Your computer is infected! Vyřešeno

[ufcbax]

spát ještě nejdu,chtěl bych to zvládnout moc děkuju za pomoc.

[Reklama]

[Damned]

Tak fixni ten seznam, pak pokračuj tím MbAM.

[ufcbax]

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3014
Windows 5.1.2600 Service Pack 3

23.10.2009 1:39:42
mbam-log-2009-10-23 (01-39-36).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 129117
Uplynulý čas: 6 minute(s), 52 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 1
Infikované klíče registru: 1
Infikované hodnoty registru: 3
Infikované datové položky registru: 3
Infikované adresáře: 0
Infikované soubory: 35

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
C:\WINDOWS\system32\cpcp.cpo (Trojan.Agent) -> No action taken.

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\lizkavd (Trojan.FakeAlert) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> No action taken.

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Documents and Settings\Aleš\Data aplikací\seres.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Data aplikací\svcst.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN1.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN2.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN3.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN4.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN5.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN6.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN7.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN8.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN9.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\BNB.tmp (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\cpcp.cpo (Trojan.Agent) -> No action taken.
C:\Documents and Settings\All Users\Data aplikací\epyhosovi.reg (Rogue.AntiVirusPro) -> No action taken.
C:\Documents and Settings\All Users\Data aplikací\nuxemosaho.reg (Rogue.AntiVirusPro) -> No action taken.
C:\Documents and Settings\All Users\Data aplikací\ynetexe.reg (Rogue.AntiVirusPro) -> No action taken.
C:\Documents and Settings\Aleš\Data aplikací\dedil.reg (Rogue.AntiVirusPro) -> No action taken.
C:\Documents and Settings\Aleš\Data aplikací\lizkavd.exe (Rogue.AntiVirusPro) -> No action taken.
C:\Documents and Settings\Aleš\Data aplikací\wiaserva.log (Malware.Trace) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr2 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr3 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr4 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr5 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr6 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr7 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr8 (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr9 (Rogue.Installer) -> No action taken.
C:\WINDOWS\Temp\wpv241255703227.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\Temp\wpv431256085323.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temporary Internet Files\belojolyz.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Aleš\Local Settings\Temporary Internet Files\pse_350_csy.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Aleš\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> No action taken.
C:\Documents and Settings\Aleš\restorer64_a.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\restorer64_a.exe (Trojan.FakeAlert) -> No action taken.

[Damned]

Pozorně čti a proveď.

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[ufcbax]

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3014
Windows 5.1.2600 Service Pack 3

23.10.2009 1:56:42
mbam-log-2009-10-23 (01-56-42).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 129281
Uplynulý čas: 1 minute(s), 32 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 1
Infikované klíče registru: 1
Infikované hodnoty registru: 3
Infikované datové položky registru: 3
Infikované adresáře: 0
Infikované soubory: 35

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
C:\WINDOWS\system32\cpcp.cpo (Trojan.Agent) -> Delete on reboot.

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\lizkavd (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Documents and Settings\Aleš\Data aplikací\seres.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Data aplikací\svcst.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN1.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN2.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN3.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN4.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN5.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN6.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN7.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN8.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BN9.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Aleš\Local Settings\Temp\BNB.tmp (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\cpcp.cpo (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\All Users\Data aplikací\epyhosovi.reg (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Data aplikací\nuxemosaho.reg (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Data aplikací\ynetexe.reg (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Data aplikací\dedil.reg (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Data aplikací\lizkavd.exe (Rogue.AntiVirusPro) -> Delete on reboot.
C:\Documents and Settings\Aleš\Data aplikací\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr2 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr3 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr4 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr5 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr6 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr7 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr8 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temp\tmpwr9 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv241255703227.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv431256085323.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temporary Internet Files\belojolyz.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\Local Settings\Temporary Internet Files\pse_350_csy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Aleš\restorer64_a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\restorer64_a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

[ufcbax]

MbAM chce restartovat, aby mohl dokončit proces. mám restartovat ?

[Damned]

Samozřejmě

[ufcbax]

Při nastartování počitače se objevila hláška "Chyba při načítání souboru cpcp.cpo uvedený modul nebyl nalezen"

[ufcbax]

