Nelze spustit explorer.exe Vyřešeno

[jaro3]

Normálně spusť Combofix i přes varování.

[Reklama]

[pepei]

ComboFix 09-04-13.01 - Pepa 2009-04-12 20:12.8 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.767.390 [GMT 2:00]
Spuštěný z: c:\documents and settings\Pepa\Plocha\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated)
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
* Resident AV is active

.

((((((((((((((((((((((((( Soubory vytvořené od 2009-03-13 do 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-12 08:52 . 2009-04-12 08:52 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-04-11 18:03 . 2009-04-11 18:03 104 ----a-w c:\windows\system32\SBRC.dat
2009-04-11 16:58 . 2009-04-11 16:58 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Sunbelt
2009-04-11 16:57 . 2009-04-11 16:57 -------- d-----w c:\documents and settings\All Users\Data aplikací\Sunbelt
2009-04-11 16:57 . 2009-04-11 16:57 -------- d-----w c:\program files\Sunbelt Software
2009-04-11 16:39 . 2009-04-11 16:39 -------- d-----w c:\documents and settings\All Users\Data aplikací\SITEguard
2009-04-11 16:37 . 2009-04-11 16:37 -------- d-----w c:\program files\Common Files\iS3
2009-04-11 16:37 . 2009-04-12 13:45 -------- d-----w c:\documents and settings\All Users\Data aplikací\STOPzilla!
2009-04-08 05:50 . 2009-04-08 05:49 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-06 15:11 . 2009-04-12 13:03 -------- d-----w c:\program files\Lavasoft
2009-04-01 17:11 . 2009-04-01 17:11 -------- d-----w c:\documents and settings\Pepa\Data aplikací\gtk-2.0
2009-04-01 17:10 . 2009-04-01 17:10 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Inkscape
2009-04-01 16:51 . 2009-04-01 16:51 -------- d-----w c:\program files\RapidDown
2009-03-28 10:44 . 2009-03-28 10:44 -------- d-----w c:\documents and settings\Istas\Data aplikací\Inkscape
2009-03-27 09:24 . 2009-03-27 09:24 -------- d-----w c:\documents and settings\Pepa\Data aplikací\CoreCodec
2009-03-27 09:23 . 2009-03-27 09:23 -------- d-----w c:\program files\Haali
2009-03-27 09:23 . 2009-03-27 09:23 -------- d-----w c:\program files\CoreCodec
2009-03-25 11:00 . 2009-03-25 11:00 94208 ----a-w c:\windows\system32\pkcs11wrapper.dll
2009-03-25 09:06 . 2009-03-25 09:06 -------- d-----w c:\program files\Opera
2009-03-24 09:09 . 2009-03-24 09:09 -------- d---a-w c:\windows\system32\runouce.exe
2009-03-22 20:15 . 2009-03-22 20:15 89600 ----a-w c:\windows\system32\atl71.dll
2009-03-22 17:07 . 2000-11-29 02:07 307200 ----a-w c:\windows\system32\msvcr70.dll
2009-03-22 12:36 . 2005-02-12 23:00 67584 --sh--r c:\windows\system32\RLTheoraDec.ax
2009-03-22 12:36 . 2005-02-05 23:00 92672 --sh--r c:\windows\system32\RLVorbisDec.ax
2009-03-22 12:36 . 2005-02-12 23:00 51712 --sh--r c:\windows\system32\RLSpeexDec.ax
2009-03-22 12:36 . 2005-02-12 23:00 186880 --sh--r c:\windows\system32\RLOgg.ax
2009-03-22 12:36 . 2004-04-26 23:00 37888 --sh--r c:\windows\system32\RLMPCDec.ax
2009-03-22 12:36 . 2003-11-20 23:00 54784 --sh--r c:\windows\system32\RLAPEDec.ax
2009-03-22 12:36 . 2005-11-25 20:46 161792 --sh--r c:\windows\system32\RealMediaDX.ax
2009-03-22 12:35 . 2008-03-16 13:30 216064 --sh--r c:\windows\system32\nbDX.dll
2009-03-22 12:35 . 2007-02-21 11:47 31232 --sh--r c:\windows\system32\msfDX.dll
2009-03-22 12:35 . 2006-03-10 21:48 169472 --sh--r c:\windows\system32\MatroskaDX.ax
2009-03-22 12:35 . 2006-05-03 10:06 163328 --sh--r c:\windows\system32\flvDX.dll
2009-03-22 12:35 . 2005-01-17 23:26 179200 --sh--r c:\windows\system32\DiracSplitter.ax
2009-03-22 12:35 . 2006-08-16 14:53 175104 --sh--r c:\windows\system32\CoreAAC.ax
2009-03-22 12:35 . 2006-01-12 23:23 123904 --sh--r c:\windows\system32\AVCDX.ax
2009-03-22 12:35 . 2006-09-12 11:46 227328 --sh--r c:\windows\system32\ac3DX.ax
2009-03-20 17:42 . 2009-03-21 18:40 -------- d-----w c:\documents and settings\Pepa\Data aplikací\avidemux
2009-03-20 17:42 . 2009-04-08 08:57 -------- d-----w c:\program files\Avidemux 2.5
2009-03-19 16:23 . 2009-03-19 16:23 -------- d-----w c:\program files\VirtualDub
2009-03-17 17:31 . 2009-03-17 17:31 -------- dc----w c:\documents and settings\All Users\Data aplikací\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-14 19:36 . 2009-03-14 19:36 -------- d-----w c:\documents and settings\Istas\Data aplikací\Boolat Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 13:45 . 2007-06-13 10:04 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Azureus
2009-04-12 13:44 . 2009-04-12 08:52 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 13:44 . 2009-04-12 13:43 -------- d--h--w c:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-12 13:03 . 2008-07-18 18:49 -------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2009-04-12 12:56 . 2009-04-12 12:56 -------- d-----w c:\program files\Trend Micro
2009-04-12 12:33 . 2007-03-16 20:10 -------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-04-12 08:52 . 2009-04-12 08:52 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Malwarebytes
