Kontrola Logu HJT Vyřešeno

[Ferda Mravenec]

ComboFix 09-05-23.04 - David a Gábina 24.05.2009 19:44.5 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.738 [GMT 2:00]
Spuštěný z: c:\documents and settings\David a Gábina\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\David a Gábina\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Vytvořen nový Bod Obnovení
* Resident AV is active

.

((((((((((((((((((((((((( Soubory vytvořené od 2009-04-24 do 2009-05-24 )))))))))))))))))))))))))))))))
.

2009-05-23 00:10 . 2009-05-23 00:10 -------- d-----w c:\windows\system32\Nová složka
2009-05-22 21:29 . 2009-05-22 21:29 -------- d-----w c:\program files\VS Revo Group
2009-05-22 20:52 . 2009-05-22 20:52 -------- d-----w c:\program files\Trend Micro
2009-05-22 20:10 . 2009-05-22 20:10 -------- d---a-w c:\windows\system32\runouce.exe
2009-05-22 20:06 . 2009-05-22 20:06 626688 ----a-w c:\windows\system32\msvcr80.dll
2009-05-22 20:06 . 2009-05-22 20:06 548864 ----a-w c:\windows\system32\msvcp80.dll
2009-05-22 20:06 . 2009-05-22 20:06 28672 ----a-w c:\windows\system32\eEmpty.exe
2009-05-22 20:06 . 2008-04-14 08:52 137216 ----a-w c:\windows\system32\T.COM
2009-05-22 20:06 . 2008-04-14 08:52 147968 ----a-w c:\windows\R.COM
2009-05-22 20:06 . 2009-05-22 20:06 -------- d-----w c:\program files\Common Files\MicroWorld
2009-05-18 00:00 . 2009-05-18 00:11 -------- d-----w c:\documents and settings\All Users\CyberLink
2009-05-17 11:02 . 2009-05-17 11:03 -------- d-----w c:\program files\Wonderburg
2009-05-17 10:59 . 2009-05-17 10:59 -------- d-----w c:\program files\Virtual Families
2009-05-17 10:57 . 2009-05-17 10:57 -------- d-----w c:\program files\Kitten Sanctuary
2009-05-17 10:51 . 2009-05-17 10:52 -------- d-----w c:\program files\The Serpent of Isis
2009-05-17 10:30 . 2009-05-17 10:31 -------- d-----w c:\program files\Hot Dish
2009-05-16 22:34 . 2009-05-16 22:34 -------- d-----w c:\program files\SmartSound Software
2009-05-15 21:59 . 2009-05-15 22:01 -------- d-----w c:\program files\The Stone of Destiny
2009-05-05 20:08 . 2008-04-13 20:16 51200 -c----w c:\windows\system32\dllcache\msdv.sys
2009-05-05 20:08 . 2008-04-13 20:16 51200 ------w c:\windows\system32\drivers\msdv.sys
2009-05-05 20:08 . 2008-04-13 20:16 38912 -c----w c:\windows\system32\dllcache\avc.sys
2009-05-05 20:08 . 2008-04-13 20:16 38912 ------w c:\windows\system32\drivers\avc.sys
2009-05-05 19:42 . 2004-09-03 17:41 212992 ------w c:\windows\system32\DVCONFIG.DLL
2009-05-05 19:42 . 2004-08-30 13:40 102400 ------w c:\windows\system32\PCDV32.dll
2009-05-05 19:42 . 2004-07-15 20:57 61440 ------w c:\windows\system32\pcdvcodc.dll
2009-05-05 19:41 . 2003-02-12 15:00 73728 ------w c:\windows\system32\dxo.dll
2009-05-05 19:41 . 1999-09-27 14:11 20992 ------w c:\windows\system32\pcdvdd.dll
2009-05-05 18:37 . 2009-05-05 18:37 -------- d-----w c:\program files\PIXELA
2009-05-05 18:37 . 2009-05-05 18:37 -------- d-----w C:\Drivers
2009-05-05 18:37 . 2002-10-15 20:41 102220 ------w c:\windows\system32\drivers\sonypvs1.sys
2009-05-05 18:37 . 2001-11-05 07:23 299923 ------w c:\windows\system32\drivers\sonyhcs.sys
2009-05-05 18:37 . 2001-11-05 07:23 38739 ------w c:\windows\system32\drivers\sonyhcc.sys
2009-05-05 18:37 . 2001-11-05 07:23 6097 ------w c:\windows\system32\drivers\sonyhcb.sys
2009-05-05 18:37 . 2001-07-03 18:39 3654 ------w c:\windows\system32\drivers\Sonyhcp.dll
2009-05-05 18:37 . 2001-07-03 18:33 53248 ------w c:\windows\system32\SONYHCY.DLL
2009-05-05 18:35 . 1998-06-17 22:00 89360 ------w c:\windows\system32\VB5DB.DLL
2009-05-05 18:35 . 2004-03-08 10:55 13567 ------w c:\windows\system32\drivers\CDRBSDRV.SYS
2009-05-05 18:24 . 2008-04-13 20:16 48128 -c----w c:\windows\system32\dllcache\61883.sys
2009-05-05 18:24 . 2008-04-13 20:16 48128 ------w c:\windows\system32\drivers\61883.sys
