Prosím o kontrolu logu - Zasekávání a vypínání myši Vyřešeno

[SoNyX]

Problém: Zasekávání a vypínání myši

LOG z HJT
---------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:59:30, on 19.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60076
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Update ESET's licence.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7936332984
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: TP-LINK Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O24 - Desktop Component 0: (no name) - http://static3-eu.webnode.com/_system/s ... generic.js

--
End of file - 9831 bytes

[Reklama]

[Damned]

Pokud máš komletní ESS, nepotřebuješ Spyware Terminatora.

Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou, zmáčknout
"Fix checked"):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O24 - Desktop Component 0: (no name) - http://static3-eu.webnode.com/_system/s ... generic.js
****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[SoNyX]

Prosím Vás nevíte někdo jak smazat obsah složky C:\Document and settings\[Profil]\local settings\temporary internet files\content.ie5\ ?
Pod touto složkou jsou další složky, ale jsou neviditelné a nepomůže ani zviditelnění složek a souborů. Vlastnosti složky content.ie5 mi nasbírali kolem 30 000 souborů a teď mi to Malwarebytes' Anti-Malware vše kontroluje a celkem to trvá.

EDIT: Teď skončil a tady máte ten log :)
-------------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.39
Verze databáze: 2462
Windows 5.1.2600 Service Pack 3

19.7.2009 18:19:24
mbam-log-2009-07-19 (18-19-21).txt

Typ skenu: Rychlý sken
Objektu skenováno: 120618
Uplynulý cas: 24 minute(s), 49 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[Damned]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
*****************************************************************************************************************************************
Potom spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[SoNyX]

Tak tady je log po odstranění co sám vyskočil z MbAM:
-----------------------------------------------------------------------------------
Malwarebytes' Anti-Malware 1.39
Verze databáze: 2462
Windows 5.1.2600 Service Pack 3

20.7.2009 15:53:39
mbam-log-2009-07-20 (15-53-39).txt

Typ skenu: Rychlý sken
Objektu skenováno: 85443
Uplynulý cas: 2 minute(s), 0 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

EDIT:

+ Log z ComboFix:
-----------------------------------------------------------------------------------
ComboFix 09-07-19.04 - Owner 20.07.2009 16:07.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2495.1994 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\1e56b5a.msi

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-06-20 do 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-19 16:42 . 2009-07-19 16:43 -------- d-----w- c:\program files\CCleaner
2009-07-19 14:47 . 2009-07-19 14:47 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2009-07-19 14:23 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 14:23 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 14:23 . 2009-07-19 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-18 15:54 . 2009-07-18 15:54 -------- d-----w- c:\program files\Trend Micro
2009-07-17 19:25 . 2009-07-19 17:47 -------- d-----w- c:\program files\Steam
2009-07-17 17:43 . 2008-12-30 22:43 487479 ----a-w- c:\windows\system32\SkinMagic.dll
2009-07-17 17:43 . 2008-12-30 22:43 23480 ----a-w- c:\windows\system32\drivers\wip0204.sys
2009-07-17 17:43 . 2009-07-17 17:44 -------- d-----w- c:\program files\Wippien
2009-07-17 07:40 . 2009-07-17 07:48 -------- d-----w- c:\program files\InterActual
2009-07-16 17:12 . 2001-08-17 19:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
2009-07-16 17:12 . 2001-08-17 19:53 4992 ----a-w- c:\windows\system32\drivers\loop.sys
2009-07-14 13:59 . 2009-07-14 13:59 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-13 16:48 . 2005-01-22 19:12 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2009-07-13 16:41 . 2009-07-13 16:42 -------- d-----w- c:\program files\WinPcap
2009-07-13 16:41 . 2009-07-14 12:04 -------- d-----w- c:\program files\WC3Banlist
2009-07-13 14:52 . 2002-03-25 16:44 722192 ----a-w- c:\windows\system32\VB40032.DLL
2009-07-13 14:52 . 2002-03-25 16:44 60416 ----a-w- c:\windows\ST4UNST.EXE
2009-07-13 14:52 . 2002-03-25 16:44 171520 ----a-w- c:\windows\setup132.exe
2009-07-12 10:16 . 2009-07-12 10:16 -------- d-----w- c:\program files\Advanced Port Scanner
2009-07-11 12:32 . 2009-07-15 19:11 -------- d-----w- C:\SC BW
2009-07-10 16:46 . 2009-07-10 16:46 -------- d-----w- c:\program files\ICCup
2009-07-10 16:39 . 2009-07-13 15:07 -------- d-----w- C:\StarCraft Broodwar
2009-07-09 17:53 . 2009-07-12 10:06 -------- d-----w- c:\program files\ESET
2009-07-09 16:55 . 2009-07-09 16:55 -------- d-----w- c:\program files\Uniblue
2009-07-09 13:17 . 2001-10-24 09:54 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-07-09 13:17 . 2001-10-24 09:54 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-07-09 13:05 . 2008-04-13 18:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-07-09 13:05 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-07-06 17:38 . 2009-07-06 17:38 -------- d-----w- c:\windows\Eurobattle.net
2009-07-06 17:24 . 2009-07-06 18:15 78581 ----a-w- c:\windows\War3Unin.dat
2009-07-06 17:24 . 2009-07-06 17:39 2829 ----a-w- c:\windows\War3Unin.pif
2009-07-06 17:24 . 2009-07-06 17:39 139264 ----a-w- c:\windows\War3Unin.exe
2009-07-06 17:21 . 2009-07-18 17:50 -------- d-----w- c:\program files\Warcraft III
2009-07-04 14:24 . 2009-07-04 14:24 -------- d-----w- C:\DriveKey
2009-07-04 10:03 . 2009-07-12 16:05 -------- d-----w- c:\program files\Norton Security Scan
2009-06-27 19:40 . 2009-06-27 19:42 -------- d-----w- c:\program files\Cerberus
2009-06-26 16:42 . 2009-06-26 16:42 -------- d-----w- c:\windows\system32\xlive