2009-04-10 11:56 . 2008-07-15 18:04 -------- d-----w c:\program files\AIMP2
2009-04-10 08:48 . 2007-07-01 14:55 -------- d-----w c:\program files\Azureus
2009-04-07 08:51 . 2007-05-12 13:42 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-04-06 16:25 . 2008-08-01 10:52 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-29 09:47 . 2001-10-25 12:00 71478 ----a-w c:\windows\system32\perfc005.dat
2009-03-29 09:47 . 2001-10-25 12:00 396124 ----a-w c:\windows\system32\perfh005.dat
2009-03-28 23:34 . 2007-03-01 18:10 -------- d-----w c:\documents and settings\Istas\Data aplikací\Skype
2009-03-28 11:15 . 2008-04-25 19:08 -------- d-----w c:\documents and settings\Istas\Data aplikací\gtk-2.0
2009-03-27 17:22 . 2008-06-12 15:50 -------- d-----w c:\documents and settings\Istas\Data aplikací\skypePM
2009-03-24 11:27 . 2008-07-17 19:13 -------- d-----w c:\program files\Google
2009-03-24 11:18 . 2008-10-18 20:36 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Any Video Converter
2009-03-22 11:56 . 2007-06-04 08:30 -------- d-----w c:\documents and settings\Pepa\Data aplikací\uTorrent
2009-03-19 19:01 . 2008-07-31 06:50 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-19 18:04 . 2008-10-25 12:50 -------- d-----w c:\program files\Bonjour
2009-03-19 14:44 . 2009-03-18 19:14 180 ----a-w C:\split.log
2009-03-17 17:55 . 2007-03-02 19:00 -------- d-----w c:\documents and settings\Istas\Data aplikací\OpenOffice.org2
2009-03-17 17:16 . 2008-10-16 16:09 3532 ----a-w C:\drmHeader.bin
2009-03-15 11:05 . 2001-10-25 12:00 219648 ----a-w c:\windows\system32\uxtheme.dll
2009-03-14 19:26 . 2008-10-26 08:31 -------- d-----w c:\documents and settings\All Users\Data aplikací\BigFishGamesCache
2009-03-12 10:35 . 2009-03-12 10:26 -------- d-----w c:\program files\GustoSoft
2009-03-09 17:30 . 2009-03-09 17:30 -------- d-----w c:\documents and settings\Administrator\Data aplikací\Happy Foto
2009-03-07 21:19 . 2009-03-06 09:10 -------- d-----w c:\documents and settings\All Users\Data aplikací\McAfee
2009-03-06 18:00 . 2008-01-06 10:25 -------- d-----w c:\documents and settings\All Users\Data aplikací\Gogii
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\LocalService\Data aplikací\SACore
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\LocalService\Data aplikací\SACore
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\All Users\Data aplikací\SiteAdvisor
2009-03-04 16:49 . 2007-04-11 17:59 -------- d-----w c:\documents and settings\Pepa\Data aplikací\DivX
2009-03-04 15:09 . 2007-02-24 19:54 -------- d-----w c:\documents and settings\Istas\Data aplikací\uTorrent
2009-03-04 13:37 . 2007-07-26 18:54 -------- d-----w c:\program files\DivX
2009-03-03 18:16 . 2009-03-03 18:02 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Crystal Player
2009-02-28 13:08 . 2009-02-28 13:08 -------- d-----w c:\documents and settings\Istas\Data aplikací\Zoner
2009-02-22 09:50 . 2009-02-21 00:07 -------- d-----w c:\documents and settings\Istas\Data aplikací\365dni
2009-02-20 17:17 . 2009-02-20 17:13 -------- d-----w c:\program files\Data
2009-02-17 18:08 . 2009-02-17 18:08 -------- d-----w c:\program files\viphone communicator
2009-02-17 18:03 . 2009-02-17 16:59 1060 ----a-w C:\libSRTP_log.txt
2009-02-17 18:03 . 2007-03-02 16:55 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Skype
2009-02-17 17:27 . 2008-06-26 17:05 -------- d-----w c:\documents and settings\Pepa\Data aplikací\skypePM
2009-02-15 14:44 . 2007-02-28 15:34 -------- d-----w c:\program files\Common Files\Adobe
2009-02-15 14:40 . 2009-02-15 14:40 -------- d-----w c:\documents and settings\All Users\Data aplikací\Adobe Systems
2009-02-15 13:42 . 2009-02-15 13:42 -------- d-----w c:\documents and settings\Pepa\Data aplikací\AdobeUM
2008-12-07 16:06 . 2007-03-25 15:06 81920 ----a-w c:\documents and settings\Pepa\Data aplikací\ezpinst.exe
2008-12-07 16:06 . 2007-03-25 15:06 47360 ----a-w c:\documents and settings\Pepa\Data aplikací\pcouffin.sys
2008-07-11 16:58 . 2008-07-11 16:58 241 ----a-w c:\documents and settings\Pepa\SR.vbs
2007-08-12 19:37 . 2007-08-12 19:25 3655608 ----a-w c:\program files\FLV PlayerRCATSetup.exe
2007-08-12 19:36 . 2007-08-12 19:24 411248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2006-09-29 18:33 . 2006-09-29 18:33 3062696 ----a-w c:\program files\openofficeorg4.cab
2006-09-29 18:33 . 2006-09-29 18:33 55912204 ----a-w c:\program files\openofficeorg3.cab
2006-09-29 18:30 . 2006-09-29 18:30 15316170 ----a-w c:\program files\openofficeorg2.cab
2006-09-29 18:30 . 2006-09-29 18:30 17992497 ----a-w c:\program files\openofficeorg1.cab
2006-09-29 18:20 . 2006-09-29 18:20 5291520 ----a-w c:\program files\openofficeorg20.msi
2006-09-29 18:20 . 2006-09-29 18:20 1821008 ----a-w c:\program files\instmsiw.exe
2006-09-29 18:20 . 2006-09-29 18:20 1707856 ----a-w c:\program files\instmsia.exe
2004-10-01 13:00 . 2007-04-07 18:26 40960 ----a-w c:\program files\Uninstall_CDS.exe
.