ComboFix 09-10-21.02 - Aleš 23.10.2009 2:28.1.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2865 [GMT 2:00]
Spuštěný z: c:\documents and settings\Aleš\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091022-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ALE~1\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\ALE~1\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\Aleç\Data aplikacˇ\ixodukiji.bat
c:\documents and settings\All Users\Dokumenty\aqene.exe
c:\documents and settings\All Users\Dokumenty\emijujyjuk.exe
c:\documents and settings\All Users\Dokumenty\tewi.exe
c:\documents and settings\All Users\Dokumenty\tububomok.ban
c:\documents and settings\All Users\Dokumenty\uwapab.reg
c:\documents and settings\All Users\Dokumenty\vivisyvako.scr
c:\documents and settings\All Users\Dokumenty\vucucy._sy
c:\documents and settings\All Users\Dokumenty\ypecehyke.scr
c:\program files\Common Files\carap.pif
c:\program files\Common Files\omyziha.bin
c:\program files\Common Files\oromiva._sy
c:\program files\Common Files\ryja.bin
c:\windows\capyzoxajy.inf
c:\windows\juqavy.sys
c:\windows\liludo.vbs
c:\windows\system32\aqozuhos.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\oriz.reg
c:\windows\system32\ryzipid.pif
c:\windows\system32\ucygupaku.vbs
c:\windows\system32\ygylequv.reg
c:\windows\toviv.reg
c:\windows\uqovox.pif
c:\windows\uzamipylum.dl
c:\windows\wapo.scr
c:\windows\ywuhuqyc.scr
c:\windows\zixe.pif

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-23 do 2009-10-23 )))))))))))))))))))))))))))))))
.

2009-10-22 23:30 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-22 23:30 . 2009-10-22 23:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-22 23:30 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-22 20:32 . 2009-10-22 20:32 -------- d-----w- c:\program files\Trend Micro
2009-10-22 14:56 . 2009-10-22 14:56 18737 ----a-w- c:\windows\ocobero.dat
2009-10-22 14:56 . 2009-10-22 14:56 10303 ----a-w- c:\windows\ovepyzygi.dat
2009-10-21 20:41 . 2009-10-21 20:41 -------- d-----w- c:\program files\Software602
2009-10-04 14:17 . 2009-10-04 15:17 19567 ----a-w- c:\windows\hpqins13.dat
2009-09-27 16:19 . 2009-09-27 16:19 3674112 ----a-w- c:\windows\system32\nvwssr.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-22 15:31 . 2009-10-22 15:31 17440 ----a-w- c:\program files\Common Files\xuka.lib
2009-10-21 21:33 . 2008-12-06 18:27 -------- d-----w- c:\program files\EXPERTool
2009-10-17 10:08 . 2008-10-04 21:14 -------- d-----w- c:\program files\DivX
2009-10-17 10:08 . 2009-04-06 20:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-14 21:55 . 2007-10-29 12:00 79062 ----a-w- c:\windows\system32\perfc005.dat
2009-10-14 21:55 . 2007-10-29 12:00 432004 ----a-w- c:\windows\system32\perfh005.dat
2009-10-12 16:53 . 2008-12-20 21:39 -------- d-----w- c:\program files\Soldier of Fortune II - Double Helix GOLD
2009-09-27 16:19 . 2009-09-27 16:19 3166208 ----a-w- c:\windows\system32\nvwss.dll
2009-09-27 14:12 . 2009-08-16 22:57 2194024 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 14:12 . 2009-08-16 22:57 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 14:12 . 2009-08-16 22:57 1604482 ----a-w- c:\windows\system32\nvdata.bin
2009-09-27 14:12 . 2008-09-21 10:13 490088 ----a-w- c:\windows\system32\nvudisp.exe
2009-09-27 14:12 . 2008-09-21 10:13 7655872 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-09-27 14:12 . 2008-09-21 10:13 888832 ----a-w- c:\windows\system32\nvapi.dll
2009-09-27 14:12 . 2008-09-21 10:13 5900416 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-27 14:12 . 2008-09-21 10:13 170600 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-27 14:12 . 2008-09-21 10:13 170600 ----a-w- c:\windows\system32\nvcod.dll
2009-09-27 14:12 . 2008-09-21 10:13 10756096 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-27 14:12 . 2008-05-03 03:46 2007040 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-24 07:24 . 2008-09-21 10:13 490088 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-09-16 17:24 . 2009-07-08 18:52 -------- d-----w- c:\program files\rajce
2009-09-15 10:59 . 2008-09-21 12:21 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2008-09-21 12:21 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2008-09-21 12:21 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2008-09-21 12:30 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2008-09-21 12:30 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2008-09-21 12:21 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2008-09-21 12:21 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2008-09-21 12:21 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2008-09-21 12:21 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-11 14:19 . 2007-10-29 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-05 15:57 . 2009-09-05 15:57 -------- d-----w- c:\program files\Unity
2009-09-04 21:05 . 2007-10-29 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:58 . 2007-10-29 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 18:50 . 2008-10-04 21:48 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-27 18:50 . 2008-12-06 18:29 -------- d-----w- c:\program files\AGEIA Technologies
2009-08-27 18:50 . 2009-08-27 18:50 -------- d-----w- c:\program files\NVIDIA Corporation
2009-08-27 18:41 . 2008-09-21 14:44 -------- d-----w- c:\program files\SystemRequirementsLab
2009-08-26 08:02 . 2007-10-29 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 12:57 . 2008-10-12 09:49 -------- d-----w- c:\program files\Java
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-08-05 09:01 . 2007-10-29 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:29 . 2007-10-29 12:00 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:29 . 2004-08-17 15:45 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-02 22:21 . 2009-08-02 22:21 23320 ----a-w- c:\windows\system32\PhysXDevice.dll
2009-07-25 03:23 . 2008-11-25 18:31 411368 ----a-w- c:\windows\system32\deploytk.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-27 1211176]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2007-02-20 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-09-23 1657448]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-04-12 16132608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Soldier of Fortune II - Double Helix GOLD\\SoF2MP.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Nero\\Nero 7\\ODD Toolkit\\ODDUpdate.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Buka\\Fair Strike\\FS.EXE"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Sierra Entertainment\\Empire Earth III\\EE3.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Battlefront\\GameData\\battlefront.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Republic Commando\\GameData\\System\\SWRepublicCommando.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\HD Publishing\\Joint Task Force\\jtf.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [21.9.2008 11:52 143256]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21.9.2008 14:30 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21.9.2008 14:30 20560]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [23.5.2007 2:17 20539]
R3 PinnacleMarvinAVS;Pinnacle AVStream Service for MovieBox Deluxe, 500-USB and 700-USB;c:\windows\system32\drivers\MarvinAVS.sys [12.10.2008 20:56 434176]
R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\drivers\V0260Vid.sys [6.10.2008 21:25 178913]
S3 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [12.6.2007 20:54 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-23 02:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%]
@Class="Shell"