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 12:53 . 2009-04-11 13:15 -------- d-----w- c:\program files\NCH Software
2009-07-17 07:57 . 2009-06-08 17:32 -------- d-----w- c:\program files\The KMPlayer
2009-07-10 09:01 . 2009-03-24 21:51 -------- d-----w- c:\program files\Spyware Terminator
2009-07-05 15:57 . 2009-04-17 17:28 -------- d-----w- c:\program files\GamePark
2009-07-04 14:24 . 2009-03-24 21:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-04 14:23 . 2009-03-24 21:27 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-02 18:10 . 2009-03-24 22:49 -------- d-----w- c:\program files\Valve
2009-06-19 18:53 . 2009-06-19 18:50 -------- d-----w- c:\program files\QIP Infium
2009-06-18 17:56 . 2009-06-18 17:56 -------- d-----w- c:\program files\AnyUtils
2009-06-18 13:58 . 2009-06-18 13:58 -------- d-----w- c:\program files\Bonjour
2009-06-18 13:58 . 2009-03-25 08:57 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-17 20:55 . 2009-06-17 20:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-16 14:40 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2006-03-02 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 14:39 . 2009-06-15 14:39 -------- d-----w- c:\program files\Sony Ericsson
2009-06-09 08:35 . 2009-06-20 17:16 20640 ----a-w- c:\windows\Fonts\ICE_AGE.ttf
2009-06-08 17:18 . 2009-06-08 17:18 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-08 17:00 . 2009-06-08 17:00 -------- d-----w- c:\program files\QuickTime
2009-06-08 17:00 . 2009-06-08 16:59 -------- d-----w- c:\program files\Apple Software Update
2009-06-06 11:01 . 2009-06-06 11:01 -------- d-----w- c:\program files\Mozilla FirefoxPlugins
2009-06-03 19:11 . 2006-03-02 12:00 1293824 ----a-w- c:\windows\system32\quartz.dll
2009-05-30 13:37 . 2009-03-25 06:56 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-25 15:00 . 2009-05-25 14:59 -------- d-----w- c:\program files\Hide Your IP Address
2009-05-23 08:50 . 2009-05-23 08:34 -------- d-----w- c:\program files\Scorpions WinCheater
2009-05-18 19:39 . 2009-05-18 19:35 5267 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-05-18 19:39 . 2009-03-24 22:18 72066 ----a-w- c:\windows\BricoPackUninst.cmd
2009-05-14 13:49 . 2009-05-14 13:49 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-05-14 13:49 . 2009-05-14 13:49 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2009-05-14 13:49 . 2009-05-14 13:49 133000 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-05-14 13:47 . 2009-05-14 13:47 107256 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-05-14 13:41 . 2009-05-14 13:41 114472 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-05-13 05:05 . 2006-03-02 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:33 . 2006-03-02 12:00 346624 ----a-w- c:\windows\system32\localspl.dll
2009-06-14 14:07 . 2009-03-24 21:43 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-08-01 222592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-07-10 2173440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-06 16262656]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Update ESET's licence.lnk - c:\program files\ESET\MiNODLogin\MiNODLogin.exe [2009-5-3 125952]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\SHOUTcast\\sc_serv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Total Commander\\TOTALCMD.EXE"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Age Of Empires II The Conquerors Expansion\\Age2_x1\\age2_x1.exe"=
"c:\\Program Files\\Ares\\chatServer.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Cerberus\\Cerberus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Download\\Hry\\CS 1.6 Portable\\Counter Strike 1.6 Portable\\root\\cstrike.exe"=
"c:\\Download\\Hry\\CS 1.6 Portable\\Counter Strike 1.6 Portable\\root\\hl.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Warcraft III\\Ghost11\\ghost.exe"=
"c:\\Program Files\\Warcraft III\\Ghost11\\GHostOne.exe"=
"c:\\Program Files\\Wippien\\Wippien.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\day of defeat\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\condition zero\\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:192.168.1.101/255.255.255.255:Enabled:@xpsp2res.dll,-22004
"6112:TCP"= 6112:TCP:Battle.net
"6112:UDP"= 6112:UDP:Battle.net
"80:UDP"= 80:UDP:80
"8000:TCP"= 8000:TCP:Vysílání
"8000:UDP"= 8000:UDP:Vysílání
"8001:TCP"= 8001:TCP:Vysílání
"8001:UDP"= 8001:UDP:Vysílání
"6113:TCP"= 6113:TCP:GHost
"6113:UDP"= 6113:UDP:GHost
"5900:TCP"= 5900:TCP:VNC
"5900:UDP"= 5900:UDP:VNC