------- Sigcheck -------

[7] 2004-08-03 22:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-03 22:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-04-12_16.57.29,69 )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-10-25 12:00 . 2004-08-17 14:48 16896 c:\windows\system32\dllcache\cfgmgr32.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 16439 c:\windows\system32\dllcache\author.exe
+ 2004-08-17 14:49 . 2004-08-17 14:49 20540 c:\windows\system32\dllcache\author.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 30208 c:\windows\system32\dllcache\atmlib.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 65024 c:\windows\system32\dllcache\asycfilt.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 98304 c:\windows\system32\dllcache\ahui.exe
+ 2007-02-24 17:50 . 2004-08-17 14:49 43520 c:\windows\system32\dllcache\admwprox.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 16439 c:\windows\system32\dllcache\admin.exe
+ 2004-08-17 14:49 . 2004-08-17 14:49 20540 c:\windows\system32\dllcache\admin.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 188480 c:\windows\system32\dllcache\cfgwiz.exe
+ 2001-10-25 12:00 . 2004-08-17 14:49 126976 c:\windows\system32\dllcache\apphelp.dll
+ 2007-02-24 17:50 . 2004-08-17 14:49 290816 c:\windows\system32\dllcache\adsiis51.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 116224 c:\windows\system32\dllcache\acxtrnal.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 244736 c:\windows\system32\dllcache\acspecfc.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 450048 c:\windows\system32\dllcache\aclayers.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 1852416 c:\windows\system32\dllcache\acgenral.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-07-12 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-12 4112384]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-17 159232]
"C-Media Mixer"="Mixer.exe" [2002-07-12 c:\windows\mixer.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^viphone communicator.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\viphone communicator.lnk
backup=c:\windows\pss\viphone communicator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Pepa^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Pepa\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dní]
c:\program files\365dni\tray_365.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
--a------ 2009-04-08 07:49 515416 c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
--a------ 2007-02-24 23:27 450560 c:\program files\VIAudioi\SBADeck\ADeck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
c:\program files\Microsoft ActiveSync\Wcescomm.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2006-05-16 12:58 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2006-05-16 12:58 213936 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2006-05-16 12:58 86960 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]
--a------ 2008-03-24 14:56 917504 c:\program files\ESET\nod32kui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spy Watcher]
c:\program files\Free Spyware Scanner\SpyWatcher.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-01-27 22:01 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
-ra------ 2004-07-12 10:50 843776 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2003-10-08 11:41 57344 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe"
"NvCplDaemon"="RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"="RUNDLL32.EXE" c:\windows\System32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"=
"c:\\Documents and Settings\\Istas\\Plocha\\Wolf's Profi Miranda-Pack v1.4.0\\miranda32.exe"=
"d:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Documents and Settings\\Istas\\Dokumenty\\ICQ Lite\\304703930\\Vratko_206804567\\Counter Strike\\hl.exe"=
"d:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe"=
"c:\\Program Files\\viphone communicator\\viphone communicator.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 FTLUND;Lundinova Filter Driver;c:\windows\system32\drivers\ftlund.sys [2004-01-19 6828]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [2004-06-24 23552]
R3 tap0901_2gm;VPN Anonymizer Adapter;c:\windows\system32\DRIVERS\tap0901_2gm.sys [2007-06-21 30720]
S0 d344bus;d344bus;c:\windows\system32\DRIVERS\d344bus.sys [2003-12-27 137216]
S0 d344prt;d344prt;c:\windows\System32\Drivers\d344prt.sys [2003-12-27 5248]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-08 64160]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-10-31 270888]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-08 951632]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-04 69120]
S3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]