2009-05-05 16:12 . 2009-05-05 16:12 -------- d-----w c:\program files\Moje cukrárna
2009-05-01 23:06 . 2009-05-01 23:08 -------- d-----w c:\program files\Cindys Fashion World
2009-04-29 20:03 . 2006-10-18 17:43 115960 ------w c:\windows\system32\PxCpyI64.exe
2009-04-29 20:02 . 2009-04-29 20:23 -------- d-----w c:\program files\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-24 08:00 . 2009-03-11 08:09 -------- d-----w c:\program files\WinClamAVShield
2009-05-23 11:40 . 2009-03-11 08:07 -------- d-----w c:\program files\Spyware Terminator
2009-05-22 23:50 . 2001-10-25 16:00 82836 ----a-w c:\windows\system32\perfc005.dat
2009-05-22 23:50 . 2001-10-25 16:00 438288 ----a-w c:\windows\system32\perfh005.dat
2009-05-22 22:44 . 2009-03-07 01:22 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-22 20:12 . 2008-09-09 20:07 -------- d--h--w c:\program files\Izrhnockivjnj
2009-05-16 23:11 . 2009-01-04 12:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-16 22:41 . 2009-01-20 07:12 -------- d-----w c:\program files\CyberLink
2009-05-14 21:05 . 2009-03-03 21:40 -------- d-----w c:\program files\Pinnacle
2009-05-14 21:02 . 2009-03-20 21:31 -------- d-----w c:\program files\Boris FX, Inc
2009-05-05 19:46 . 2009-03-25 14:24 -------- d-----w c:\program files\Canopus
2009-05-05 19:42 . 2009-02-14 22:48 -------- d-----w c:\program files\Common Files\Canopus Shared
2009-05-05 18:36 . 2009-05-05 18:36 -------- d-----w c:\program files\Sony Corporation
2009-05-05 18:36 . 2009-05-05 18:36 -------- d-----w c:\program files\Common Files\muvee Technologies
2009-05-01 13:38 . 2009-03-07 09:38 -------- d-----w c:\program files\Barbie(TM)
2009-04-28 00:39 . 2009-03-11 08:04 410984 ------w c:\windows\system32\deploytk.dll
2009-04-28 00:39 . 2009-01-05 18:17 -------- d-----w c:\program files\Java
2009-04-23 08:46 . 2009-02-10 21:43 -------- d-----w c:\program files\RealArcade
2009-04-15 18:32 . 2009-04-15 18:24 -------- d-----w c:\program files\eMule
2009-04-14 14:48 . 2009-04-14 14:47 -------- d-----w c:\program files\Módní salón
2009-04-13 14:26 . 2009-04-13 14:23 -------- d-----w c:\program files\Moje farma
2009-04-12 22:17 . 2009-04-12 22:17 -------- d-----w c:\program files\Free WMA to MP3 Converter
2009-04-12 22:05 . 2009-01-04 22:34 -------- d-----w c:\program files\Eset
2009-04-09 04:55 . 2009-04-09 04:55 -------- d-----w c:\program files\MSConfig CleanUp
2009-04-08 08:01 . 2009-01-31 01:18 -------- d-----w c:\program files\PeerGuardian2
2009-04-06 20:16 . 2009-04-06 20:16 -------- d-----w c:\program files\GMX Media
2009-04-06 13:32 . 2009-03-07 01:22 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2009-03-07 01:22 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-30 20:01 . 2009-03-30 20:01 -------- d-----w c:\program files\Common Files\Snell & Wilcox Shared
2009-03-30 19:59 . 2009-03-30 19:59 -------- d-----w c:\program files\Grass Valley
2009-03-30 19:59 . 2009-03-30 19:59 -------- d-----w c:\program files\Common Files\Grass Valley
2009-03-29 18:25 . 2009-01-04 22:34 512096 ------w c:\windows\system32\drivers\amon.sys
2009-03-29 18:25 . 2009-01-04 22:34 298104 ------w c:\windows\system32\imon.dll
2009-03-29 18:25 . 2009-03-29 18:27 15424 ------w c:\windows\system32\drivers\nod32drv.sys
2009-03-29 08:44 . 2009-03-28 20:55 81984 ------w c:\windows\system32\bdod.bin
2009-03-11 08:07 . 2009-03-11 08:07 142592 ------w c:\windows\system32\drivers\sp_rsdrv2.sys
2009-03-08 00:26 . 2009-01-07 16:52 107888 ------w c:\windows\system32\CmdLineExt.dll
2009-03-04 23:25 . 2009-03-04 23:25 6656 ------w c:\windows\system32\haspvdd.dll
2009-03-04 23:25 . 2009-03-04 23:25 47616 ------w c:\windows\system32\drivers\Haspnt.sys
2009-03-04 23:25 . 2009-03-04 23:25 383 ------w c:\windows\system32\haspdos.sys
2009-02-10 21:42 . 2009-02-10 21:42 135168 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\Izrhnockivjnj ----

