kontrola HJT logu (podezření na nějaký nepořádek) Vyřešeno

[Renee]

Zdravím, po krátké době od posledního čištění mi počítač zase začal podávat nepřesvědčivé výkony, rychlost kolísá, některé internetové stránky nejsou zobrazit. Podívejte se, prosím, na log z HJT. Předem děkuji!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:46:35, on 16.5.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\QIP\qip.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/stati ... 0.53.0.cab
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 3024 bytes

[Reklama]

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/stati ... 0.53.0.cab


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

[Renee]

tady log z MbAM (je to ten, co jsi chtěl? tento na mě vyskočil sám po skončení skenu, a protože jsem neviděl tlačítko Zobrazit výsledky tak jsem ho použil)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4106

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

16.5.2010 19:00:42
mbam-log-2010-05-16 (19-00-42).txt

Typ skenu: Rychlý sken
Skenované objekty: 121862
Uplynulý čas: 5 minuta(y), 41 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

[Renee]

po restartu se mi zdá, že je vše o něco rychlejší.
log:

ComboFix 10-05-16.01 - Renee 16.05.2010 21:30:39.3.1 - x86
Microsoft Windows 7 Enterprise 6.1.7600.0.1250.420.1029.18.2048.1403 [GMT 2:00]
Spuštěný z: c:\users\Renee\Desktop\ComboFix.exe
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-04-16 do 2010-05-16 )))))))))))))))))))))))))))))))
.