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [24.3.2009 23:52 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 15:47 731840]
R3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [17.7.2009 19:43 23480]
R3 ZD1211BU(TP-LINK);TL-WN422G Wireless USB Adapter Driver(TP-LINK);c:\windows\system32\drivers\ZD1211BU.sys [16.4.2009 14:15 500736]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2.8.2005 23:10 32512]
S3 PAC7302;iSlim 310;c:\windows\system32\drivers\PAC7302.SYS [18.4.2009 14:48 458112]
S3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [16.4.2009 12:22 55840]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE:
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... -us&query=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... -us&query=
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\extensions\{12e4c684-c03e-4e4d-85bc-0c065e7a9489}\components\WinampPlayer.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdrmv2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdsplay.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwmsdrm.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 16:11
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-299502267-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
Celkový čas: 2009-07-20 16:13
ComboFix-quarantined-files.txt 2009-07-20 14:12

Před spuštěním: Volných bajtů: 19 404 394 496
Po spuštění: Volných bajtů: 19 398 610 944

235 --- E O F --- 2009-07-15 19:55

[Damned]

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[SoNyX]

Dotaz, to mám zas udělat znova ?
-----------------------------------------------------------------------------
ComboFix 09-07-19.04 - Owner 20.07.2009 17:05.2.1 - NTFSx86
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-06-20 do 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-19 16:42 . 2009-07-19 16:43 -------- d-----w- c:\program files\CCleaner
2009-07-19 14:47 . 2009-07-19 14:47 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2009-07-19 14:23 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 14:23 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 14:23 . 2009-07-19 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-18 15:54 . 2009-07-18 15:54 -------- d-----w- c:\program files\Trend Micro
2009-07-17 19:25 . 2009-07-19 17:47 -------- d-----w- c:\program files\Steam
2009-07-17 17:43 . 2008-12-30 22:43 487479 ----a-w- c:\windows\system32\SkinMagic.dll
2009-07-17 17:43 . 2008-12-30 22:43 23480 ----a-w- c:\windows\system32\drivers\wip0204.sys
2009-07-17 17:43 . 2009-07-17 17:44 -------- d-----w- c:\program files\Wippien
2009-07-17 07:40 . 2009-07-17 07:48 -------- d-----w- c:\program files\InterActual
2009-07-16 17:12 . 2001-08-17 19:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
2009-07-16 17:12 . 2001-08-17 19:53 4992 ----a-w- c:\windows\system32\drivers\loop.sys
2009-07-14 13:59 . 2009-07-14 13:59 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-13 16:48 . 2005-01-22 19:12 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2009-07-13 16:41 . 2009-07-13 16:42 -------- d-----w- c:\program files\WinPcap
2009-07-13 16:41 . 2009-07-14 12:04 -------- d-----w- c:\program files\WC3Banlist
2009-07-13 14:52 . 2002-03-25 16:44 722192 ----a-w- c:\windows\system32\VB40032.DLL
2009-07-13 14:52 . 2002-03-25 16:44 60416 ----a-w- c:\windows\ST4UNST.EXE
2009-07-13 14:52 . 2002-03-25 16:44 171520 ----a-w- c:\windows\setup132.exe
2009-07-12 10:16 . 2009-07-12 10:16 -------- d-----w- c:\program files\Advanced Port Scanner
2009-07-11 12:32 . 2009-07-15 19:11 -------- d-----w- C:\SC BW
2009-07-10 16:46 . 2009-07-10 16:46 -------- d-----w- c:\program files\ICCup
2009-07-10 16:39 . 2009-07-13 15:07 -------- d-----w- C:\StarCraft Broodwar
2009-07-09 17:53 . 2009-07-12 10:06 -------- d-----w- c:\program files\ESET
2009-07-09 16:55 . 2009-07-09 16:55 -------- d-----w- c:\program files\Uniblue
2009-07-09 13:17 . 2001-10-24 09:54 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-07-09 13:17 . 2001-10-24 09:54 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-07-09 13:05 . 2008-04-13 18:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-07-09 13:05 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-07-06 17:38 . 2009-07-06 17:38 -------- d-----w- c:\windows\Eurobattle.net
2009-07-06 17:24 . 2009-07-06 18:15 78581 ----a-w- c:\windows\War3Unin.dat
2009-07-06 17:24 . 2009-07-06 17:39 2829 ----a-w- c:\windows\War3Unin.pif
2009-07-06 17:24 . 2009-07-06 17:39 139264 ----a-w- c:\windows\War3Unin.exe
2009-07-06 17:21 . 2009-07-18 17:50 -------- d-----w- c:\program files\Warcraft III
2009-07-04 14:24 . 2009-07-04 14:24 -------- d-----w- C:\DriveKey
2009-07-04 10:03 . 2009-07-12 16:05 -------- d-----w- c:\program files\Norton Security Scan
2009-06-27 19:40 . 2009-06-27 19:42 -------- d-----w- c:\program files\Cerberus
2009-06-26 16:42 . 2009-06-26 16:42 -------- d-----w- c:\windows\system32\xlive

