PC-HELP.CZ

Rad bych poprosil o kontrolu logu a o pomoc pri reseni problemu, ktery mam. Bohuzel je to tak tyden, kdy me zacla zlobit jedna vec. Pri hrani her se mi po urcitem case 5-10min zacne sama od sebe minimalizovat hra do windows a pri naslednem vraceni se do hry se opet minimalizuje. Vetsinou to trva zhruba 30s a minimalizuje se to cca po 2s. Vsiml jsem si, ze kdyz pri teto minimalizaci koukam do taskmanageru, ze se zapina a vypina iexplore.exe v procesech. Uz jsem zkousel procistit PC ruznymi programy na spyware, ale porad tuto ne moc prijemnou vec mam. Predem dekuji za rady a pomoc. Prikladam log z hijackthis.


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:31:50, on 8.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\mIRc\mirc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\totalcmd\TOTALCMD.EXE
c:\Programy\Hijackthis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVRT] C:\Program Files\NVRefreshTool\nvrt.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechno FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\Program Files\bet365MPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O21 - SSODL: zip - {20fc3142-8801-44e9-8f00-7b661268c44f} - C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll
O21 - SSODL: VolumeService - {456f426a-4b4e-4ae0-bd87-8d54b863f9fa} - C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll
O21 - SSODL: CDMon - {8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc} - C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll
O21 - SSODL: CDCD - {d2b23ed4-4cc2-471c-b2f0-48da0c790ce2} - C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

--
End of file - 6899 bytes

vypni štít toho Sunbelt CounterSpy Antispyware-nod si to pohlídá.

fixni
v okně programu HJT zaškrtni nalevo u položek co napíšu a potom klik na Fix checked
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\Program Files\bet365MPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O21 - SSODL: zip - {20fc3142-8801-44e9-8f00-7b661268c44f} - C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll
O21 - SSODL: VolumeService - {456f426a-4b4e-4ae0-bd87-8d54b863f9fa} - C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll
O21 - SSODL: CDMon - {8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc} - C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll
O21 - SSODL: CDCD - {d2b23ed4-4cc2-471c-b2f0-48da0c790ce2} - C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll

použij Avenger http://www.spyware.cz/go.php?p=spyware&t=aplikace&id=35

a tento skript


povol restart,po něm log z avengeru a nový log z hijackthis

Udelal jsem vsechno jak jste mi poradil. Novy log z hijackthis mam, ale z toho avengeru jsem to nejak nepochopil odkud ho mam vzit. Vytvorilo to totiz po restartu akorat prazdny soubor avenger.txt. Tady je ten log z hijackthis a zatim dekuji za pomoc. Uvidim pozdeji jestli problem pretrval nebo ne.



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:37:55, on 8.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\mIRc\mirc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\totalcmd\TOTALCMD.EXE
c:\Programy\Hijackthis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVRT] C:\Program Files\NVRefreshTool\nvrt.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechno FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O21 - SSODL: zip - {20fc3142-8801-44e9-8f00-7b661268c44f} - C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll
O21 - SSODL: CDCD - {d2b23ed4-4cc2-471c-b2f0-48da0c790ce2} - C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll
O21 - SSODL: CDMon - {8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc} - C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll
O21 - SSODL: VolumeService - {456f426a-4b4e-4ae0-bd87-8d54b863f9fa} - C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)

--
End of file - 5983 bytes

pošli log z combofixu.tohle je nový a nějak ještě nevím jak naň.

tady je log z combofixu:

ComboFix 08-02.05.3 - Flamer 2008-02-09 0:30:12.1 - NTFSx86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1785 [GMT 1:00]
Running from: c:\Programy\combofix\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-08 21:36 . 2008-02-08 21:36 0 --a------ C:\WINDOWS\system32\SBRC.dat
2008-02-08 21:36 . 2008-02-08 21:36 0 --a------ C:\WINDOWS\system32\SBFC.dat
2008-02-08 19:23 . 2008-02-08 19:23 11,341 --a------ C:\Program Files\tmp385687.exe
2008-02-08 19:23 . 2008-02-08 19:23 11,341 --a------ C:\Program Files\tmp385671.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp384500.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383687.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383671.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383625.exe
2008-02-08 19:23 . 2008-02-08 19:23 9,881 --a------ C:\Program Files\tmp385640.exe
2008-02-08 11:42 . 2008-02-08 11:42 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\Sunbelt Software
2008-02-08 11:35 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-08 11:14 . 2008-02-08 11:23 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\HouseCall 6.6
2008-02-07 14:47 . 2008-02-07 14:47 11,341 --a------ C:\Program Files\tmp55218.exe
2008-02-07 14:47 . 2008-02-07 14:47 10,469 --a------ C:\Program Files\tmp54500.exe
2008-02-06 08:22 . 2008-02-06 08:22 11,341 --a------ C:\Program Files\tmp18099281.exe
2008-02-06 08:22 . 2008-02-06 08:22 11,341 --a------ C:\Program Files\tmp18099265.exe
2008-02-02 12:37 . 2008-02-02 12:37 <DIR> d-------- C:\Program Files\Interplay
2008-02-02 12:32 . 2008-02-02 12:35 <DIR> d-------- C:\Program Files\TalonSoft
2008-02-01 02:55 . 2008-01-07 14:29 352 --ah----- C:\WINDOWS\nod32fixtemdono.reg
2008-02-01 02:54 . 2008-02-01 02:54 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\ESET
2008-02-01 02:19 . 2008-02-01 02:21 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-01 02:19 . 2008-02-01 02:45 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-02-01 02:12 . 2008-02-01 02:12 <DIR> d-------- C:\Program Files\AxBx
2008-01-27 14:48 . 2008-01-27 14:48 <DIR> d-------- C:\Program Files\Monte Cristo
2008-01-24 20:07 . 2008-01-24 20:07 <DIR> d-------- C:\Casino
2008-01-16 14:52 . 2008-01-16 14:52 <DIR> d-------- C:\Program Files\Ventrilo
2008-01-15 20:33 . 2008-01-15 20:41 <DIR> d-------- C:\Program Files\Full Tilt Poker

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 22:14 --------- d-----w C:\Program Files\FlashGet
2008-02-08 22:09 --------- d-----w C:\Program Files\MVPedit
2008-02-08 11:14 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin
2008-02-08 10:47 --------- d-----w C:\Program Files\WinPcap
2008-02-08 01:41 --------- d-----w C:\Program Files\Warcraft III
2008-02-07 15:15 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Vso
2008-02-03 15:49 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Skype
2008-02-01 01:54 --------- d-----w C:\Program Files\Centauri
2008-02-01 01:51 --------- d-----w C:\Program Files\Eset
2008-02-01 01:51 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Eset
2008-02-01 01:47 --------- d-----w C:\Program Files\EvilLyrics
2008-01-23 02:19 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\DivX
2008-01-19 18:38 --------- d-----w C:\Program Files\bwin
2008-01-15 19:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 10:55 --------- d-----w C:\Program Files\PokerStars
2008-01-11 20:12 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Hamachi
2007-12-28 10:37 --------- d-----w C:\Program Files\DivX
2007-12-28 01:39 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\COWON
2007-12-28 01:38 --------- d-----w C:\Program Files\JetAudio
2007-12-28 01:38 --------- d-----w C:\Program Files\Common Files\COWON
2007-12-21 22:47 --------- d-----w C:\Program Files\TrackMania Nations
2007-12-21 07:21 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-12-21 07:21 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-12-21 07:21 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-12-16 13:37 --------- d-----w C:\Program Files\Strategy First
2007-12-12 22:48 --------- d-----w C:\Program Files\EA SPORTS
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-11-29 22:30 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-29 22:30 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-09-07 00:31 16,368 ----a-w C:\Documents and Settings\Flamer\Data aplikací\GDIPFONTCACHEV1.DAT
2007-03-30 23:16 81,920 ----a-w C:\Documents and Settings\Flamer\Data aplikací\ezpinst.exe
2007-03-30 23:16 47,360 ----a-w C:\Documents and Settings\Flamer\Data aplikací\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"nwiz"="nwiz.exe" []
"NVRT"="C:\Program Files\NVRefreshTool\nvrt.exe" [2003-02-09 19:16 294912]
"QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2007-03-30 12:17 98304]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-03-30 06:32:14 692224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"= {20fc3142-8801-44e9-8f00-7b661268c44f} - C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll [2008-02-05 06:34 39462]
"CDCD"= {d2b23ed4-4cc2-471c-b2f0-48da0c790ce2} - C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll [2008-02-07 01:00 14374]
"CDMon"= {8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc} - C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll [2008-02-06 01:03 14374]
"VolumeService"= {456f426a-4b4e-4ae0-bd87-8d54b863f9fa} - C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll [2008-02-05 06:33 14374]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Flamer^Nabídka Start^Programy^Po spuštění^Zástupce - MultiRes.lnk]
path=C:\Documents and Settings\Flamer\Nabídka Start\Programy\Po spuštění\Zástupce - MultiRes.lnk
backup=C:\WINDOWS\pss\Zástupce - MultiRes.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
--a------ 2004-08-17 14:49 5632 C:\WINDOWS\system32\winver.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBB36X Configure]
-r------- 2006-07-12 10:58 356352 C:\WINDOWS\system32\JMRaidTool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRT]
--a------ 2003-02-09 19:16 294912 C:\Program Files\NVRefreshTool\nvrt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-03-30 12:17 98304 C:\WINDOWS\system32\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegPowerClean]
C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBCSTray]
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-06-08 14:18 23233576 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