.
Obsah adresáře 'Naplánované úlohy'

2009-04-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-04-08 07:49]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout Star Downloaderem - c:\program files\Star Downloader\sdie.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
LSP: imon.dll
Trusted Zone: servis24.cz\www
FF - ProfilePath - c:\documents and settings\Pepa\Data aplikací\Mozilla\Firefox\Profiles\ivnp2mof.default\
FF - prefs.js: browser.search.selectedEngine - CSFD
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatche ... 60076&qkw=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 20:16
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a1,67,08,08,9c,61,19,dc,8b,86,82,92,b8,bc,52,24,56,01,97,69,51,0d,03,
c7,43,46,23,a3,70,82,8a,1e,45,90,54,b0,eb,4b,59,a5,33,41,cd,33,b9,fb,28,1d,\
"??"=hex:c9,5a,3a,96,7f,fd,46,d2,ea,9b,09,ee,a6,74,96,41
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(932)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Celkový čas: 2009-04-13 20:18
ComboFix-quarantined-files.txt 2009-04-13 18:18
ComboFix2.txt 2009-04-12 14:59
ComboFix3.txt 2009-04-12 09:41

Před spuštěním: 2 030 182 400
Po spuštění: 2,019,790,848

297 --- E O F --- 2008-07-09 06:41

[jaro3]

Tedy to je sbírka antivirů, antispyware, firewallů atd..
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated)
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)
McAfee
Free Spyware Scanner
ESET\nod32
Sunbelt Software Firewall
STOPzilla!
Lavasoft Ad-Aware
Trend Micro
Spybot - Search & Destroy
SiteAdvisor

Máš mít jen jeden antivir, jeden antispyware a jeden firewall!!!
Takže napřed se pokus vše odinstalovat a nechat od každého jeden.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\runouce.exe
c:\windows\system32\nbDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\flvDX.dll

Folder::
c:\windows\system32\runouce.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[pepei]

ComboFix 09-04-13.01 - Pepa 2009-04-13 21:23.9 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.767.478 [GMT 2:00]
Spuštěný z: c:\documents and settings\Pepa\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Pepa\Plocha\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated)
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
* Resident AV is active