2010-05-16 19:36 . 2010-05-16 19:36 -------- d-----w- c:\users\Renee\AppData\Local\temp
2010-05-16 19:36 . 2010-05-16 19:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-15 16:46 . 2010-05-15 16:46 -------- d--h--r- c:\users\Renee\AppData\Roaming\SecuROM
2010-05-15 16:46 . 2010-05-15 16:46 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-15 15:24 . 2010-05-15 15:24 -------- d-----w- c:\program files\SEGA
2010-05-15 14:02 . 2007-03-22 10:46 126976 ----a-w- c:\users\Renee\AppData\Roaming\GRETECH\GomPlayer\GrLauncher.exe
2010-05-13 19:10 . 2010-05-13 19:14 -------- d-----w- c:\program files\GoldWave
2010-05-12 10:44 . 2010-03-04 07:33 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-06 19:52 . 2010-05-06 19:55 -------- d-----w- c:\users\Renee\AppData\Roaming\uTorrent
2010-05-03 15:29 . 2010-05-03 15:30 -------- d-----w- c:\program files\GIMP-2.0
2010-05-01 22:19 . 2010-05-01 22:42 -------- d-----w- c:\program files\Castle Strike
2010-05-01 13:07 . 2010-05-01 13:41 -------- d-----w- c:\program files\Ground Control II
2010-04-30 21:02 . 2010-05-01 13:26 -------- d-----w- C:\pch
2010-04-30 15:07 . 2010-04-30 15:07 -------- d-----w- c:\programdata\F-Secure
2010-04-30 14:58 . 2010-04-30 14:58 -------- d-----w- c:\windows\Sun
2010-04-30 14:58 . 2010-04-30 14:58 -------- d-----w- c:\program files\Common Files\Java
2010-04-30 14:57 . 2010-04-30 14:57 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-30 14:57 . 2010-04-30 14:57 -------- d-----w- c:\program files\Java
2010-04-30 13:09 . 2010-04-30 13:09 -------- d-----w- c:\users\Renee\DoctorWeb
2010-04-29 19:18 . 2010-04-29 19:18 0 ----a-w- c:\windows\ativpsrm.bin
2010-04-28 14:21 . 2009-09-26 05:58 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys
2010-04-28 14:21 . 2009-12-11 07:38 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-04-28 14:21 . 2009-12-11 07:44 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-26 19:57 . 2010-04-26 19:57 -------- d-----w- c:\users\Renee\AppData\Local\ESET
2010-04-26 14:03 . 2010-04-26 14:03 -------- d-----w- c:\users\Renee\AppData\Roaming\Malwarebytes
2010-04-26 14:03 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 14:03 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 14:03 . 2010-04-26 14:03 -------- d-----w- c:\programdata\Malwarebytes
2010-04-26 14:03 . 2010-05-16 16:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-25 17:41 . 2010-04-25 17:41 -------- d-----w- c:\program files\AMD
2010-04-25 17:40 . 2010-04-25 17:40 -------- d-----w- c:\users\Renee\AppData\Local\Downloaded Installations
2010-04-25 16:38 . 2010-04-25 16:38 388096 ----a-r- c:\users\Renee\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-25 16:38 . 2010-04-26 21:26 -------- d-----w- c:\program files\Trend Micro
2010-04-25 16:20 . 2010-04-25 16:24 -------- d-----w- c:\program files\RegCleaner
2010-04-25 16:09 . 2010-04-25 16:09 -------- d-----w- c:\program files\CCleaner
2010-04-25 12:37 . 2010-04-25 12:37 10134 ----a-r- c:\users\Renee\AppData\Roaming\Microsoft\Installer\{9903001D-2728-9D9B-3D8B-F593A502A972}\ARPPRODUCTICON.exe
2010-04-25 12:10 . 2009-02-17 16:22 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-04-25 12:10 . 2009-02-17 16:22 30976 ----a-w- c:\windows\system32\drivers\ATKDispLowFilter.sys
2010-04-25 12:10 . 2009-02-17 16:22 15232 ----a-w- c:\windows\system32\drivers\asusgsb.sys
2010-04-22 19:05 . 2010-04-22 19:05 -------- d-----w- c:\windows\system32\URTTEMP
2010-04-22 18:33 . 2010-04-22 18:33 -------- d-----w- c:\program files\Razor
2010-04-19 12:48 . 2010-04-19 12:48 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-04-18 18:00 . 2010-05-05 13:36 -------- d-----w- c:\users\Renee\AppData\Roaming\DMCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-16 13:33 . 2010-04-02 16:01 1 ----a-w- c:\users\Renee\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-15 21:48 . 2010-04-01 19:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-15 21:47 . 2010-04-02 10:43 -------- d-----w- c:\users\Renee\AppData\Roaming\Hamachi
2010-05-15 15:45 . 2009-07-14 08:14 631116 ----a-w- c:\windows\system32\perfh005.dat
2010-05-15 15:45 . 2009-07-14 08:14 123556 ----a-w- c:\windows\system32\perfc005.dat
2010-05-15 12:57 . 2010-04-01 21:43 -------- d-----w- c:\users\Renee\AppData\Roaming\AIMP
2010-05-15 12:00 . 2010-04-04 08:44 138184 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-05-15 12:00 . 2010-04-04 08:44 215016 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-05-12 13:55 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-05-06 08:36 . 2010-04-01 19:15 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-05 20:58 . 2010-04-02 20:35 -------- d-----w- c:\users\Renee\AppData\Roaming\gtk-2.0
2010-05-05 13:57 . 2010-04-01 19:11 64120 ----a-w- c:\users\Renee\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-28 20:28 . 2010-04-01 20:41 -------- d-----w- c:\program files\AIMP2
2010-04-25 12:27 . 2010-04-01 21:03 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-22 19:45 . 2010-04-02 21:05 -------- d-----w- c:\program files\EA Games
2010-04-19 12:49 . 2010-04-02 21:21 138056 ----a-w- c:\users\Renee\AppData\Roaming\PnkBstrK.sys
2010-04-19 12:49 . 2010-04-02 21:21 138056 ----a-w- c:\users\Renee\AppData\Roaming\PnkBstrK.sys
2010-04-15 15:55 . 2010-04-15 15:55 -------- d-----w- c:\program files\Sony Ericsson
2010-04-08 18:48 . 2010-04-08 18:13 -------- d-----w- c:\programdata\TrackMania
2010-04-08 18:13 . 2010-04-02 09:27 -------- d-----w- c:\program files\TmNationsForever
2010-04-04 08:44 . 2010-04-04 08:44 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-04-03 12:05 . 2010-04-03 12:05 -------- d-----w- c:\users\Renee\AppData\Roaming\GRETECH
2010-04-03 12:05 . 2010-04-03 12:05 -------- d-----w- c:\program files\GRETECH
2010-04-02 18:06 . 2010-04-02 18:06 -------- d-----w- c:\program files\SQUARE ENIX - Eidos Interactive
2010-04-02 16:24 . 2010-04-02 16:22 -------- d-----w- c:\program files\FootballArena