2009-03-20 20:08 . 2009-05-22 20:12 519490 ----a-w c:\program files\Izrhnockivjnj\Log\Text\aiotxt.dat
2009-03-20 20:48 . 2009-05-22 20:05 389832 ----a-w c:\program files\Izrhnockivjnj\Log\Text\aioweb.dat
2009-05-19 22:00 . 2009-05-20 21:59 118525966 ----a-w c:\program files\Izrhnockivjnj\Log\Visual\05202009.dat
2009-05-20 22:00 . 2009-05-21 21:59 118153483 ----a-w c:\program files\Izrhnockivjnj\Log\Visual\05212009.dat
2009-05-21 22:00 . 2009-05-22 20:11 221184402 ----a-w c:\program files\Izrhnockivjnj\Log\Visual\05222009.dat


------- Sigcheck -------

[-] 2008-04-27 10:22 1571840 1E603EA2A3FDBAE9E5B88A8CB3C03124 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-22_23.14.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-23 16:42 . 2009-05-23 16:42 16384 c:\windows\temp\Perflib_Perfdata_1c0.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 71444 c:\windows\system32\perfc009.dat
+ 2001-10-25 16:00 . 2009-05-22 23:50 71444 c:\windows\system32\perfc009.dat
- 2009-01-03 23:38 . 2009-05-17 06:21 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-03 23:38 . 2009-05-23 04:27 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-03 23:38 . 2009-05-23 04:27 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-03 23:38 . 2009-05-17 06:21 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 441760 c:\windows\system32\perfh009.dat
+ 2001-10-25 16:00 . 2009-05-22 23:50 441760 c:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-03-11 2233856]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-03-29 949376]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-16 198160]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-1-4 585728]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\TC UP\\PLUGINS\\Media\\uTorrent\\utorrent.exe"=
"e:\\emule\\emule.exe"=
"e:\\uTorrent\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\CorresBurn\\CorresBurn.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\eMule\\emule.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pe3anmue;Ubersoldier 2 Environment Driver (pe3anmue);c:\windows\system32\drivers\pe3anmue.sys [21.2.2008 10:38 65152]
R0 ps7anmue;Ubersoldier 2 Synchronization Driver (ps7anmue);c:\windows\system32\drivers\ps7anmue.sys [21.2.2008 10:37 68744]
R1 atitray;atitray;c:\program files\ATI Tray Tools\atitray.sys [22.5.2007 11:04 18088]
R1 cdrblock;cdrblock;c:\windows\system32\drivers\cdrblock.sys [22.3.2009 23:04 20864]
R1 cdrport;cdrport;c:\windows\system32\drivers\cdrport.sys [22.3.2009 23:04 4608]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [29.3.2009 20:27 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [11.3.2009 10:07 142592]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 15:00 15872]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [7.10.2008 21:31 61424]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [4.1.2009 14:47 193792]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [4.1.2009 14:52 9600]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [4.1.2009 14:48 37120]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 20:19 13592]
S2 gupdate1c99b98f91fb050;Služba Google Update (gupdate1c99b98f91fb050);c:\program files\Google\Update\GoogleUpdate.exe [3.3.2009 2:42 133104]
S2 pr2anmue;Ubersoldier 2 Drivers Auto Removal (pr2anmue);c:\windows\system32\pr2anmue.exe svc --> c:\windows\system32\pr2anmue.exe svc [?]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [10.1.2009 0:12 9446]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
LSP: imon.dll
TCP: {E4360D32-AE1E-4366-821A-CA1BDA1B8971} = 82.114.192.15,82.114.192.6
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\David a Gábina\Data aplikací\Mozilla\Firefox\Profiles\wo54vkrg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... pab&query=
FF - component: c:\documents and settings\David a Gábina\Data aplikací\Mozilla\Firefox\Profiles\wo54vkrg.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-24 19:47
