PC-HELP.CZ

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:07, on 3.2.2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\Programy\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Programy\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Programy\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Programy\Bluetooth Software\BTTray.exe
C:\Programy\Common\Bin\WinCinemaMgr.exe
C:\Programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Programy\BLUETO~1\BTSTAC~1.EXE
C:\Programy\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.garena.com/portal/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Cole2k Media Toolbar Helper - {08825191-C3C7-44e9-8CA6-07AB521FA8F2} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Cole2k Media Toolbar - {015407A9-D183-4379-8452-DFD7C2297902} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Programy\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programy\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: MotionSD STUDIO - SD Browser auto start -.lnk = C:\Programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programy\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} (ICQDevilImg Control) - http://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{59C95815-4682-43F5-924D-035E849F1004}: NameServer = 62.240.178.250,10.0.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programy\Bluetooth Software\bin\btwdins.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programy\Spyware Terminator\sp_rsser.exe

--
End of file - 8862 bytes

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Tak tady je našel 4: a ještě ps: stáhl jsem sunbelt kerio a ten stále hlásí : zablokován pokus o průnik - naručitel c: windows\system32\mdm.exe........

Malwarebytes' Anti-Malware 1.30
Verze databáze: 1356
Windows 5.1.2600 Service Pack 1

3.2.2009 19:02:05
mbam-log-2009-02-03 (19-01-58).txt

Typ skenu: Rychlý sken
Objektu skenováno: 43175
Uplynulý cas: 3 minute(s), 0 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 3
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft visual debuger (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft visual debuger (Backdoor.Bot) -> No action taken.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft visual debuger (Backdoor.Bot) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\WINDOWS\system32\mdm.exe (Backdoor.Bot) -> No action taken.

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log + nový log z HJT.

Tak tady je z malware,, ten po restartu a novém projetí nic nenašel...
Malwarebytes' Anti-Malware 1.30
Verze databáze: 1356
Windows 5.1.2600 Service Pack 1

4.2.2009 7:00:35
mbam-log-2009-02-04 (07-00-35).txt

Typ skenu: Rychlý sken
Objektu skenováno: 42844
Uplynulý cas: 2 minute(s), 31 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0

A TADY JE Z HIJATHISU - ASI PROBLÉMY TROJAN???
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:00, on 4.2.2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Programy\Bluetooth Software\BTTray.exe
C:\Programy\Common\Bin\WinCinemaMgr.exe
C:\Programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Programy\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programy\BLUETO~1\BTSTAC~1.EXE
C:\Programy\Mozilla Firefox\firefox.exe
C:\Programy\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.postarticles.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Cole2k Media Toolbar Helper - {08825191-C3C7-44e9-8CA6-07AB521FA8F2} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: Cole2k Media Toolbar - {015407A9-D183-4379-8452-DFD7C2297902} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft Visual Debuger] C:\WINDOWS\System32\mdm.exe
O4 - HKLM\..\Run: [Microsoft Msn Messenger] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA7963] command /c del "C:\WINDOWS\system32\msmsgs.exe_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8745] cmd /c del "C:\WINDOWS\system32\msmsgs.exe_old"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Microsoft Visual Debuger] C:\WINDOWS\System32\mdm.exe
O4 - HKCU\..\Run: [Microsoft Msn Messenger] C:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB4828] command /c del "C:\WINDOWS\system32\msmsgs.exe_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3379] cmd /c del "C:\WINDOWS\system32\msmsgs.exe_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programy\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: MotionSD STUDIO - SD Browser auto start -.lnk = C:\Programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programy\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} (ICQDevilImg Control) - http://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{59C95815-4682-43F5-924D-035E849F1004}: NameServer = 62.240.178.250,10.0.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programy\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe

--
End of file - 9131 bytes

Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Nejen..Pořiď si nějaký free antivir.
vypni rez. ochranu u SpyBota:
- spusť Spybot - Search & Destroy
- nahoře v menu zvol: Režim => Pro pokročilé
- objeví se ti varovné okno kde zvol Ano
- okno programu se ti přepne do pokročilého zobrazení a tam zvol: Nástroje => Rezidentní
- tam zruš zatržení pokud bude u položky: Rezidentní program "TeaTimer" (Ochrana ...)
- zavři program
Restartuj PC.
Po té si stáhni ResetTeaTimer.bat(viz. Poznámka)
a ulož si ho na disku.
- spusť ho a po vyzvání zmáčkni libovolnou klávesu
- po proběhnutí a výzvě opět zmáčkni libovolnou klávesu a program se zavře.
Poznámka:
- pokud používáš Operu, tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit cíl odkazu jako...
- pokud používáš Firefox tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit odkaz jako...