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%\OpenWithList]
@Class="Shell"
.
Celkový čas: 2009-10-23 2:34
ComboFix-quarantined-files.txt 2009-10-23 00:34

Před spuštěním: Volných bajtů: 314 681 004 032
Po spuštění: Volných bajtů: 316 101 832 704

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F7ECD962C7A9BFECCF9FE1ADC685B1FE

[Damned]

Zase pozorně čti.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\ocobero.dat
c:\windows\ovepyzygi.dat
c:\program files\Common Files\xuka.lib

RegLockDel::
[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%]
@Class="Shell"
[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%\OpenWithList]




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače
Tu hlášku opravíme za chvíli

[ufcbax]

Žádná chybová hláška se neobjevila.


ComboFix 09-10-21.02 - Aleš 23.10.2009 3:00.2.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2764 [GMT 2:00]
Spuštěný z: c:\documents and settings\Aleš\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Aleš\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1356 [VPS 091022-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\program files\Common Files\xuka.lib"
"c:\windows\ocobero.dat"
"c:\windows\ovepyzygi.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Aleç\Data aplikacˇ\ixodukiji.bat
c:\program files\Common Files\xuka.lib
c:\windows\ocobero.dat
c:\windows\ovepyzygi.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-23 do 2009-10-23 )))))))))))))))))))))))))))))))
.

