Prosím o konrolu mého logu

[jaro3]

Tak ještě jeden script v CF:

Kód: Vybrat vše

File::
c:\windows\system32\drivers\ipdhnmic.sys
d:\program files\malware defender\mdservice.exe

Folder::
d:\program files\malware defender

Driver::
ipdhnmic

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000


Postup stejný.

[Reklama]

[synologic]

Musel jsem vypnout Spywer Doctora, jinak to házelo tohle:

Pak vše OK.

HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:02, on 20.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Free Download Manager\fdm.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\explorer.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - d:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Free Download Manager] d:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Startup: ObjectDock Plus.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: Zástupce - Psycho.lnk = ?
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://d:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_11.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8684926921
O17 - HKLM\System\CCS\Services\Tcpip\..\{386C99A1-BF6B-4FDC-A67A-16B15859A7A1}: NameServer = 212.71.128.8,193.85.1.100
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Malware Defender Service (MalwareDefenderService) - Unknown owner - d:\program files\malware defender\mdservice.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--
End of file - 4347 bytes
_________________________________________________________________________________________________

COMBO:

ComboFix 08-12-20.01 - Doma 2008-12-20 21:25:57.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.591 [GMT 1:00]
Spuštěný z: c:\documents and settings\Doma\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Doma\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení
* Resident AV is active


FILE ::
c:\windows\system32\drivers\ipdhnmic.sys
d:\program files\malware defender\mdservice.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\program files\malware defender
d:\program files\malware defender\autostarts.dat
d:\program files\malware defender\CrashRpt.dll
d:\program files\malware defender\dbghelp.dll
d:\program files\malware defender\checksum.dat
d:\program files\malware defender\license.txt
d:\program files\malware defender\MalwareDefender.exe
d:\program files\malware defender\MalwareDefender.chm
d:\program files\malware defender\MalwareDefender.ini
d:\program files\malware defender\mdcore.sys
d:\program files\malware defender\mdlog.tmp
d:\program files\malware defender\mdlog.txt
d:\program files\malware defender\mdservice.exe
d:\program files\malware defender\rules.dat
d:\program files\malware defender\rules.drv
d:\program files\malware defender\symbols\halmacpi.pdb\9875FD697ECA4BBB8A475825F6BF885E1\halmacpi.pdb
d:\program files\malware defender\symbols\ntkrpamp.pdb\D82F3C0407BA4AB09C7831D423622B691\ntkrpamp.pdb
d:\program files\malware defender\symbols\pingme.txt
d:\program files\malware defender\symbols\win32k.pdb\63B88C09865349A58AC30CC31DB1E1F02\win32k.pdb
d:\program files\malware defender\symsrv.dll
d:\program files\malware defender\symsrv.yes
d:\program files\malware defender\Uninstall.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPDHNMIC
-------\Service_ipdhnmic


((((((((((((((((((((((((( Soubory vytvořené od 2008-11-20 do 2008-12-20 )))))))))))))))))))))))))))))))
.