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Ahoj, ten resetteatimer - jen otevřít a uložit na plochu jako - resetteatimer.bat...? jo?

Ten si stáhni do dokumentů.Vše je tam popsáno.A stáhni si ten antivir , třeba Aviru.
Nezapomeň antivir před combofixem vypnout (rez, ochranu)..

ok (stahl jsem si awast),,,, tady je log:
ComboFix 09-02-02.04 - Duck 2009-02-04 8:14:39.8 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.1.1029.18.2047.1696 [GMT 1:00]
Spuštěný z: c:\documents and settings\Duck\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Možné infikované stránky -----

hxxp://megauplinkbindinstaller.com
hxxp://77.91.228.180
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-04 do 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-02-03 19:28 . 2009-02-03 19:28 <DIR> d-------- c:\program files\Java
2009-02-03 19:28 . 2009-02-03 19:28 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-30 12:11 . 2009-01-30 12:23 <DIR> d-------- c:\program files\VDOWNLOADER
2009-01-28 18:42 . 2009-01-28 18:42 <DIR> d-------- C:\ZAV_DOMA
2009-01-24 23:00 . 2009-02-02 23:39 <DIR> d-------- c:\program files\Metin2_TESTER
2009-01-06 05:09 . 2009-01-06 05:09 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-01-06 05:09 . 2009-01-06 05:09 <DIR> d-------- c:\program files\AvRack

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-03 18:28 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-03 17:27 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-26 01:50 --------- d-----w c:\program files\OpenOffice.org 2.4
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-05 22:42 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-22 10:27 --------- d-----w c:\program files\Panasonic
2008-12-22 10:21 --------- d-----w c:\documents and settings\All Users\Data aplikací\Panasonic
2008-12-22 10:12 --------- d-----w c:\program files\Common Files\Panasonic
2008-12-22 10:10 --------- d-----w c:\program files\Common Files\IviSDK
2008-12-22 10:10 --------- d-----w c:\program files\Common Files\CNC
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 18:06 --------- d-----w c:\program files\Hamachi
2008-12-20 18:05 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-12-06 18:32 --------- d-----w c:\program files\GameSpy Arcade
2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-21 15:28 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot@2008-09-25_20.17.28.06 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-20 18:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE
- 1999-01-11 09:40:58 306,688 ----a-w c:\windows\IsUninst.exe
+ 1998-10-29 14:45:06 306,688 ----a-w c:\windows\IsUninst.exe
+ 2008-06-21 03:54:54 65,576 ----a-w c:\windows\LastGood\System32\DRIVERS\SBFWIM.sys
- 2000-08-31 06:00:00 28,672 ----a-w c:\windows\Nircmd.exe
+ 2000-08-31 07:00:00 29,696 ----a-w c:\windows\Nircmd.exe
- 2000-08-31 06:00:00 161,792 ----a-w c:\windows\swreg.exe
+ 2000-08-31 07:00:00 161,792 ----a-w c:\windows\swreg.exe
+ 2006-12-28 20:18:00 122,512 ----a-w c:\windows\system32\bgsvcgen.exe
- 2008-07-11 04:28:12 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-03 19:32:22 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-07-11 04:28:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 19:32:22 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-09-25 18:11:58 258,048 ----a-w c:\windows\system32\config\systemprofile\ntuser.dat
+ 2009-02-04 07:13:35 258,048 ----a-w c:\windows\system32\config\systemprofile\ntuser.dat
+ 2006-02-20 18:17:00 33,408 ----a-w c:\windows\system32\drivers\cdrbsdrv.sys
+ 2008-10-22 15:10:22 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
+ 2008-10-22 15:10:38 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
+ 2000-10-26 09:53:40 36,864 ----a-w c:\windows\system32\DvRead.dll
+ 2000-10-26 09:51:34 36,864 ----a-w c:\windows\system32\DvWrite.dll
+ 2006-12-28 20:18:00 56,976 ----a-w c:\windows\system32\GenSvcInst.exe
- 2008-06-09 23:21:01 135,168 ----a-w c:\windows\system32\java.exe
+ 2009-02-03 18:28:19 144,792 ----a-w c:\windows\system32\java.exe
- 2008-06-09 23:21:04 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2009-02-03 18:28:19 144,792 ----a-w c:\windows\system32\javaw.exe
- 2008-06-10 00:32:34 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2009-02-03 18:28:19 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2006-10-06 13:45:30 77,824 ----a-w c:\windows\system32\PAvFilt.dll
+ 2004-06-17 20:29:46 253,952 ----a-w c:\windows\system32\PCodec.dll
+ 2003-05-14 09:45:12 65,536 ----a-w c:\windows\system32\PDvAvi2.dll
+ 2005-01-17 16:58:06 65,536 ----a-w c:\windows\system32\PDvAvi3.dll
+ 2000-11-21 13:53:08 215,552 ----a-w c:\windows\system32\pdvcodec.dll
- 2008-04-19 20:02:04 46,128 ----a-w c:\windows\system32\perfc005.dat
+ 2008-11-02 18:22:23 46,128 ----a-w c:\windows\system32\perfc005.dat
- 2008-04-19 20:02:04 40,108 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-02 18:22:23 40,108 ----a-w c:\windows\system32\perfc009.dat
- 2008-04-19 20:02:04 310,044 ----a-w c:\windows\system32\perfh005.dat
+ 2008-11-02 18:22:23 310,044 ----a-w c:\windows\system32\perfh005.dat
- 2008-04-19 20:02:04 311,912 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-02 18:22:23 311,912 ----a-w c:\windows\system32\perfh009.dat
- 2008-03-10 13:21:35 511,912 ----a-w c:\windows\system32\Restore\rstrlog.dat
+ 2009-01-14 01:22:06 72,848 ----a-w c:\windows\system32\Restore\rstrlog.dat
+ 2009-02-04 07:01:44 16,384 ----atw c:\windows\temp\Perflib_Perfdata_1e4.dat
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08825191-C3C7-44e9-8CA6-07AB521FA8F2}]
2007-08-08 16:14 495616 --a------ c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-09-20 13312]
"SpybotSD TeaTimer"="c:\programy\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="c:\windows\System32\sw20.exe" [2006-05-18 208896]
"SW24"="c:\windows\System32\sw24.exe" [2006-05-17 69632]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2005-03-02 278528]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 148888]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-20 13312]