S0 lcydvjci;lcydvjci;C:\WINDOWS\system32\drivers\lgpqnmhx.sys []
S2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2007-10-29 03:14]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]
S3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 09:06]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-05 08:00:00 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 00:34:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-09 0:36:18
ComboFix-quarantined-files.txt 2008-02-08 23:36:16
.
2008-02-07 19:01:57 --- E O F ---

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu+new log z hijackthis

log z combofixu:


ComboFix 08-02.05.3 - Flamer 2008-02-09 11:11:21.2 - NTFSx86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1789 [GMT 1:00]
Running from: C:\Documents and Settings\Flamer\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Flamer\Plocha\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll
C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll
C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll
C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Installer\{20fc3142-8801-44e9-8f00-7b661268c44f}\zip.dll
C:\WINDOWS\Installer\{456f426a-4b4e-4ae0-bd87-8d54b863f9fa}\VolumeService.dll
C:\WINDOWS\Installer\{8bcf3eba-8a4c-4c37-979a-2ca9e45b18bc}\CDMon.dll
C:\WINDOWS\Installer\{d2b23ed4-4cc2-471c-b2f0-48da0c790ce2}\CDCD.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-09 to 2008-02-09 )))))))))))))))))))))))))))))))
.

2008-02-09 00:25 . 2004-08-17 14:49 389,632 --a------ C:\kmd.exe
2008-02-08 21:36 . 2008-02-08 21:36 0 --a------ C:\WINDOWS\system32\SBRC.dat
2008-02-08 21:36 . 2008-02-08 21:36 0 --a------ C:\WINDOWS\system32\SBFC.dat
2008-02-08 19:23 . 2008-02-08 19:23 11,341 --a------ C:\Program Files\tmp385687.exe
2008-02-08 19:23 . 2008-02-08 19:23 11,341 --a------ C:\Program Files\tmp385671.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp384500.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383687.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383671.exe
2008-02-08 19:23 . 2008-02-08 19:23 10,240 --a------ C:\Program Files\tmp383625.exe
2008-02-08 19:23 . 2008-02-08 19:23 9,881 --a------ C:\Program Files\tmp385640.exe
2008-02-08 11:42 . 2008-02-08 11:42 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\Sunbelt Software
2008-02-08 11:35 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-08 11:14 . 2008-02-08 11:23 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\HouseCall 6.6
2008-02-07 14:47 . 2008-02-07 14:47 11,341 --a------ C:\Program Files\tmp55218.exe
2008-02-07 14:47 . 2008-02-07 14:47 10,469 --a------ C:\Program Files\tmp54500.exe
2008-02-06 08:22 . 2008-02-06 08:22 11,341 --a------ C:\Program Files\tmp18099281.exe
2008-02-06 08:22 . 2008-02-06 08:22 11,341 --a------ C:\Program Files\tmp18099265.exe
2008-02-02 12:37 . 2008-02-02 12:37 <DIR> d-------- C:\Program Files\Interplay
2008-02-02 12:32 . 2008-02-02 12:35 <DIR> d-------- C:\Program Files\TalonSoft
2008-02-01 02:55 . 2008-01-07 14:29 352 --ah----- C:\WINDOWS\nod32fixtemdono.reg
2008-02-01 02:54 . 2008-02-01 02:54 <DIR> d-------- C:\Documents and Settings\Flamer\Data aplikací\ESET
2008-02-01 02:19 . 2008-02-01 02:21 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-01 02:19 . 2008-02-01 02:45 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-02-01 02:12 . 2008-02-01 02:12 <DIR> d-------- C:\Program Files\AxBx
2008-01-27 14:48 . 2008-01-27 14:48 <DIR> d-------- C:\Program Files\Monte Cristo
2008-01-24 20:07 . 2008-01-24 20:07 <DIR> d-------- C:\Casino
2008-01-16 14:52 . 2008-01-16 14:52 <DIR> d-------- C:\Program Files\Ventrilo
2008-01-15 20:33 . 2008-01-15 20:41 <DIR> d-------- C:\Program Files\Full Tilt Poker