2010-04-02 16:01 . 2010-04-02 16:01 -------- d-----w- c:\users\Renee\AppData\Roaming\OpenOffice.org
2010-04-02 10:43 . 2010-04-02 10:43 -------- d-----w- c:\program files\Hamachi
2010-04-02 10:43 . 2010-04-02 10:43 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-----w- c:\users\Renee\AppData\Roaming\TuneUp Software
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-----w- c:\programdata\TuneUp Software
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-02 09:14 . 2010-04-02 09:14 -------- d-----w- c:\program files\OpenOffice.org 3
2010-04-01 23:19 . 2010-04-01 23:19 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-01 23:19 . 2010-04-01 23:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-01 23:06 . 2010-04-01 23:06 -------- d-----w- c:\program files\2K Games
2010-04-01 23:05 . 2010-04-01 22:38 -------- d-----w- c:\users\Renee\AppData\Roaming\DAEMON Tools Lite
2010-04-01 22:48 . 2010-04-01 22:48 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2010-04-01 22:41 . 2010-04-01 22:39 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-01 22:41 . 2010-04-01 22:41 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-01 22:38 . 2010-04-01 22:38 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-04-01 21:13 . 2010-04-01 21:03 -------- d-----w- c:\program files\Realtek AC97
2010-04-01 20:37 . 2010-04-01 20:37 -------- d-----w- c:\program files\QIP
2010-04-01 19:29 . 2010-04-01 19:29 -------- d-----w- c:\program files\ESET
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\users\Renee\AppData\Roaming\ATI
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\programdata\ATI
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-04-01 19:10 . 2010-04-01 19:08 -------- d-----w- c:\program files\ATI Technologies
2010-04-01 19:09 . 2010-04-01 19:09 -------- d-----w- c:\program files\ATI
2010-04-01 19:06 . 2010-04-01 19:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Plocha
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Oblíbené položky
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Šablony
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Nabídka Start
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Dokumenty
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Data aplikací
2010-03-08 21:33 . 2010-04-14 13:39 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-03-03 04:22 . 2010-03-03 04:22 5340160 ----a-w- c:\windows\system32\drivers\atipmdag.sys
2010-03-03 04:22 . 2010-03-03 04:22 5340160 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-03-03 04:16 . 2010-03-03 04:16 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-03-03 04:16 . 2010-03-03 04:16 446464 ----a-w- c:\windows\system32\aticfx32.dll
2010-03-03 04:13 . 2010-03-03 04:13 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-03-03 04:12 . 2010-03-03 04:12 372736 ----a-w- c:\windows\system32\atieclxx.exe
2010-03-03 04:11 . 2010-03-03 04:11 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2010-03-03 04:10 . 2010-03-03 04:10 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-03-03 04:10 . 2010-03-03 04:10 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-03-03 04:09 . 2010-03-03 04:09 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2010-03-03 04:09 . 2010-03-03 04:09 11776 ----a-w- c:\windows\system32\atimuixx.dll
2010-03-03 04:09 . 2010-03-03 04:09 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-03-03 04:06 . 2009-07-13 22:09 3131392 ----a-w- c:\windows\system32\atidxx32.dll
2010-03-03 03:46 . 2010-03-03 03:46 3703808 ----a-w- c:\windows\system32\atiumdag.dll
2010-03-03 03:45 . 2010-03-03 03:45 14226944 ----a-w- c:\windows\system32\atioglxx.dll
2010-03-03 03:24 . 2010-03-03 03:24 2993152 ----a-w- c:\windows\system32\atiumdva.dll
2010-03-03 03:23 . 2010-03-03 03:23 50176 ----a-w- c:\windows\system32\coinst.dll
2010-03-03 03:20 . 2010-03-03 03:20 53248 ----a-w- c:\windows\system32\aticalrt.dll
2010-03-03 03:20 . 2010-03-03 03:20 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-03-03 03:18 . 2010-03-03 03:18 3657728 ----a-w- c:\windows\system32\aticaldd.dll
2010-03-03 03:08 . 2010-03-03 03:08 52224 ----a-w- c:\windows\system32\atimpc32.dll
2010-03-03 03:08 . 2010-03-03 03:08 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2010-03-03 03:08 . 2010-03-03 03:08 237568 ----a-w- c:\windows\system32\atiadlxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 15360 ----a-w- c:\windows\system32\atigktxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 152064 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-03-03 03:06 . 2010-03-03 03:06 27648 ----a-w- c:\windows\system32\atiuxpag.dll
2010-03-03 03:06 . 2010-03-03 03:06 20480 ----a-w- c:\windows\system32\atiu9pag.dll
2010-03-03 03:05 . 2010-03-03 03:05 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-02-27 12:07 . 2010-04-14 13:39 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-27 12:07 . 2010-04-14 13:39 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-27 07:32 . 2010-04-14 13:39 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-27 07:32 . 2010-04-14 13:39 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-27 07:32 . 2010-04-14 13:39 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-26 04:41 . 2010-02-26 04:41 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-02-26 04:41 . 2010-02-26 04:41 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-02-26 04:39 . 2010-02-26 04:39 133512 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-02-25 19:55 . 2010-02-25 19:55 201875 ----a-w- c:\windows\system32\atiicdxx.dat
2010-02-23 16:15 . 2010-02-23 16:15 1105 ----a-w- c:\windows\system32\atipblag.dat
2010-02-23 07:56 . 2010-04-02 07:45 977920 ----a-w- c:\windows\system32\wininet.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-08-13 3276288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-02-26 2140880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ

[HKLM\~\startupfolder\C:^Users^Renee^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\Renee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-04-01 19:14 136176 ----atw- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-03-02 20:23 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-01 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-02-26 114984]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-02-26 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-02-26 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-02-26 96896]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]

.
Obsah adresáře 'Naplánované úlohy'

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3066638169-474057053-1295839724-1001Core.job
- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 19:14]

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3066638169-474057053-1295839724-1001UA.job
- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 19:14]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-IDMan - c:\program files\Internet Download Manager\IDMan.exe
AddRemove-HijackThis - c:\program files\trend micro\HijackThis.exe


.
Celkový čas: 2010-05-16 21:38:51
ComboFix-quarantined-files.txt 2010-05-16 19:38

Před spuštěním: Volných bajtů: 26 998 595 584
Po spuštění: Volných bajtů: 27 141 140 480

- - End Of File - - B05DE762E9EB349B92815BB7D8E8A80A

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\ativpsrm.bin

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Renee]

combofix:
ComboFix 10-05-16.01 - Renee 16.05.2010 23:21:17.4.1 - x86
Microsoft Windows 7 Enterprise 6.1.7600.0.1250.420.1029.18.2048.1369 [GMT 2:00]
Spuštěný z: c:\users\Renee\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Renee\Desktop\cfscript.txt
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\ativpsrm.bin"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ativpsrm.bin

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-16 do 2010-05-16 )))))))))))))))))))))))))))))))
.