2008-12-20 20:04 . 2008-12-20 20:04 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2008-12-19 14:59 . 2008-12-19 14:59 <DIR> d-------- c:\windows\Sun
2008-12-08 11:56 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-08 11:56 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-12-07 22:34 . 2008-12-07 22:34 <DIR> d-------- c:\program files\Common Files\Java
2008-12-07 22:18 . 2008-12-07 22:20 <DIR> d-------- c:\windows\system32\XPSViewer
2008-12-07 22:18 . 2008-12-07 22:18 <DIR> d-------- c:\program files\MSBuild
2008-12-07 22:17 . 2008-12-07 22:17 <DIR> d-------- c:\program files\Reference Assemblies
2008-12-07 22:16 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-12-07 19:20 . 2008-12-07 19:20 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-07 19:18 . 2008-12-07 19:18 <DIR> d-------- c:\windows\ERUNT
2008-12-07 19:16 . 2008-12-07 19:30 <DIR> d-------- C:\SDFix
2008-12-07 17:14 . 2008-12-07 18:37 <DIR> d-------- c:\documents and settings\Doma\.SunDownloadManager
2008-12-07 15:46 . 2008-12-07 15:46 <DIR> d-------- c:\program files\Google
2008-12-07 14:29 . 2008-12-07 14:29 <DIR> d-------- c:\program files\FBM Software
2008-12-07 12:08 . 2008-12-07 12:25 <DIR> d-------- c:\program files\ICQ6
2008-12-06 23:41 . 2008-12-20 21:28 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\Free Download Manager
2008-12-06 13:48 . 2004-09-02 16:39 28,236 --a------ c:\windows\system32\drivers\SGuard.sys
2008-12-06 13:48 . 2004-05-29 06:15 9,728 --a------ c:\windows\system32\drivers\filedisk.sys
2008-12-06 13:47 . 2004-09-20 11:17 567,808 --a------ c:\windows\system32\Incinerator.dll
2008-12-06 12:39 . 2008-12-06 18:38 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\Nero
2008-12-06 10:09 . 2008-04-14 04:22 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-06 09:44 . 2008-12-06 09:44 4,767 --a------ c:\windows\Irremote.ini
2008-12-06 09:41 . 2008-12-06 09:41 <DIR> d-------- c:\program files\Windows Sidebar
2008-12-06 09:23 . 2008-12-06 09:58 <DIR> d-------- c:\program files\Common Files\Nero
2008-12-06 09:23 . 2008-12-06 09:34 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Nero
2008-12-06 01:05 . 2008-11-10 03:39 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-06 00:35 . 2008-12-14 20:03 <DIR> d-------- c:\program files\Java
2008-12-06 00:35 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-05 22:05 . 2008-12-05 22:05 <DIR> d-------- c:\documents and settings\LocalService\Data aplikací\iolo
2008-12-05 21:30 . 2008-12-05 21:30 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\Malwarebytes
2008-12-05 21:25 . 2008-12-05 21:25 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-12-05 21:24 . 2008-12-05 23:11 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\iolo
2008-12-05 21:18 . 2008-12-05 21:18 <DIR> d-------- c:\program files\uTorrent
2008-12-05 21:17 . 2008-12-20 13:12 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\uTorrent
2008-12-03 14:05 . 2007-05-26 12:32 26,288 --a------ c:\windows\system32\wbload.dll
2008-12-02 18:41 . 2008-12-02 18:43 5,462 --a------ c:\windows\BricoPackFoldersDelete.cmd
2008-12-02 18:04 . 2008-12-02 18:04 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\PC Tools
2008-12-02 18:04 . 2008-12-02 18:07 74,240 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-02 18:04 . 2008-12-02 18:07 56,832 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-02 18:04 . 2007-10-18 00:14 41,288 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-02 18:04 . 2007-10-18 00:16 29,000 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-02 17:58 . 2008-12-07 16:19 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-02 17:55 . 2008-12-02 17:55 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\CyberLink
2008-12-02 17:42 . 1999-10-15 12:50 1,056,768 --a------ c:\windows\system32\ROBOEX32.DLL
2008-12-02 17:42 . 2006-07-22 19:37 49,152 --a------ c:\windows\system32\INETWH32.dll
2008-12-02 17:41 . 2008-12-07 15:57 <DIR> d-------- c:\documents and settings\All Users\Plocha
2008-12-02 17:39 . 2004-05-04 12:53 1,645,320 --a------ c:\windows\gdiplus.dll
2008-12-02 17:39 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2008-12-02 17:39 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2008-12-02 17:39 . 2003-03-25 05:49 761 --a------ c:\windows\m3jp2k.ini
2008-12-02 17:39 . 2003-03-25 05:49 714 --a------ c:\windows\m3jpeg.ini
2008-12-02 17:39 . 2003-03-25 05:49 702 --a------ c:\windows\mmtvmj.ini
2008-12-02 17:36 . 2008-12-02 17:36 <DIR> d-------- c:\program files\Common Files\xing shared
