PC-HELP.CZ

Ahoj, posílám Ti logy od dalšího kamaráda, zkus na to kouknout. Díky moc.

Výpis s HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:00:24, on 14.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\rmctrl.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\ICQLite\ICQLite.exe
D:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Winamp Remote\bin\OrbTray.exe
D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Program Files\Winamp Remote\bin\Orb.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Totalcmd\TOTALCMD.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - D:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - D:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] D:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] "D:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "D:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Orb] "D:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [NBJ] "D:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~2\ICQ6\ICQ.exe" silent
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Reboot.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Winamp Toolbar Search - D:\Documents and Settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6688 bytes


Výpis z ComboFix:
ComboFix 08-06-12.2 - Admina 2008-06-14 20:08:00.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.123 [GMT 2:00]
Running from: D:\Documents and Settings\Admina\Plocha\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 )))))))))))))))))))))))))))))))
.

2008-06-14 20:00 . 2008-06-14 20:00 <DIR> d-------- D:\Program Files\Trend Micro
2008-06-14 19:05 . 2008-06-14 19:05 <DIR> d-------- D:\WINDOWS\LastGood
2008-06-14 19:04 . 2008-06-14 19:04 <DIR> d-------- D:\Program Files\ESET
2008-06-14 19:04 . 2008-06-14 19:04 <DIR> d-------- D:\Documents and Settings\All Users\Data aplikací\ESET
2008-06-14 11:16 . 2004-01-05 14:04 565,248 -ra------ D:\WINDOWS\system32\hpotscl.dll
2008-06-14 11:16 . 2004-01-05 14:04 90,112 -ra------ D:\WINDOWS\system32\hpovst08.dll
2008-06-14 10:48 . 2004-01-05 14:04 38,871 --------- D:\WINDOWS\hpomdl03.dat
2008-06-14 10:48 . 2008-06-14 11:02 29,553 --------- D:\WINDOWS\hpoins03.dat
2008-06-11 20:17 . 2008-06-11 20:17 <DIR> d----c--- D:\Temp
2008-06-09 16:48 . 2008-06-14 10:15 <DIR> d-------- D:\Program Files\ICQLite
2008-06-08 19:28 . 2008-06-14 12:48 <DIR> d-------- D:\Program Files\ICQToolbar
2008-06-08 19:26 . 2008-06-09 16:30 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\ICQ
2008-06-05 13:13 . 2008-06-05 13:13 54,156 --ah----- D:\WINDOWS\QTFont.qfn
2008-06-05 13:13 . 2008-06-05 13:13 1,409 --a------ D:\WINDOWS\QTFont.for
2008-05-27 19:40 . 2008-06-14 18:46 <DIR> d-------- D:\Documents and Settings\All Users\Data aplikací\avg8
2008-05-27 19:40 . 2008-06-09 16:38 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\AVGTOOLBAR
2008-05-27 18:20 . 2008-05-27 18:20 <DIR> d-------- D:\Program Files\IMSI
2008-05-17 16:55 . 2008-05-17 16:55 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 08:18 --------- d-----w D:\Program Files\HP
2008-06-14 08:12 --------- d-----w D:\Program Files\Winamp Remote
2008-06-05 10:49 --------- d-----w D:\Documents and Settings\Admina\Data aplikací\Nokia Multimedia Player
2008-05-17 19:25 --------- d-----w D:\Documents and Settings\Admina\Data aplikací\Skype
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 22:06 1135968 --a------ D:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "D:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= D:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-17 17:49 15360]
"Orb"="D:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
"NBJ"="D:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00 1937408]
"ICQ"="C:\PROGRA~2\ICQ6\ICQ.exe" [ ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ Lite"="D:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 12:06 3144800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="D:\WINDOWS\system32\rmctrl.exe" [2000-10-16 10:37 32768]
"Cmaudio"="cmicnfg.cpl" []
"SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17 102400]
"DXDllRegExe"="dxdllreg.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"ICQ Lite"="D:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 12:06 3144800]
"HPDJ Taskbar Utility"="D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-01-05 14:04 176128]
"HP Component Manager"="D:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"egui"="D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 17:49 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

D:\Documents and Settings\Admina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Reboot.exe [2002-03-21 06:40:42 382464]

D:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.div4"= DivXc32f.dll
"vidc.div3"= DivXc32.dll
"vidc.xvid"= xvid.dll
"msacm.l3radius"= l3codecp.acm
"msacm.divxa"= divxa32.acm
"msacm.a3d"= a3d.dll
"msacm.ogg"= ogg.dll
"msacm.vorbis"= vorbis.dll
"msacm.vorbisenc"= vorbisenc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\WINDOWS\\system32\\mshta.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"D:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"D:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"D:\\Documents and Settings\\Admina\\Plocha\\Skype.exe"=
"D:\\Program Files\\ICQLite\\ICQLite.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9406:TCP"= 9406:TCP:BitComet 9406 TCP
"9406:UDP"= 9406:UDP:BitComet 9406 UDP