2010-05-16 21:26 . 2010-05-16 21:26 -------- d-----w- c:\users\Renee\AppData\Local\temp
2010-05-16 21:26 . 2010-05-16 21:26 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-16 21:26 . 2010-05-16 21:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-15 16:46 . 2010-05-15 16:46 -------- d--h--r- c:\users\Renee\AppData\Roaming\SecuROM
2010-05-15 16:46 . 2010-05-15 16:46 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-15 15:24 . 2010-05-15 15:24 -------- d-----w- c:\program files\SEGA
2010-05-15 14:02 . 2007-03-22 10:46 126976 ----a-w- c:\users\Renee\AppData\Roaming\GRETECH\GomPlayer\GrLauncher.exe
2010-05-13 19:10 . 2010-05-13 19:14 -------- d-----w- c:\program files\GoldWave
2010-05-12 10:44 . 2010-03-04 07:33 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-06 19:52 . 2010-05-06 19:55 -------- d-----w- c:\users\Renee\AppData\Roaming\uTorrent
2010-05-03 15:29 . 2010-05-03 15:30 -------- d-----w- c:\program files\GIMP-2.0
2010-05-01 22:19 . 2010-05-01 22:42 -------- d-----w- c:\program files\Castle Strike
2010-05-01 13:07 . 2010-05-01 13:41 -------- d-----w- c:\program files\Ground Control II
2010-04-30 21:02 . 2010-05-01 13:26 -------- d-----w- C:\pch
2010-04-30 15:07 . 2010-04-30 15:07 -------- d-----w- c:\programdata\F-Secure
2010-04-30 14:58 . 2010-04-30 14:58 -------- d-----w- c:\windows\Sun
2010-04-30 14:58 . 2010-04-30 14:58 -------- d-----w- c:\program files\Common Files\Java
2010-04-30 14:57 . 2010-04-30 14:57 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-30 14:57 . 2010-04-30 14:57 -------- d-----w- c:\program files\Java
2010-04-30 13:09 . 2010-04-30 13:09 -------- d-----w- c:\users\Renee\DoctorWeb
2010-04-28 14:21 . 2009-09-26 05:58 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys
2010-04-28 14:21 . 2009-12-11 07:38 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-04-28 14:21 . 2009-12-11 07:44 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-26 19:57 . 2010-04-26 19:57 -------- d-----w- c:\users\Renee\AppData\Local\ESET
2010-04-26 14:03 . 2010-04-26 14:03 -------- d-----w- c:\users\Renee\AppData\Roaming\Malwarebytes
2010-04-26 14:03 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-26 14:03 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 14:03 . 2010-04-26 14:03 -------- d-----w- c:\programdata\Malwarebytes
2010-04-26 14:03 . 2010-05-16 16:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-25 17:41 . 2010-04-25 17:41 -------- d-----w- c:\program files\AMD
2010-04-25 17:40 . 2010-04-25 17:40 -------- d-----w- c:\users\Renee\AppData\Local\Downloaded Installations
2010-04-25 16:38 . 2010-04-25 16:38 388096 ----a-r- c:\users\Renee\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-25 16:38 . 2010-04-26 21:26 -------- d-----w- c:\program files\Trend Micro
2010-04-25 16:20 . 2010-04-25 16:24 -------- d-----w- c:\program files\RegCleaner
2010-04-25 16:09 . 2010-04-25 16:09 -------- d-----w- c:\program files\CCleaner
2010-04-25 12:37 . 2010-04-25 12:37 10134 ----a-r- c:\users\Renee\AppData\Roaming\Microsoft\Installer\{9903001D-2728-9D9B-3D8B-F593A502A972}\ARPPRODUCTICON.exe
2010-04-25 12:10 . 2009-02-17 16:22 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-04-25 12:10 . 2009-02-17 16:22 30976 ----a-w- c:\windows\system32\drivers\ATKDispLowFilter.sys
2010-04-25 12:10 . 2009-02-17 16:22 15232 ----a-w- c:\windows\system32\drivers\asusgsb.sys
2010-04-22 19:05 . 2010-04-22 19:05 -------- d-----w- c:\windows\system32\URTTEMP
2010-04-22 18:33 . 2010-04-22 18:33 -------- d-----w- c:\program files\Razor
2010-04-19 12:48 . 2010-04-19 12:48 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-04-18 18:00 . 2010-05-05 13:36 -------- d-----w- c:\users\Renee\AppData\Roaming\DMCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-16 13:33 . 2010-04-02 16:01 1 ----a-w- c:\users\Renee\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-15 21:48 . 2010-04-01 19:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-15 21:47 . 2010-04-02 10:43 -------- d-----w- c:\users\Renee\AppData\Roaming\Hamachi
2010-05-15 15:45 . 2009-07-14 08:14 631116 ----a-w- c:\windows\system32\perfh005.dat
2010-05-15 15:45 . 2009-07-14 08:14 123556 ----a-w- c:\windows\system32\perfc005.dat
2010-05-15 12:57 . 2010-04-01 21:43 -------- d-----w- c:\users\Renee\AppData\Roaming\AIMP