FILE ::
c:\windows\system32\flvDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\nbDX.dll
c:\windows\system32\runouce.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\flvDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\nbDX.dll
c:\windows\system32\runouce.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-03-13 do 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-13 19:11 . 2009-04-13 19:11 -------- d---a-w c:\windows\system32\vcmgcd32.dll
2009-04-13 19:11 . 2009-04-13 19:11 -------- d---a-w c:\windows\system32\systems.txt
2009-04-13 19:11 . 2009-04-13 19:11 -------- d---a-w c:\windows\rundll16.exe
2009-04-13 19:11 . 2009-04-13 19:11 -------- d---a-w c:\windows\logo1_.exe
2009-04-13 19:10 . 2009-04-13 19:10 -------- d--h--w c:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-12 13:05 . 2009-04-13 19:10 -------- d-----w C:\RECYCLER(2)
2009-04-12 12:56 . 2009-04-12 12:56 -------- d-----w c:\program files\Trend Micro
2009-04-12 08:52 . 2009-04-12 08:52 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Malwarebytes
2009-04-12 08:52 . 2009-04-13 19:08 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 08:52 . 2009-04-12 08:52 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-04-11 18:03 . 2009-04-11 18:03 104 ----a-w c:\windows\system32\SBRC.dat
2009-04-11 16:58 . 2009-04-11 16:58 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Sunbelt
2009-04-11 16:57 . 2009-04-11 16:57 -------- d-----w c:\documents and settings\All Users\Data aplikací\Sunbelt
2009-04-11 16:57 . 2009-04-11 16:57 -------- d-----w c:\program files\Sunbelt Software
2009-04-11 16:39 . 2009-04-11 16:39 -------- d-----w c:\documents and settings\All Users\Data aplikací\SITEguard
2009-04-11 16:37 . 2009-04-11 16:37 -------- d-----w c:\program files\Common Files\iS3
2009-04-11 16:37 . 2009-04-12 13:45 -------- d-----w c:\documents and settings\All Users\Data aplikací\STOPzilla!
2009-04-08 05:50 . 2009-04-08 05:49 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-06 15:11 . 2009-04-13 19:10 -------- d-----w c:\program files\Lavasoft
2009-04-01 17:11 . 2009-04-01 17:11 -------- d-----w c:\documents and settings\Pepa\Data aplikací\gtk-2.0
2009-04-01 17:10 . 2009-04-01 17:10 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Inkscape
2009-04-01 16:51 . 2009-04-01 16:51 -------- d-----w c:\program files\RapidDown
2009-03-28 10:44 . 2009-03-28 10:44 -------- d-----w c:\documents and settings\Istas\Data aplikací\Inkscape
2009-03-27 09:24 . 2009-03-27 09:24 -------- d-----w c:\documents and settings\Pepa\Data aplikací\CoreCodec
2009-03-27 09:23 . 2009-03-27 09:23 -------- d-----w c:\program files\Haali
2009-03-27 09:23 . 2009-03-27 09:23 -------- d-----w c:\program files\CoreCodec
2009-03-25 11:00 . 2009-03-25 11:00 94208 ----a-w c:\windows\system32\pkcs11wrapper.dll
2009-03-25 09:06 . 2009-03-25 09:06 -------- d-----w c:\program files\Opera
2009-03-22 20:15 . 2009-03-22 20:15 89600 ----a-w c:\windows\system32\atl71.dll
2009-03-22 17:07 . 2000-11-29 02:07 307200 ----a-w c:\windows\system32\msvcr70.dll
2009-03-22 12:36 . 2005-02-12 23:00 67584 --sh--r c:\windows\system32\RLTheoraDec.ax
2009-03-22 12:36 . 2005-02-05 23:00 92672 --sh--r c:\windows\system32\RLVorbisDec.ax
2009-03-22 12:36 . 2005-02-12 23:00 51712 --sh--r c:\windows\system32\RLSpeexDec.ax
2009-03-22 12:36 . 2005-02-12 23:00 186880 --sh--r c:\windows\system32\RLOgg.ax
2009-03-22 12:36 . 2004-04-26 23:00 37888 --sh--r c:\windows\system32\RLMPCDec.ax
2009-03-22 12:36 . 2003-11-20 23:00 54784 --sh--r c:\windows\system32\RLAPEDec.ax
2009-03-22 12:36 . 2005-11-25 20:46 161792 --sh--r c:\windows\system32\RealMediaDX.ax
2009-03-22 12:35 . 2006-03-10 21:48 169472 --sh--r c:\windows\system32\MatroskaDX.ax
2009-03-22 12:35 . 2005-01-17 23:26 179200 --sh--r c:\windows\system32\DiracSplitter.ax
2009-03-22 12:35 . 2006-08-16 14:53 175104 --sh--r c:\windows\system32\CoreAAC.ax
2009-03-22 12:35 . 2006-01-12 23:23 123904 --sh--r c:\windows\system32\AVCDX.ax
2009-03-22 12:35 . 2006-09-12 11:46 227328 --sh--r c:\windows\system32\ac3DX.ax
2009-03-20 17:42 . 2009-03-21 18:40 -------- d-----w c:\documents and settings\Pepa\Data aplikací\avidemux
2009-03-20 17:42 . 2009-04-08 08:57 -------- d-----w c:\program files\Avidemux 2.5
2009-03-19 16:23 . 2009-03-19 16:23 -------- d-----w c:\program files\VirtualDub
2009-03-17 17:31 . 2009-03-17 17:31 -------- dc----w c:\documents and settings\All Users\Data aplikací\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-14 19:36 . 2009-03-14 19:36 -------- d-----w c:\documents and settings\Istas\Data aplikací\Boolat Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-13 19:10 . 2008-07-18 18:49 -------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2009-04-13 19:08 . 2007-06-13 10:04 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Azureus
2009-04-13 19:08 . 2007-03-16 20:10 -------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-04-10 11:56 . 2008-07-15 18:04 -------- d-----w c:\program files\AIMP2