2008-12-02 00:24 . 2008-12-05 22:09 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\iolo
2008-12-01 23:54 . 2008-12-03 12:44 10 --------- c:\windows\WB.ini
2008-12-01 23:43 . 2008-12-01 23:43 406 --a------ c:\windows\system32\ioloBootDefrag.cfg
2008-12-01 23:02 . 2007-07-11 15:06 42,672 --a------ c:\windows\system32\wbsys.dll
2008-11-28 13:15 . 2001-10-31 10:14 1,650,688 --a------ c:\windows\system32\mplva6.dll
2008-11-28 13:15 . 2001-10-31 10:14 1,581,056 --a------ c:\windows\system32\mplvw7.dll
2008-11-28 13:15 . 2001-10-31 10:14 1,552,384 --a------ c:\windows\system32\mplvm6.dll
2008-11-28 13:15 . 2001-10-31 10:14 1,122,304 --a------ c:\windows\system32\mplvpx.dll
2008-11-28 13:15 . 2004-10-30 15:39 761,856 --a------ c:\windows\system32\xvidcore.dll
2008-11-28 13:15 . 2003-03-25 05:49 152,064 --a------ c:\windows\system32\unrar.dll
2008-11-28 13:15 . 2001-10-31 10:14 77,824 --a------ c:\windows\system32\mplaw7.dll
2008-11-28 13:15 . 2001-10-31 10:14 77,824 --a------ c:\windows\system32\mplaa6.dll
2008-11-28 13:15 . 2001-10-31 10:14 65,536 --a------ c:\windows\system32\mplapx.dll
2008-11-28 13:15 . 2001-10-31 10:14 65,536 --a------ c:\windows\system32\mplam6.dll
2008-11-28 13:15 . 2004-02-17 10:11 53,248 --a------ c:\windows\system32\vp6dec_settings.cpl
2008-11-28 13:15 . 2001-09-17 12:20 19,968 --a------ c:\windows\system32\cpuinf32.dll
2008-11-28 13:14 . 2004-05-25 16:06 417,792 --a------ c:\windows\system32\ac3filter.cpl
2008-11-27 19:38 . 2005-04-15 05:00 401,408 -ra------ c:\windows\9205RMT.exe
2008-11-27 19:38 . 2005-04-15 05:00 352,256 -ra------ c:\windows\9205RMTMon.exe
2008-11-27 19:37 . 1998-10-12 18:05 327,168 --a------ c:\windows\IsUninst.exe
2008-11-27 19:13 . 2005-07-20 05:00 401,408 -ra------ c:\windows\713xRMT.exe
2008-11-27 19:13 . 2005-07-20 05:00 352,256 -ra------ c:\windows\713xRMTMon.exe
2008-11-27 19:12 . 2008-11-27 20:17 <DIR> d-------- c:\windows\MyInstall
2008-11-27 19:12 . 2005-08-10 12:00 204,800 --a------ c:\windows\system32\713xTTXDecoder.ax
2008-11-27 19:08 . 2008-04-13 20:45 60,032 --a------ c:\windows\system32\drivers\USBAUDIO.sys
2008-11-27 19:08 . 2008-04-13 20:45 60,032 --a--c--- c:\windows\system32\dllcache\usbaudio.sys
2008-11-27 19:06 . 2005-08-19 05:00 143,563 -ra------ c:\windows\system32\drivers\M9205.sys
2008-11-27 19:06 . 2008-04-14 05:22 20,992 --a------ c:\windows\system32\dshowext.ax
2008-11-27 19:06 . 2008-04-14 05:22 20,992 --a--c--- c:\windows\system32\dllcache\dshowext.ax
2008-11-27 19:04 . 2008-04-13 20:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-11-27 19:04 . 2008-04-13 20:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-11-27 15:34 . 2008-11-27 15:34 <DIR> d-------- c:\documents and settings\Evička\Data aplikací\ESET
2008-11-27 15:14 . 2008-01-07 14:29 352 --ah----- c:\windows\nod32fixtemdono.reg
2008-11-27 15:13 . 2008-11-27 15:13 <DIR> d-------- c:\documents and settings\Doma\Data aplikací\ESET
2008-11-27 15:12 . 2008-11-27 15:12 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ESET
2008-11-27 01:45 . 2008-12-02 17:01 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-11-26 23:55 . 2001-08-23 17:00 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-11-26 23:55 . 2005-07-08 11:05 1,024,000 --a------ c:\windows\system32\3ivx.dll
2008-11-26 23:55 . 2002-01-05 20:48 974,848 --a------ c:\windows\system32\mfc70.dll
2008-11-26 23:55 . 2002-01-05 11:40 487,424 --a------ c:\windows\system32\msvcp70.dll
2008-11-26 23:55 . 2005-07-08 11:05 409,600 --a------ c:\windows\system32\3ivxDSAudioDecoder.ax
2008-11-26 23:55 . 2005-04-21 10:45 316,640 --a------ c:\windows\system32\WMSysPr9.prx
2008-11-26 23:55 . 2005-07-08 11:05 290,816 --a------ c:\windows\system32\3ivxDSMediaSplitter.ax
2008-11-26 23:55 . 2005-07-08 11:05 290,816 --a------ c:\windows\system32\3ivxDSDecoder.ax
2008-11-26 23:55 . 2003-08-07 15:01 237,568 --a------ c:\windows\system32\lame_enc.dll
2008-11-26 23:55 . 2003-05-21 23:50 156,910 --a------ c:\windows\system32\WMSysPr8.prx
2008-11-26 23:55 . 2005-07-08 11:06 96,768 --a------ c:\windows\system32\libsndfile.dll
2008-11-26 23:52 . 2006-03-11 04:56 438,272 --a------ c:\windows\system32\Mpeg2DecFilter.ax
2008-11-26 23:52 . 2004-03-09 00:00 224,016 --a------ c:\windows\system32\tabctl32.ocx
2008-11-26 23:52 . 2004-03-09 16:45 152,848 --a------ c:\windows\system32\Comdlg32.ocx
2008-11-26 23:52 . 2005-06-21 17:48 1 --a------ c:\windows\gamidnof.lnl
2008-11-25 13:53 . 2008-11-25 13:53 <DIR> d--h----- c:\windows\PIF
2008-11-21 22:30 . 2008-11-21 22:30 145 --a------ c:\windows\fcp5.cfg