R1 epfwtdir;epfwtdir;D:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
R3 PSched;Plánovač paketů technologie QoS;D:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-04 01:04]
S3 imhidusb;Immersion's HID USB Driver;D:\WINDOWS\system32\DRIVERS\imhidusb.sys [2001-12-12 12:37]

*Newly Created Service* - CATCHME
*Newly Created Service* - EAMON
*Newly Created Service* - EASDRV
*Newly Created Service* - EKRN
*Newly Created Service* - EPFWTDIR
.
Contents of the 'Scheduled Tasks' folder
"2007-07-21 10:58:55 D:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-14 20:12:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: D:\WINDOWS\system32\winlogon.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll

PROCESS: D:\WINDOWS\system32\lsass.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll

PROCESS: D:\WINDOWS\explorer.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll
.
Completion time: 2008-06-14 20:14:35
ComboFix-quarantined-files.txt 2008-06-14 18:14:21

Adresářů: 7, Volných bajtů: 452,722,688
Adresářů: 9, Volných bajtů: 848,003,072

148
Výpis z Combofixu s tímto texťákem: CFScript.txt

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000

ComboFix 08-06-12.2 - Admina 2008-06-14 20:18:46.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.110 [GMT 2:00]
Running from: D:\Documents and Settings\Admina\Plocha\ComboFix.exe
Command switches used :: D:\Documents and Settings\Admina\Plocha\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 )))))))))))))))))))))))))))))))
.

2008-06-14 20:00 . 2008-06-14 20:00 <DIR> d-------- D:\Program Files\Trend Micro
2008-06-14 19:05 . 2008-06-14 19:05 <DIR> d-------- D:\WINDOWS\LastGood
2008-06-14 19:04 . 2008-06-14 19:04 <DIR> d-------- D:\Program Files\ESET
2008-06-14 19:04 . 2008-06-14 19:04 <DIR> d-------- D:\Documents and Settings\All Users\Data aplikací\ESET
2008-06-14 11:16 . 2004-01-05 14:04 565,248 -ra------ D:\WINDOWS\system32\hpotscl.dll
2008-06-14 11:16 . 2004-01-05 14:04 90,112 -ra------ D:\WINDOWS\system32\hpovst08.dll
2008-06-14 10:48 . 2004-01-05 14:04 38,871 --------- D:\WINDOWS\hpomdl03.dat
2008-06-14 10:48 . 2008-06-14 11:02 29,553 --------- D:\WINDOWS\hpoins03.dat
2008-06-11 20:17 . 2008-06-11 20:17 <DIR> d----c--- D:\Temp
2008-06-09 16:48 . 2008-06-14 10:15 <DIR> d-------- D:\Program Files\ICQLite
2008-06-08 19:28 . 2008-06-14 12:48 <DIR> d-------- D:\Program Files\ICQToolbar
2008-06-08 19:26 . 2008-06-09 16:30 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\ICQ
2008-06-05 13:13 . 2008-06-05 13:13 54,156 --ah----- D:\WINDOWS\QTFont.qfn
2008-06-05 13:13 . 2008-06-05 13:13 1,409 --a------ D:\WINDOWS\QTFont.for
2008-05-27 19:40 . 2008-06-14 18:46 <DIR> d-------- D:\Documents and Settings\All Users\Data aplikací\avg8
2008-05-27 19:40 . 2008-06-09 16:38 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\AVGTOOLBAR
2008-05-27 18:20 . 2008-05-27 18:20 <DIR> d-------- D:\Program Files\IMSI
2008-05-17 16:55 . 2008-05-17 16:55 <DIR> d----c--- D:\Documents and Settings\Admina\Data aplikací\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 08:18 --------- d-----w D:\Program Files\HP
2008-06-14 08:12 --------- d-----w D:\Program Files\Winamp Remote
2008-06-05 10:49 --------- d-----w D:\Documents and Settings\Admina\Data aplikací\Nokia Multimedia Player
2008-05-17 19:25 --------- d-----w D:\Documents and Settings\Admina\Data aplikací\Skype
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 22:06 1135968 --a------ D:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "D:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= D:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-17 17:49 15360]
"Orb"="D:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
"NBJ"="D:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00 1937408]
"ICQ"="C:\PROGRA~2\ICQ6\ICQ.exe" [ ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ Lite"="D:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 12:06 3144800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="D:\WINDOWS\system32\rmctrl.exe" [2000-10-16 10:37 32768]
"Cmaudio"="cmicnfg.cpl" []
"SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17 102400]
"DXDllRegExe"="dxdllreg.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"ICQ Lite"="D:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 12:06 3144800]
"HPDJ Taskbar Utility"="D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-01-05 14:04 176128]
"HP Component Manager"="D:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"egui"="D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 17:49 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

D:\Documents and Settings\Admina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Reboot.exe [2002-03-21 06:40:42 382464]

D:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.div4"= DivXc32f.dll
"vidc.div3"= DivXc32.dll
"vidc.xvid"= xvid.dll
"msacm.l3radius"= l3codecp.acm
"msacm.divxa"= divxa32.acm
"msacm.a3d"= a3d.dll
"msacm.ogg"= ogg.dll
"msacm.vorbis"= vorbis.dll
"msacm.vorbisenc"= vorbisenc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\WINDOWS\\system32\\mshta.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"D:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"D:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"D:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"D:\\Documents and Settings\\Admina\\Plocha\\Skype.exe"=
"D:\\Program Files\\ICQLite\\ICQLite.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9406:TCP"= 9406:TCP:BitComet 9406 TCP
"9406:UDP"= 9406:UDP:BitComet 9406 UDP

R1 epfwtdir;epfwtdir;D:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
R3 PSched;Plánovač paketů technologie QoS;D:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-04 01:04]
S3 imhidusb;Immersion's HID USB Driver;D:\WINDOWS\system32\DRIVERS\imhidusb.sys [2001-12-12 12:37]

*Newly Created Service* - CATCHME
*Newly Created Service* - EAMON
*Newly Created Service* - EASDRV
*Newly Created Service* - EKRN
*Newly Created Service* - EPFWTDIR
.
Contents of the 'Scheduled Tasks' folder
"2007-07-21 10:58:55 D:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-14 20:22:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: D:\WINDOWS\system32\winlogon.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll

PROCESS: D:\WINDOWS\system32\lsass.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll

PROCESS: D:\WINDOWS\explorer.exe
-> D:\WINDOWS\system32\ogg.dll
-> D:\WINDOWS\system32\vorbis.dll
.
Completion time: 2008-06-14 20:24:06
ComboFix-quarantined-files.txt 2008-06-14 18:23:47
ComboFix2.txt 2008-06-14 18:14:36

Adresářů: 7, Volných bajtů: 962,863,104
Adresářů: 8, Volných bajtů: 958,181,376

147

Proč zrrvna pro fredika? Jinak on má nějaký vážný problám že je tu i combo?

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u a dej Ok.
- mezi comobofix a /u musí být mezera
- počkej až proběhne, bude tě o tom informovat.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O4 - Startup: Reboot.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)
po zaškrtnutí klikni na tlačítko Fix Checked

Můžeš ještě případně fixnout programy, které se spouští zároveň se startem Win. a nejsou nutné/potřeba:
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background => pokud nepoužívá Messenger od MS, případně ho rovnou odinstalovat

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Pro lepší zabezpečení bych ti doporučil doinstalovat firewall, můžeš si vybrat některý zde uvedený nebo některý jiný z odkazu: Přehled osobních firewallů
Firewally zdarma:
Comodo - kvalitní, pokročilý, s mnoha funkcemi, originálně v angličtině
Kerio - přehledný, větší možnosti nastavení, náročnější na systémové prostředky, v češtině
ZoneAlarm - jednoduchý, kompatibilní, nenáročný na systémové prostředky, málo možností nastavení, v angličtině + návod

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Doporučil bych ti aktualizovat Javu:
- Stáhni si poslední verzi Java Runtime Environment (JRE) 6 Update 6
- Posuň se dolů kde je napsáno Java Runtime Environment (JRE) 6 Update 6 a klikni na tlačítko Download
- Načte se ti nová stránka
- Pod nadpisem Select Platform and Language for your download:
* u položky Platform: vyber OS který používáš
* zatrhni možnost kde je napsáno: I agree to the Java SE Runtime Environment 6 License Agreement
* klikni na tlačítko Continue >>
- Načte se ti nová stránka
- Klikni na odkaz pro stažení pod položkou: Windows Offline Installation

a ulož si ho na disk

- Ukonči běžící programy které máš spuštěné, hlavě webový prohlížeč
- Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj všechny staré verze Javy
- Podívej se po položkách s názvem Java Runtime Environment (JRE or J2SE)
* příklady starých verzí v Přidat nebo odebrat programy:

J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 8
Java 2 Runtime Environment, SE v1.4.2

- Odinstaluj je přes tlačítko Změnit nebo odebrat nebo Odebrat
- Odinstaluj postupně po sobě případné všechny staré verze Javy
- Po skončení odinstalovaní restartuj Pc.
- Pak už jen spusť instalaci poslední verze ze souboru jre-6u6-windows-i586-p.exe, který sis stáhl na začátku.

Má nějaké problémy nebo jen prevence?

Čau, bylo to pro Tebe páč jsi mi minule dobře poradil.
Problémy snad nemá, našel jsem mu tam jen jednoho vira(jednalo se spíše o prevenci). V kombinaci Combofix a NOD32 se tento vir objevil.
P.S. Jaký je podle Tebe nejlepší antivir? Může to být NOD32??

Není dobré používat CF z vlastní iniciativy, měl by být použit je pod "dohledem" nebo vyžádání někoho zkušenějšího. Můžou vzniknout určité komplikace ...

Nedá se říct jednoznačně který antivir je nejlepší, jeden může být v něčem lepší v určité oblasti jiný zas v jiné. Klidně si tam může nechat ten Nod.