2009-10-22 23:30 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-22 23:30 . 2009-10-22 23:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-22 23:30 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-22 20:32 . 2009-10-22 20:32 -------- d-----w- c:\program files\Trend Micro
2009-10-21 20:41 . 2009-10-21 20:41 -------- d-----w- c:\program files\Software602
2009-10-04 14:17 . 2009-10-04 15:17 19567 ----a-w- c:\windows\hpqins13.dat
2009-09-27 16:19 . 2009-09-27 16:19 3674112 ----a-w- c:\windows\system32\nvwssr.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-21 21:33 . 2008-12-06 18:27 -------- d-----w- c:\program files\EXPERTool
2009-10-17 10:08 . 2008-10-04 21:14 -------- d-----w- c:\program files\DivX
2009-10-17 10:08 . 2009-04-06 20:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-14 21:55 . 2007-10-29 12:00 79062 ----a-w- c:\windows\system32\perfc005.dat
2009-10-14 21:55 . 2007-10-29 12:00 432004 ----a-w- c:\windows\system32\perfh005.dat
2009-10-12 16:53 . 2008-12-20 21:39 -------- d-----w- c:\program files\Soldier of Fortune II - Double Helix GOLD
2009-09-27 16:19 . 2009-09-27 16:19 3166208 ----a-w- c:\windows\system32\nvwss.dll
2009-09-27 14:12 . 2009-08-16 22:57 2194024 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 14:12 . 2009-08-16 22:57 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 14:12 . 2009-08-16 22:57 1604482 ----a-w- c:\windows\system32\nvdata.bin
2009-09-27 14:12 . 2008-09-21 10:13 490088 ----a-w- c:\windows\system32\nvudisp.exe
2009-09-27 14:12 . 2008-09-21 10:13 7655872 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-09-27 14:12 . 2008-09-21 10:13 888832 ----a-w- c:\windows\system32\nvapi.dll
2009-09-27 14:12 . 2008-09-21 10:13 5900416 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-27 14:12 . 2008-09-21 10:13 170600 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-27 14:12 . 2008-09-21 10:13 170600 ----a-w- c:\windows\system32\nvcod.dll
2009-09-27 14:12 . 2008-09-21 10:13 10756096 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-27 14:12 . 2008-05-03 03:46 2007040 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-24 07:24 . 2008-09-21 10:13 490088 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-09-16 17:24 . 2009-07-08 18:52 -------- d-----w- c:\program files\rajce
2009-09-15 10:59 . 2008-09-21 12:21 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2008-09-21 12:21 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2008-09-21 12:21 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2008-09-21 12:30 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2008-09-21 12:30 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2008-09-21 12:21 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2008-09-21 12:21 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2008-09-21 12:21 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2008-09-21 12:21 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-11 14:19 . 2007-10-29 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-05 15:57 . 2009-09-05 15:57 -------- d-----w- c:\program files\Unity
2009-09-04 21:05 . 2007-10-29 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:58 . 2007-10-29 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-27 18:50 . 2008-10-04 21:48 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-27 18:50 . 2008-12-06 18:29 -------- d-----w- c:\program files\AGEIA Technologies
2009-08-27 18:50 . 2009-08-27 18:50 -------- d-----w- c:\program files\NVIDIA Corporation
2009-08-27 18:41 . 2008-09-21 14:44 -------- d-----w- c:\program files\SystemRequirementsLab
2009-08-26 08:02 . 2007-10-29 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 12:57 . 2008-10-12 09:49 -------- d-----w- c:\program files\Java
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-08-05 09:01 . 2007-10-29 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:29 . 2007-10-29 12:00 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:29 . 2004-08-17 15:45 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-08-02 22:21 . 2009-08-02 22:21 23320 ----a-w- c:\windows\system32\PhysXDevice.dll
2009-07-25 03:23 . 2008-11-25 18:31 411368 ----a-w- c:\windows\system32\deploytk.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-27 1211176]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2007-02-20 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-09-23 1657448]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-04-12 16132608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Soldier of Fortune II - Double Helix GOLD\\SoF2MP.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Nero\\Nero 7\\ODD Toolkit\\ODDUpdate.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Buka\\Fair Strike\\FS.EXE"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Sierra Entertainment\\Empire Earth III\\EE3.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Battlefront\\GameData\\battlefront.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Republic Commando\\GameData\\System\\SWRepublicCommando.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\HD Publishing\\Joint Task Force\\jtf.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [21.9.2008 11:52 143256]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21.9.2008 14:30 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21.9.2008 14:30 20560]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [23.5.2007 2:17 20539]
R3 PinnacleMarvinAVS;Pinnacle AVStream Service for MovieBox Deluxe, 500-USB and 700-USB;c:\windows\system32\drivers\MarvinAVS.sys [12.10.2008 20:56 434176]
R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\drivers\V0260Vid.sys [6.10.2008 21:25 178913]
S3 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [12.6.2007 20:54 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-23 03:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%]
@Class="Shell"

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%f%*%\OpenWithList]
@Class="Shell"
.
Celkový čas: 2009-10-23 3:03
ComboFix-quarantined-files.txt 2009-10-23 01:03
ComboFix2.txt 2009-10-23 00:34

Před spuštěním: Volných bajtů: 316 129 603 584
Po spuštění: Volných bajtů: 316 111 048 704

- - End Of File - - 6293A6CE89C715792F99077E6D04354F

[Damned]

Najdi mi batovej soubor:
c:\documents and settings\Aleš\Data aplikaci\ixodukiji.bat , dej ho do archívu a přilož mi ho sem jako přílohu. Soubor může být skrytý.
*****************************************************************************************************************************************
Stáhni si OTL na Plochu.
Ujisti se , že máš zavřena všechna ostatní okna a poklepej na ikonu OTL.Nahoře v okně pod Output klikni na minimal Output.Pod Standard Registry změň na All. Zatrhni LOP Check a Purity Check. Klikni na Run Scan. Všechny ostatní nastavení ponech jak jsou. Sken může trvat dlouho, až skončí otevřou se dva logy:
OTL.Txt
Extras.Txt
Jsou uloženy ve stejném místě jako OTL. Oba logy sem prosím zkopíruj