2009-04-10 08:48 . 2007-07-01 14:55 -------- d-----w c:\program files\Azureus
2009-04-07 08:51 . 2007-05-12 13:42 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-04-06 16:25 . 2008-08-01 10:52 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-29 09:47 . 2001-10-25 12:00 71478 ----a-w c:\windows\system32\perfc005.dat
2009-03-29 09:47 . 2001-10-25 12:00 396124 ----a-w c:\windows\system32\perfh005.dat
2009-03-28 23:34 . 2007-03-01 18:10 -------- d-----w c:\documents and settings\Istas\Data aplikací\Skype
2009-03-28 11:15 . 2008-04-25 19:08 -------- d-----w c:\documents and settings\Istas\Data aplikací\gtk-2.0
2009-03-27 17:22 . 2008-06-12 15:50 -------- d-----w c:\documents and settings\Istas\Data aplikací\skypePM
2009-03-24 11:27 . 2008-07-17 19:13 -------- d-----w c:\program files\Google
2009-03-24 11:18 . 2008-10-18 20:36 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Any Video Converter
2009-03-22 11:56 . 2007-06-04 08:30 -------- d-----w c:\documents and settings\Pepa\Data aplikací\uTorrent
2009-03-19 19:01 . 2008-07-31 06:50 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-19 18:04 . 2008-10-25 12:50 -------- d-----w c:\program files\Bonjour
2009-03-19 14:44 . 2009-03-18 19:14 180 ----a-w C:\split.log
2009-03-17 17:55 . 2007-03-02 19:00 -------- d-----w c:\documents and settings\Istas\Data aplikací\OpenOffice.org2
2009-03-17 17:16 . 2008-10-16 16:09 3532 ----a-w C:\drmHeader.bin
2009-03-15 11:05 . 2001-10-25 12:00 219648 ----a-w c:\windows\system32\uxtheme.dll
2009-03-14 19:26 . 2008-10-26 08:31 -------- d-----w c:\documents and settings\All Users\Data aplikací\BigFishGamesCache
2009-03-12 10:35 . 2009-03-12 10:26 -------- d-----w c:\program files\GustoSoft
2009-03-09 17:30 . 2009-03-09 17:30 -------- d-----w c:\documents and settings\Administrator\Data aplikací\Happy Foto
2009-03-07 21:19 . 2009-03-06 09:10 -------- d-----w c:\documents and settings\All Users\Data aplikací\McAfee
2009-03-06 18:00 . 2008-01-06 10:25 -------- d-----w c:\documents and settings\All Users\Data aplikací\Gogii
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\LocalService\Data aplikací\SACore
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\LocalService\Data aplikací\SACore
2009-03-06 09:12 . 2009-03-06 09:12 -------- d-----w c:\documents and settings\All Users\Data aplikací\SiteAdvisor
2009-03-04 16:49 . 2007-04-11 17:59 -------- d-----w c:\documents and settings\Pepa\Data aplikací\DivX
2009-03-04 15:09 . 2007-02-24 19:54 -------- d-----w c:\documents and settings\Istas\Data aplikací\uTorrent
2009-03-04 13:37 . 2007-07-26 18:54 -------- d-----w c:\program files\DivX
2009-03-03 18:16 . 2009-03-03 18:02 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Crystal Player
2009-02-28 13:08 . 2009-02-28 13:08 -------- d-----w c:\documents and settings\Istas\Data aplikací\Zoner
2009-02-22 09:50 . 2009-02-21 00:07 -------- d-----w c:\documents and settings\Istas\Data aplikací\365dni
2009-02-20 17:17 . 2009-02-20 17:13 -------- d-----w c:\program files\Data
2009-02-17 18:08 . 2009-02-17 18:08 -------- d-----w c:\program files\viphone communicator
2009-02-17 18:03 . 2009-02-17 16:59 1060 ----a-w C:\libSRTP_log.txt
2009-02-17 18:03 . 2007-03-02 16:55 -------- d-----w c:\documents and settings\Pepa\Data aplikací\Skype
2009-02-17 17:27 . 2008-06-26 17:05 -------- d-----w c:\documents and settings\Pepa\Data aplikací\skypePM
2009-02-15 14:44 . 2007-02-28 15:34 -------- d-----w c:\program files\Common Files\Adobe
2009-02-15 14:40 . 2009-02-15 14:40 -------- d-----w c:\documents and settings\All Users\Data aplikací\Adobe Systems
2009-02-15 13:42 . 2009-02-15 13:42 -------- d-----w c:\documents and settings\Pepa\Data aplikací\AdobeUM
2008-12-07 16:06 . 2007-03-25 15:06 81920 ----a-w c:\documents and settings\Pepa\Data aplikací\ezpinst.exe
2008-12-07 16:06 . 2007-03-25 15:06 47360 ----a-w c:\documents and settings\Pepa\Data aplikací\pcouffin.sys
2008-07-11 16:58 . 2008-07-11 16:58 241 ----a-w c:\documents and settings\Pepa\SR.vbs
2007-08-12 19:37 . 2007-08-12 19:25 3655608 ----a-w c:\program files\FLV PlayerRCATSetup.exe
2007-08-12 19:36 . 2007-08-12 19:24 411248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2006-09-29 18:33 . 2006-09-29 18:33 3062696 ----a-w c:\program files\openofficeorg4.cab
2006-09-29 18:33 . 2006-09-29 18:33 55912204 ----a-w c:\program files\openofficeorg3.cab
2006-09-29 18:30 . 2006-09-29 18:30 15316170 ----a-w c:\program files\openofficeorg2.cab
2006-09-29 18:30 . 2006-09-29 18:30 17992497 ----a-w c:\program files\openofficeorg1.cab
2006-09-29 18:20 . 2006-09-29 18:20 5291520 ----a-w c:\program files\openofficeorg20.msi
2006-09-29 18:20 . 2006-09-29 18:20 1821008 ----a-w c:\program files\instmsiw.exe
2006-09-29 18:20 . 2006-09-29 18:20 1707856 ----a-w c:\program files\instmsia.exe
2004-10-01 13:00 . 2007-04-07 18:26 40960 ----a-w c:\program files\Uninstall_CDS.exe
.