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 12:53 . 2009-04-11 13:15 -------- d-----w- c:\program files\NCH Software
2009-07-17 07:57 . 2009-06-08 17:32 -------- d-----w- c:\program files\The KMPlayer
2009-07-10 09:01 . 2009-03-24 21:51 -------- d-----w- c:\program files\Spyware Terminator
2009-07-05 15:57 . 2009-04-17 17:28 -------- d-----w- c:\program files\GamePark
2009-07-04 14:24 . 2009-03-24 21:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-04 14:23 . 2009-03-24 21:27 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-02 18:10 . 2009-03-24 22:49 -------- d-----w- c:\program files\Valve
2009-06-19 18:53 . 2009-06-19 18:50 -------- d-----w- c:\program files\QIP Infium
2009-06-18 17:56 . 2009-06-18 17:56 -------- d-----w- c:\program files\AnyUtils
2009-06-18 13:58 . 2009-06-18 13:58 -------- d-----w- c:\program files\Bonjour
2009-06-18 13:58 . 2009-03-25 08:57 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-17 20:55 . 2009-06-17 20:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-16 14:40 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2006-03-02 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 14:39 . 2009-06-15 14:39 -------- d-----w- c:\program files\Sony Ericsson
2009-06-09 08:35 . 2009-06-20 17:16 20640 ----a-w- c:\windows\Fonts\ICE_AGE.ttf
2009-06-08 17:18 . 2009-06-08 17:18 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-08 17:00 . 2009-06-08 17:00 -------- d-----w- c:\program files\QuickTime
2009-06-08 17:00 . 2009-06-08 16:59 -------- d-----w- c:\program files\Apple Software Update
2009-06-06 11:01 . 2009-06-06 11:01 -------- d-----w- c:\program files\Mozilla FirefoxPlugins
2009-06-03 19:11 . 2006-03-02 12:00 1293824 ----a-w- c:\windows\system32\quartz.dll
2009-05-30 13:37 . 2009-03-25 06:56 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-25 15:00 . 2009-05-25 14:59 -------- d-----w- c:\program files\Hide Your IP Address
2009-05-23 08:50 . 2009-05-23 08:34 -------- d-----w- c:\program files\Scorpions WinCheater
2009-05-18 19:39 . 2009-05-18 19:35 5267 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-05-18 19:39 . 2009-03-24 22:18 72066 ----a-w- c:\windows\BricoPackUninst.cmd
2009-05-14 13:49 . 2009-05-14 13:49 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-05-14 13:49 . 2009-05-14 13:49 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2009-05-14 13:49 . 2009-05-14 13:49 133000 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-05-14 13:47 . 2009-05-14 13:47 107256 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-05-14 13:41 . 2009-05-14 13:41 114472 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-05-13 05:05 . 2006-03-02 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:33 . 2006-03-02 12:00 346624 ----a-w- c:\windows\system32\localspl.dll
2009-06-14 14:07 . 2009-03-24 21:43 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-08-01 222592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-07-10 2173440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-06 16262656]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Update ESET's licence.lnk - c:\program files\ESET\MiNODLogin\MiNODLogin.exe [2009-5-3 125952]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\SHOUTcast\\sc_serv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Total Commander\\TOTALCMD.EXE"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Age Of Empires II The Conquerors Expansion\\Age2_x1\\age2_x1.exe"=