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-20 20:25 --------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2008-12-20 20:11 --------- d-----w c:\documents and settings\Doma\Data aplikací\Vso
2008-12-19 15:31 --------- d-----w c:\documents and settings\Doma\Data aplikací\ICQ
2008-12-12 20:19 --------- d-----w c:\documents and settings\Evička\Data aplikací\Skype
2008-12-07 11:10 --------- d-----w c:\program files\ICQ6Toolbar
2008-12-07 07:50 --------- d-----w c:\documents and settings\Evička\Data aplikací\ICQ
2008-12-06 19:00 --------- d-----w c:\program files\CursorXP
2008-12-05 23:59 319,488 ----a-w c:\windows\HideWin.exe
2008-12-03 10:59 --------- d-----w c:\program files\Common Files\Stardock
2008-12-03 10:54 --------- d-----w c:\program files\Stardock
2008-12-02 17:43 71,054 ----a-w c:\windows\BricoPackUninst.cmd
2008-12-02 16:55 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-02 16:55 --------- d-----w c:\program files\CyberLink
2008-12-02 16:50 --------- d-----w c:\program files\Common Files\Adobe
2008-12-02 16:44 --------- d-----w c:\documents and settings\Doma\Data aplikací\Ulead Systems
2008-12-02 16:42 --------- d-----w c:\program files\Common Files\Ulead Systems
2008-12-02 16:42 --------- d-----w c:\documents and settings\All Users\Data aplikací\Ulead Systems
2008-12-02 16:40 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-12-02 16:40 47,360 ----a-w c:\documents and settings\Doma\Data aplikací\pcouffin.sys
2008-12-02 16:40 --------- d-----w c:\program files\VSO
2008-12-02 16:36 --------- d-----w c:\program files\Real
2008-12-02 16:36 --------- d-----w c:\program files\Common Files\Real
2008-12-02 16:04 --------- d-----w c:\program files\Ahead
2008-12-02 16:01 --------- d-----w c:\program files\Sony Ericsson
2008-12-01 14:56 --------- d-----w c:\documents and settings\Doma\Data aplikací\Skype
2008-11-27 14:12 --------- d-----w c:\program files\ESET
2008-11-25 12:37 --------- d-----w c:\documents and settings\Doma\Data aplikací\Spy Defy
2008-11-10 17:00 --------- d--h--r c:\documents and settings\Doma\Data aplikací\SecuROM
2008-11-09 19:32 --------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2008-11-09 18:05 --------- d-----w c:\documents and settings\All Users\Data aplikací\Anvsoft
2008-11-09 15:25 --------- d-----w c:\documents and settings\Doma\Data aplikací\TRIWORKS
2008-11-09 13:27 --------- d-----w c:\documents and settings\Evička\Data aplikací\Photodex
2008-11-09 12:51 --------- d-----w c:\documents and settings\Doma\Data aplikací\Netscape
2008-11-09 12:49 --------- d-----w c:\documents and settings\Doma\Data aplikací\Photodex
2008-11-09 06:24 --------- d-----w c:\documents and settings\Evička\Data aplikací\Spyware Terminator
2008-11-09 00:34 --------- d-----w c:\program files\Common Files\ArcSoft
2008-11-09 00:33 --------- d-----w c:\program files\Philips
2008-11-08 20:37 --------- d-----w c:\documents and settings\All Users\Data aplikací\Skype
2008-11-08 19:21 --------- d-----w c:\program files\Common Files\Acronis
2008-11-08 18:20 --------- d-----w c:\documents and settings\Doma\Data aplikací\Lavasoft
2008-11-08 06:17 --------- d-----w c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2008-11-07 19:34 --------- d-----w c:\documents and settings\All Users\Data aplikací\Arovax
2008-11-03 21:43 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-03 11:19 2,208 ----a-w c:\windows\system32\drivers\nxsIO32.sys
2008-10-29 20:05 --------- d-----w c:\documents and settings\Doma\Data aplikací\Softplicity
2008-10-29 16:18 --------- d-----w c:\program files\Common Files\Teleca Shared
2008-10-28 17:57 --------- d-----w c:\documents and settings\Doma\Data aplikací\RealWorld
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-09-20 22:03 4 ----a-w C:\df.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="d:\program files\Free Download Manager\fdm.exe" [2006-08-23 2068527]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]