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1292428093-2000478354-682003330-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A2A1BB06-65AE-B418-D78E-048631AB10FF}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jadikhcijpbkeijkdgam"=hex:62,61,70,63,00,00
"jadikhcijpbkeijkdgel"=hex:62,61,66,67,00,00
"iadhomjkehiiegiagn"=hex:6b,61,61,67,70,70,66,6e,67,6e,63,65,66,6a,65,6a,6f,63,
6e,63,6b,64,00,00
"hapeojjpnnnneoec"=hex:6b,61,67,68,61,70,6a,62,61,69,62,65,68,6f,6a,62,68,6a,
62,65,68,69,00,00
"jaoedkhfbhnabaieapgb"=hex:6f,61,65,69,6d,65,69,70,62,66,6f,69,67,6f,6c,6e,6a,
6b,6d,6b,64,6e,6c,6c,6a,6b,64,64,62,6f,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,80,96,45,e5,fc,
8d,d8,9d,e2,63,26,f1,3f,c8,ff,68,c9,6c,f5,35,a8,99,b7,b2,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,8e,e0,1d,9c,77,
3e,e0,c5,6a,9c,d6,61,af,45,84,18,f2,8f,c0,5c,a2,6e,93,77,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,e5,14,cc,55,6c,
ae,8b,ac,ff,7c,85,e0,43,d4,0e,fe,1a,44,17,5c,69,33,0b,1f,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,b1,b1,80,60,71,
58,73,f2,86,8c,21,01,be,91,eb,e7,c0,37,5f,d4,55,49,9a,c5,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,cd,bb,9e,28,d2,
12,a9,e4,f5,1d,4d,73,a8,13,5c,05,97,db,8e,7d,76,9c,81,2e,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,48,2f,85,28,26,
ca,ab,62,df,20,58,62,78,6b,cf,c8,db,10,b0,3e,05,86,86,0b,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A2A1BB06-65AE-B418-D78E-048631AB10FF}\InProcServer32*]
"kabhmpahldcheogimkkcoi"=hex:62,61,62,67,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,07,4f,46,3f,6b,
88,94,fe,fb,a7,78,e6,12,2f,9a,ea,94,8f,04,e3,1d,ee,91,08,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,d0,24,e9,f8,9b,
e9,40,23,01,3a,48,fc,e8,04,4a,f1,89,97,bd,06,19,94,76,d1,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,50,4c,63,28,3d,
11,50,47,f6,0f,4e,58,98,5b,89,c9,e1,8f,1a,71,48,b9,39,e2,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,ef,78,ff,d6,dc,
28,7f,39,3d,ce,ea,26,2d,45,aa,78,07,0d,14,5d,88,63,b6,54,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,e6,dd,55,30,a7,
1d,b8,e3,2a,b7,cc,b5,b9,7f,41,e7,c0,71,e0,2d,e5,5a,62,d6,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,4f,a2,e3,2e,7b,
54,73,3b,6c,43,2d,1e,aa,22,2f,9c,ca,fe,eb,d3,ed,1d,4e,85,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|˙˙˙˙¤•€|ů•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(856)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(3788)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-05-24 19:48
ComboFix-quarantined-files.txt 2009-05-24 17:48
ComboFix2.txt 2009-05-22 23:20

Před spuštěním: Volných bajtů: 19 703 468 032
Po spuštění: Volných bajtů: 19 691 954 176

321







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:43:12, on 24.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4360D32-AE1E-4366-821A-CA1BDA1B8971}: NameServer = 82.114.192.15,82.114.192.6
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Služba Google Update (gupdate1c99b98f91fb050) (gupdate1c99b98f91fb050) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ubersoldier 2 Drivers Auto Removal (pr2anmue) (pr2anmue) - City Interactive Sp z o.o. - C:\WINDOWS\system32\pr2anmue.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6531 bytes

[Reklama]

[Damned]

Dívím se, že ten keylogger tam ještě žije. Vypni si body obnovení.
Stáhni si Killbox. Spusť ho a vlož do něj cestu c:\program files\Izrhnockivjnj , objeví se ti modře napsáno Directory. Zaškrtni "Delete on reboot" a zmáčkni bílí kříž v červeným kruhu.

Po restartu zkus najít v PC tyto soubory a složku (můžou být i skryté):
csrss.exe, UninsHs.exe, .exe, vyewqzjnqwn.exe, msvmcmord.dll, mswmnmore.dll, UninsHs.dat, UninsHs.exe, msdicroed.dll, mswinroee.dll, MSTRC32.DLL, Relytec.

Pokud je najdeš, smaž je. Pokud nepůjdou opět použij Killbox (stejně). Až je odstraníš, dej sem znovu log z ComboFixu.
Až vše odstraníš, zapni si opět Body obnovení.