2010-05-15 12:00 . 2010-04-04 08:44 138184 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-05-15 12:00 . 2010-04-04 08:44 215016 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-05-12 13:55 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-05-06 08:36 . 2010-04-01 19:15 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-05 20:58 . 2010-04-02 20:35 -------- d-----w- c:\users\Renee\AppData\Roaming\gtk-2.0
2010-05-05 13:57 . 2010-04-01 19:11 64120 ----a-w- c:\users\Renee\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-28 20:28 . 2010-04-01 20:41 -------- d-----w- c:\program files\AIMP2
2010-04-25 12:27 . 2010-04-01 21:03 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-22 19:45 . 2010-04-02 21:05 -------- d-----w- c:\program files\EA Games
2010-04-19 12:49 . 2010-04-02 21:21 138056 ----a-w- c:\users\Renee\AppData\Roaming\PnkBstrK.sys
2010-04-19 12:49 . 2010-04-02 21:21 138056 ----a-w- c:\users\Renee\AppData\Roaming\PnkBstrK.sys
2010-04-15 15:55 . 2010-04-15 15:55 -------- d-----w- c:\program files\Sony Ericsson
2010-04-08 18:48 . 2010-04-08 18:13 -------- d-----w- c:\programdata\TrackMania
2010-04-08 18:13 . 2010-04-02 09:27 -------- d-----w- c:\program files\TmNationsForever
2010-04-04 08:44 . 2010-04-04 08:44 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-04-03 12:05 . 2010-04-03 12:05 -------- d-----w- c:\users\Renee\AppData\Roaming\GRETECH
2010-04-03 12:05 . 2010-04-03 12:05 -------- d-----w- c:\program files\GRETECH
2010-04-02 18:06 . 2010-04-02 18:06 -------- d-----w- c:\program files\SQUARE ENIX - Eidos Interactive
2010-04-02 16:24 . 2010-04-02 16:22 -------- d-----w- c:\program files\FootballArena
2010-04-02 16:01 . 2010-04-02 16:01 -------- d-----w- c:\users\Renee\AppData\Roaming\OpenOffice.org
2010-04-02 10:43 . 2010-04-02 10:43 -------- d-----w- c:\program files\Hamachi
2010-04-02 10:43 . 2010-04-02 10:43 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-----w- c:\users\Renee\AppData\Roaming\TuneUp Software
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-----w- c:\programdata\TuneUp Software
2010-04-02 09:32 . 2010-04-02 09:32 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-02 09:14 . 2010-04-02 09:14 -------- d-----w- c:\program files\OpenOffice.org 3
2010-04-01 23:19 . 2010-04-01 23:19 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-01 23:19 . 2010-04-01 23:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-01 23:06 . 2010-04-01 23:06 -------- d-----w- c:\program files\2K Games
2010-04-01 23:05 . 2010-04-01 22:38 -------- d-----w- c:\users\Renee\AppData\Roaming\DAEMON Tools Lite
2010-04-01 22:48 . 2010-04-01 22:48 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2010-04-01 22:41 . 2010-04-01 22:39 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-01 22:41 . 2010-04-01 22:41 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-01 22:38 . 2010-04-01 22:38 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-04-01 21:13 . 2010-04-01 21:03 -------- d-----w- c:\program files\Realtek AC97
2010-04-01 20:37 . 2010-04-01 20:37 -------- d-----w- c:\program files\QIP
2010-04-01 19:29 . 2010-04-01 19:29 -------- d-----w- c:\program files\ESET
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\users\Renee\AppData\Roaming\ATI
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\programdata\ATI
2010-04-01 19:10 . 2010-04-01 19:10 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-04-01 19:10 . 2010-04-01 19:08 -------- d-----w- c:\program files\ATI Technologies
2010-04-01 19:09 . 2010-04-01 19:09 -------- d-----w- c:\program files\ATI
2010-04-01 19:06 . 2010-04-01 19:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Plocha
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Oblíbené položky
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Šablony
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Nabídka Start
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Dokumenty
2010-04-01 18:59 . 2010-04-01 18:59 -------- d-sh--we c:\programdata\Data aplikací
2010-03-08 21:33 . 2010-04-14 13:39 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-03-03 04:22 . 2010-03-03 04:22 5340160 ----a-w- c:\windows\system32\drivers\atipmdag.sys
2010-03-03 04:22 . 2010-03-03 04:22 5340160 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-03-03 04:16 . 2010-03-03 04:16 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-03-03 04:16 . 2010-03-03 04:16 446464 ----a-w- c:\windows\system32\aticfx32.dll
2010-03-03 04:13 . 2010-03-03 04:13 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-03-03 04:12 . 2010-03-03 04:12 372736 ----a-w- c:\windows\system32\atieclxx.exe