c:\documents and settings\Eviźka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ICQ6.lnk - c:\program files\ICQ6\ICQ.exe [2008-06-05 173304]

c:\documents and settings\Doma\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ObjectDock Plus.lnk - d:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-03 3581680]
Z stupce - Psycho.lnk - d:\security\Programy\Ostatnˇ\ZmŘna Vzhledu\ZmŘna - Kurzoru\Cursor XP\Psycho.CurXPTheme [2001-10-31 452175]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.sl_anet"= d:\progra~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= d:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= d:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= d:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= d:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= d:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= d:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= d:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= d:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R2 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" [2007-12-21 468224]
R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS\nxsIO32.sys [2008-11-03 2208]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2002-08-29 69120]
S2 MalwareDefenderService;Malware Defender Service;d:\program files\malware defender\mdservice.exe []
S3 getPlus(R) Helper;getPlus(R) Helper; []
S3 M9205;M9205 USB TV Box;c:\windows\system32\Drivers\M9205.sys [2008-11-27 143563]
S3 MemStPCI;Řadič Sony Memory Stick (PCI);c:\windows\system32\DRIVERS\MemStPCI.SYS [2008-09-03 26112]
S3 sdAuxService;PC Tools Auxiliary Service;d:\program files\Spyware Doctor\svcntaux.exe [2008-12-02 311112]
S3 zebrbus;Sony Ericsson Composite Device driver;c:\windows\system32\DRIVERS\zebrbus.sys [2008-10-31 83200]
S3 zebrmdfl;Sony Ericsson Modem Filter;c:\windows\system32\DRIVERS\zebrmdfl.sys [2008-10-31 14848]
S3 zebrmdm;Sony Ericsson Port (WDM);c:\windows\system32\DRIVERS\zebrmdm.sys [2008-10-31 109568]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);c:\windows\system32\DRIVERS\zebrmdmc.sys [2008-10-31 109568]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
.
Obsah adresáře 'Naplánované úlohy'

2008-12-19 c:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2005-10-24 17:54]

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Stáhnout Free Download Managerem - file://d:\program files\Free Download Manager\dllink.htm
TCP: {386C99A1-BF6B-4FDC-A67A-16B15859A7A1} = 212.71.128.8,193.85.1.100

O16 -: DirectAnimation Java Classes - c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-20 21:30:42
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\CursorXP\CursorXP.exe
.
**************************************************************************
.
Celkový čas: 2008-12-20 21:32:41 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-12-20 20:32:38
ComboFix2.txt 2008-12-14 20:10:54
ComboFix3.txt 2008-12-07 19:08:26

Před spuštěním: Volných bajtů: 14 531 592 192
Po spuštění: Volných bajtů: 15,254,376,448

302 --- E O F --- 2008-12-18 19:56:42

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R3 - URLSearchHook: (no name) - - (no file)
O23 - Service: Malware Defender Service (MalwareDefenderService) - Unknown owner - d:\program files\malware defender\mdservice.exe (file missing)


Doinstaloval bych IE7.
Najdi a smaž:C:\SDFix

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

[synologic]

Tak až na tu doinstalaci IE7, jsem to všechno udělal.
Jen když spustím Správce Úloh, tak tam běží proces s názvem 9205RMTMon.exe a žere dost paměti (58 256kB), to asi nebude normální, že?
A co to vlastně je zač?

[jaro3]

Mělo by to patřit TV Card Remote Control Device.

[synologic]

JJ máš pravdu, spouštělo se to při startu pc, tak jsem to přes Ccleaner vypnul.
Je fakt, že jsem před 4 dny instaloval externí tv kartu, protože jsem potřeboval něco stáhnout z kamery do pc.

JInak, ještě jednou moc dík za pomoc, pc je znatelně hbytější.