------- Sigcheck -------

[7] 2004-08-03 22:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-03 22:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-04-12_16.57.29,69 )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-10-25 12:00 . 2004-08-17 14:48 16896 c:\windows\system32\dllcache\cfgmgr32.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 16439 c:\windows\system32\dllcache\author.exe
+ 2004-08-17 14:49 . 2004-08-17 14:49 20540 c:\windows\system32\dllcache\author.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 30208 c:\windows\system32\dllcache\atmlib.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 65024 c:\windows\system32\dllcache\asycfilt.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 98304 c:\windows\system32\dllcache\ahui.exe
+ 2007-02-24 17:50 . 2004-08-17 14:49 43520 c:\windows\system32\dllcache\admwprox.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 16439 c:\windows\system32\dllcache\admin.exe
+ 2004-08-17 14:49 . 2004-08-17 14:49 20540 c:\windows\system32\dllcache\admin.dll
+ 2004-08-17 14:49 . 2004-08-17 14:49 188480 c:\windows\system32\dllcache\cfgwiz.exe
+ 2001-10-25 12:00 . 2004-08-17 14:49 126976 c:\windows\system32\dllcache\apphelp.dll
+ 2007-02-24 17:50 . 2004-08-17 14:49 290816 c:\windows\system32\dllcache\adsiis51.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 116224 c:\windows\system32\dllcache\acxtrnal.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 244736 c:\windows\system32\dllcache\acspecfc.dll
+ 2001-10-25 12:00 . 2004-08-17 14:49 450048 c:\windows\system32\dllcache\aclayers.dll
+ 2007-03-09 23:06 . 2009-04-13 19:11 3804464 c:\windows\system32\Restore\rstrlog.dat
+ 2001-10-25 12:00 . 2004-08-17 14:49 1852416 c:\windows\system32\dllcache\acgenral.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-07-12 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-12 4112384]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-17 159232]
"C-Media Mixer"="Mixer.exe" [2002-07-12 c:\windows\mixer.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^viphone communicator.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\viphone communicator.lnk
backup=c:\windows\pss\viphone communicator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Pepa^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Pepa\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dní]
c:\program files\365dni\tray_365.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
--a------ 2009-04-08 07:49 515416 c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
--a------ 2007-02-24 23:27 450560 c:\program files\VIAudioi\SBADeck\ADeck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
c:\program files\Microsoft ActiveSync\Wcescomm.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2006-05-16 12:58 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2006-05-16 12:58 213936 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2006-05-16 12:58 86960 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]
--a------ 2008-03-24 14:56 917504 c:\program files\ESET\nod32kui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spy Watcher]
c:\program files\Free Spyware Scanner\SpyWatcher.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-01-27 22:01 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
-ra------ 2004-07-12 10:50 843776 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2003-10-08 11:41 57344 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe"
"NvCplDaemon"="RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"="RUNDLL32.EXE" c:\windows\System32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"=
"c:\\Documents and Settings\\Istas\\Plocha\\Wolf's Profi Miranda-Pack v1.4.0\\miranda32.exe"=
"d:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Documents and Settings\\Istas\\Dokumenty\\ICQ Lite\\304703930\\Vratko_206804567\\Counter Strike\\hl.exe"=
"d:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe"=
"c:\\Program Files\\viphone communicator\\viphone communicator.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 FTLUND;Lundinova Filter Driver;c:\windows\system32\drivers\ftlund.sys [2004-01-19 6828]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [2004-06-24 23552]
R3 tap0901_2gm;VPN Anonymizer Adapter;c:\windows\system32\DRIVERS\tap0901_2gm.sys [2007-06-21 30720]
S0 d344bus;d344bus;c:\windows\system32\DRIVERS\d344bus.sys [2003-12-27 137216]
S0 d344prt;d344prt;c:\windows\System32\Drivers\d344prt.sys [2003-12-27 5248]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-08 64160]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-10-31 270888]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-08 951632]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-04 69120]
S3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]