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 23:58 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin
2008-02-08 22:14 --------- d-----w C:\Program Files\FlashGet
2008-02-08 22:09 --------- d-----w C:\Program Files\MVPedit
2008-02-08 10:47 --------- d-----w C:\Program Files\WinPcap
2008-02-08 01:41 --------- d-----w C:\Program Files\Warcraft III
2008-02-07 15:15 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Vso
2008-02-03 15:49 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Skype
2008-02-01 01:54 --------- d-----w C:\Program Files\Centauri
2008-02-01 01:51 --------- d-----w C:\Program Files\Eset
2008-02-01 01:51 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Eset
2008-02-01 01:47 --------- d-----w C:\Program Files\EvilLyrics
2008-01-23 02:19 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\DivX
2008-01-19 18:38 --------- d-----w C:\Program Files\bwin
2008-01-15 19:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 10:55 --------- d-----w C:\Program Files\PokerStars
2008-01-11 20:12 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\Hamachi
2007-12-28 10:37 --------- d-----w C:\Program Files\DivX
2007-12-28 01:39 --------- d-----w C:\Documents and Settings\Flamer\Data aplikací\COWON
2007-12-28 01:38 --------- d-----w C:\Program Files\JetAudio
2007-12-28 01:38 --------- d-----w C:\Program Files\Common Files\COWON
2007-12-21 22:47 --------- d-----w C:\Program Files\TrackMania Nations
2007-12-21 07:21 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-12-21 07:21 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-12-21 07:21 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-12-16 13:37 --------- d-----w C:\Program Files\Strategy First
2007-12-12 22:48 --------- d-----w C:\Program Files\EA SPORTS
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-11-29 22:30 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-29 22:30 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-09-07 00:31 16,368 ----a-w C:\Documents and Settings\Flamer\Data aplikací\GDIPFONTCACHEV1.DAT
2007-03-30 23:16 81,920 ----a-w C:\Documents and Settings\Flamer\Data aplikací\ezpinst.exe
2007-03-30 23:16 47,360 ----a-w C:\Documents and Settings\Flamer\Data aplikací\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"nwiz"="nwiz.exe" []
"NVRT"="C:\Program Files\NVRefreshTool\nvrt.exe" [2003-02-09 19:16 294912]
"QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2007-03-30 12:17 98304]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-03-30 06:32:14 692224]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Flamer^Nabídka Start^Programy^Po spuštění^Zástupce - MultiRes.lnk]
path=C:\Documents and Settings\Flamer\Nabídka Start\Programy\Po spuštění\Zástupce - MultiRes.lnk
backup=C:\WINDOWS\pss\Zástupce - MultiRes.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
--a------ 2004-08-17 14:49 5632 C:\WINDOWS\system32\winver.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBB36X Configure]
-r------- 2006-07-12 10:58 356352 C:\WINDOWS\system32\JMRaidTool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRT]
--a------ 2003-02-09 19:16 294912 C:\Program Files\NVRefreshTool\nvrt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-03-30 12:17 98304 C:\WINDOWS\system32\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegPowerClean]
C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBCSTray]
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-06-08 14:18 23233576 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

S0 lcydvjci;lcydvjci;C:\WINDOWS\system32\drivers\lgpqnmhx.sys []
S2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2007-10-29 03:14]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]
S3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 09:06]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-05 08:00:00 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 11:14:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-09 11:16:22
ComboFix-quarantined-files.txt 2008-02-09 10:16:21
ComboFix2.txt 2008-02-08 23:36:18
.
2008-02-07 19:01:57 --- E O F ---



log z hijackthis:


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:18:47, on 9.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
c:\Programy\Hijackthis\HiJackThis_v2.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVRT] C:\Program Files\NVRefreshTool\nvrt.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechno FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)

--
End of file - 5348 bytes

bůh žehnej combofixu

co problém?

Uvidime jestli problem trva, tedka jsem si myslel, ze trva, ale to se mi jenom vypla hra. Ja kdyztak jeste napisu, zatim predem dekuji!

neměl by to dělat.zip a jeho rychlá rota,CDCD,CDMon,VolumeService jsou mrtvy!
takže,předem nemáš zač

Tak diky moc, opravdu tedka to uz nic nedela :) Jsi trida! :)

jj,první pomocná,sme řikali jako děti
není zač a dík za chválu