"c:\\Program Files\\Ares\\chatServer.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Cerberus\\Cerberus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Download\\Hry\\CS 1.6 Portable\\Counter Strike 1.6 Portable\\root\\cstrike.exe"=
"c:\\Download\\Hry\\CS 1.6 Portable\\Counter Strike 1.6 Portable\\root\\hl.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Warcraft III\\Ghost11\\ghost.exe"=
"c:\\Program Files\\Warcraft III\\Ghost11\\GHostOne.exe"=
"c:\\Program Files\\Wippien\\Wippien.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\day of defeat\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\nutty123\\condition zero\\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:192.168.1.101/255.255.255.255:Enabled:@xpsp2res.dll,-22004
"6112:TCP"= 6112:TCP:Battle.net
"6112:UDP"= 6112:UDP:Battle.net
"80:UDP"= 80:UDP:80
"8000:TCP"= 8000:TCP:Vysílání
"8000:UDP"= 8000:UDP:Vysílání
"8001:TCP"= 8001:TCP:Vysílání
"8001:UDP"= 8001:UDP:Vysílání
"6113:TCP"= 6113:TCP:GHost
"6113:UDP"= 6113:UDP:GHost
"5900:TCP"= 5900:TCP:VNC
"5900:UDP"= 5900:UDP:VNC

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [24.3.2009 23:52 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 15:47 731840]
R3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [17.7.2009 19:43 23480]
R3 ZD1211BU(TP-LINK);TL-WN422G Wireless USB Adapter Driver(TP-LINK);c:\windows\system32\drivers\ZD1211BU.sys [16.4.2009 14:15 500736]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2.8.2005 23:10 32512]
S3 PAC7302;iSlim 310;c:\windows\system32\drivers\PAC7302.SYS [18.4.2009 14:48 458112]
S3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [16.4.2009 12:22 55840]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE:
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... -us&query=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... -us&query=
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\extensions\{12e4c684-c03e-4e4d-85bc-0c065e7a9489}\components\WinampPlayer.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\4rjh5hdr.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdrmv2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdsplay.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwmsdrm.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 17:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-299502267-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(912)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-07-20 17:09
ComboFix-quarantined-files.txt 2009-07-20 15:08
ComboFix2.txt 2009-07-20 14:13

Před spuštěním: Volných bajtů: 19 415 130 112
Po spuštění: Volných bajtů: 19 407 577 088

244 --- E O F --- 2009-07-15 19:55

[Damned]

Omlouvám se.
Tato složka by měla být prázdná: C:\Document and settings\[Profil]\local settings\temporary internet files\content.ie5.
Ovladače k myši tam máš, zkus ve Správci zařízení "Myš a jiná...", klikni na svou myš pravým a Vlastnosti - Upřesnit nastavení (výchozí) a pak nech aktualizovat ovladač.
Šmejdy jsme odstranili.
*****************************************************************************************************************************************
Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

Vyčisti systém CCleanerem a použij i T-Cleaner smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž
a zapni si AVG.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Pak mi sem ještě vlož log z HJT

[SoNyX]

Cleanery sem použil už dříve. Díky za pomoc a AVG nemám, jelikož mám na něj svůj názor
Na tu myš se juknu. Zkusím otestovat, jestli to náhodou nakonec nebylo tím drátem.