.
Obsah adresáře 'Naplánované úlohy'

2009-04-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-04-08 07:49]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-RunOnce-<NO NAME> - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout Star Downloaderem - c:\program files\Star Downloader\sdie.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
LSP: imon.dll
Trusted Zone: servis24.cz\www
FF - ProfilePath - c:\documents and settings\Pepa\Data aplikací\Mozilla\Firefox\Profiles\ivnp2mof.default\
FF - prefs.js: browser.search.selectedEngine - CSFD
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatche ... 60076&qkw=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 21:27
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a1,67,08,08,9c,61,19,dc,8b,86,82,92,b8,bc,52,24,56,01,97,69,51,0d,03,
c7,43,46,23,a3,70,82,8a,1e,45,90,54,b0,eb,4b,59,a5,33,41,cd,33,b9,fb,28,1d,\
"??"=hex:c9,5a,3a,96,7f,fd,46,d2,ea,9b,09,ee,a6,74,96,41
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(928)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Celkový čas: 2009-04-13 21:30
ComboFix-quarantined-files.txt 2009-04-13 19:29
ComboFix2.txt 2009-04-12 14:59
ComboFix3.txt 2009-04-12 09:41

Před spuštěním: 1 758 793 728
Po spuštění: 1,748,619,264

307 --- E O F --- 2008-07-09 06:41


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37, on 13.4.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FoxyTunes Toolbar Helper - {784D8FBC-4165-4D88-90FB-62907ACDD045} - C:\Program Files\FoxyTunes\ForInternetExplorer\components\IE\FoxyTunesForIE.dll
O2 - BHO: (no name) - {93935F7F-9C88-42F8-8445-95251D27FABC} - (no file)
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: FoxyTunes Toolbar - {1D1901C3-F72A-46f3-9DBB-0AAA0DEEF6DF} - C:\Program Files\FoxyTunes\ForInternetExplorer\components\IE\FoxyTunesForIE.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Star Downloaderem - C:\Program Files\Star Downloader\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 7767 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {93935F7F-9C88-42F8-8445-95251D27FABC} - (no file)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Aktualizuj javu:
Java SE Runtime Environment 6u13
Vyber OS ( předpokládám Windows), dej zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u13-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.

Napiš, jak je to s explorerem.

[pepei]

Ahoj
Vsechno jsem udelal podle tvych rad za ktere dekuji ale je to porad stejny,tem Combofix numuzu odstranit nemam start-spustit.Vse delam pres spravce uloh protoze plochu mam cistou.Ted se tlucu do hlavy ze jsem ten Counterspy
vubec instaloval tim to vse zacalo i kdyz jsem ho odinstaloval.Jestli mas jeste nejaky rady byl bych rad za pomoc.

[jaro3]

Stáhni si Dial-a-fix
Control Panel applets - Pokusí se o opravu Ovládacích panelů.
Nebo:
Klikni na kladívko-další možnosti:
SFC scan - Spustí nástroj pro kontrolu systémových souborů (případná potřeba instalačního media Windows)
kLIKNI NA SLUŽBU A POTOM NA go.

[pepei]

No tak jsem asi skoncil nemam totiz to CD.Sice mam jine Windows XP Media Center Edition ale to tam asi dat nemuzu.
Jinak to prvni jsem udelal ale bez odezvi.

[jaro3]

Zkus si vypůjčit Cd se stejným OS jako máš Ty.

[pepei]

Problem nikoho tady neznam a CD me jen tak nikdo nepujci takze jsem jak se rika v pr....

[CZechBoY]

tak si ho stáhni z netu :) jinak Spustit je klávesová zkratka Win+R

[pepei]

Ta k.zkratka me nefunguje z netu by to slo ale nejsem tak zkusenej nevim jaky Windows,kde a jak a kdyz to stahnu
tak nevim co dal windows jsem nikdy neinstaloval.Kdybych to umel tak tam dam ty media center.
Nekde jsem cetl ze se da ten explorer.exe stahnout nebo nainstalovat z toho instal CD.