2010-03-03 04:11 . 2010-03-03 04:11 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2010-03-03 04:10 . 2010-03-03 04:10 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-03-03 04:10 . 2010-03-03 04:10 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-03-03 04:09 . 2010-03-03 04:09 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2010-03-03 04:09 . 2010-03-03 04:09 11776 ----a-w- c:\windows\system32\atimuixx.dll
2010-03-03 04:09 . 2010-03-03 04:09 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-03-03 04:06 . 2009-07-13 22:09 3131392 ----a-w- c:\windows\system32\atidxx32.dll
2010-03-03 03:46 . 2010-03-03 03:46 3703808 ----a-w- c:\windows\system32\atiumdag.dll
2010-03-03 03:45 . 2010-03-03 03:45 14226944 ----a-w- c:\windows\system32\atioglxx.dll
2010-03-03 03:24 . 2010-03-03 03:24 2993152 ----a-w- c:\windows\system32\atiumdva.dll
2010-03-03 03:23 . 2010-03-03 03:23 50176 ----a-w- c:\windows\system32\coinst.dll
2010-03-03 03:20 . 2010-03-03 03:20 53248 ----a-w- c:\windows\system32\aticalrt.dll
2010-03-03 03:20 . 2010-03-03 03:20 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-03-03 03:18 . 2010-03-03 03:18 3657728 ----a-w- c:\windows\system32\aticaldd.dll
2010-03-03 03:08 . 2010-03-03 03:08 52224 ----a-w- c:\windows\system32\atimpc32.dll
2010-03-03 03:08 . 2010-03-03 03:08 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2010-03-03 03:08 . 2010-03-03 03:08 237568 ----a-w- c:\windows\system32\atiadlxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 15360 ----a-w- c:\windows\system32\atigktxx.dll
2010-03-03 03:07 . 2010-03-03 03:07 152064 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-03-03 03:06 . 2010-03-03 03:06 27648 ----a-w- c:\windows\system32\atiuxpag.dll
2010-03-03 03:06 . 2010-03-03 03:06 20480 ----a-w- c:\windows\system32\atiu9pag.dll
2010-03-03 03:05 . 2010-03-03 03:05 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-02-27 12:07 . 2010-04-14 13:39 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-27 12:07 . 2010-04-14 13:39 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-27 07:32 . 2010-04-14 13:39 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-27 07:32 . 2010-04-14 13:39 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-27 07:32 . 2010-04-14 13:39 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-26 04:41 . 2010-02-26 04:41 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-02-26 04:41 . 2010-02-26 04:41 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-02-26 04:39 . 2010-02-26 04:39 133512 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-02-25 19:55 . 2010-02-25 19:55 201875 ----a-w- c:\windows\system32\atiicdxx.dat
2010-02-23 16:15 . 2010-02-23 16:15 1105 ----a-w- c:\windows\system32\atipblag.dat
2010-02-23 07:56 . 2010-04-02 07:45 977920 ----a-w- c:\windows\system32\wininet.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-05-16_19.36.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-04-01 18:56 . 2010-05-16 10:48 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-04-01 18:56 . 2010-05-16 19:32 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-01 18:56 . 2010-05-16 10:48 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-01 18:56 . 2010-05-16 19:32 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:41 . 2010-05-16 10:48 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2010-05-16 19:32 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:34 . 2010-05-16 19:48 71480 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-04-02 09:09 . 2010-05-16 21:02 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-04-02 09:09 . 2010-05-16 19:14 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-04-02 09:09 . 2010-05-16 19:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2010-04-02 09:09 . 2010-05-16 21:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2010-04-02 09:09 . 2010-05-16 19:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2010-04-02 09:09 . 2010-05-16 21:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-04-01 21:42 . 2010-05-16 19:31 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-01 21:42 . 2010-05-16 21:02 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 02:03 . 2010-05-16 19:57 7077888 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:03 . 2010-05-16 10:56 7077888 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-08-13 3276288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-02-26 2140880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ

[HKLM\~\startupfolder\C:^Users^Renee^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\Renee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-04-01 19:14 136176 ----atw- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-03-02 20:23 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-01 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-02-26 114984]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-02-26 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-02-26 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-02-26 96896]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]

.
Obsah adresáře 'Naplánované úlohy'

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3066638169-474057053-1295839724-1001Core.job
- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 19:14]

2010-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3066638169-474057053-1295839724-1001UA.job
- c:\users\Renee\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 19:14]
.
.
Celkový čas: 2010-05-16 23:28:37
ComboFix-quarantined-files.txt 2010-05-16 21:28
ComboFix2.txt 2010-05-16 19:38

Před spuštěním: Volných bajtů: 27 187 482 624
Po spuštění: Volných bajtů: 26 907 078 656

- - End Of File - - 39F4E5576D543FE3781749C4CB03531C


HJT:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:32:27, on 16.5.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\system32\notepad.exe
C:\Windows\explorer.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Renee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 2614 bytes

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

Potom napiš , jak se chová PC.

[Renee]

tak jsem to projel a vypadá docela v cajku, co to pořád chytám? stalo se mi to už podruhé za krátkou dobu a rád bych se tomu teď na chvíli vyhnul. pomohlo by, kdybych používal lepší firewall než windowsácký?

[jaro3]

Ve win7 je dobrý firewall , ten bych ponechal , spíš doinstalovat něco na spyware:
Spybot, SpywareTerminator, SpywareDoctor atd.

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.

[Renee]

dobrá tak já tedy zkusím nějaký ten ničitel spyware :). stejně s tímto počítačem potřebuji už jen "dojet" pár týdnů, pak budu (doufám) kupovat nový. díky moc za tvůj čas!