c:\documents and settings\Duck\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-12-20 625952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\programy\Bluetooth Software\BTTray.exe [2005-10-09 610365]
InterVideo WinCinema Manager.lnk - c:\programy\Common\Bin\WinCinemaMgr.exe [2006-12-11 155648]
MotionSD STUDIO - SD Browser auto start -.lnk - c:\programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe [2008-12-22 66952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"VIDC.DVSD"= pdvcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2004-09-02 22:57 57344 c:\programy\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 03:10 409600 c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-08-29 66048]
S2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [2006-12-14 208851]
S2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [2006-12-14 10324]
S2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [2006-12-14 34789]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
S3 WFIOCTL;WFIOCTL;\??\c:\programy\WinFast\WFTVFM\WFIOCTL.SYS --> c:\programy\WinFast\WFTVFM\WFIOCTL.SYS [?]
.
Obsah adresáře 'Naplánované úlohy'

2008-11-03 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\programy\Spybot - Search & Destroy\SpybotSD.exe [2008-07-30 14:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.postarticles.net
uInternet Connection Wizard,ShellNext = iexplore
IE: &ICQ Toolbar Search - c:\programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Send to &Bluetooth Device... - c:\programy\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz.
Trusted Zone: mojebanka.cz\www
TCP: {59C95815-4682-43F5-924D-035E849F1004} = 62.240.178.250,10.0.0.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} - hxxp://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
FF - ProfilePath - c:\documents and settings\Duck\Data aplikací\Mozilla\Firefox\Profiles\k4owlely.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/?from=icqhp
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - plugin: c:\programy\DivX\DivX Web Player\npdivx32.dll

---- NASTAVENÍ FIREFOXU ----
c:\programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-04 08:15:46
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-861567501-764733703-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-861567501-764733703-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*'*x*%\OpenWithList]
@Class="Shell"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(856)
c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(912)
c:\windows\System32\dssenh.dll
.
Celkový čas: 2009-02-04 8:17:41
ComboFix-quarantined-files.txt 2009-02-04 07:17:19
ComboFix2.txt 2008-09-28 03:05:58
ComboFix3.txt 2008-09-27 16:56:07
ComboFix4.txt 2008-09-27 15:30:00
ComboFix5.txt 2009-02-04 07:13:09

Před spuštěním: 6 205 616 128
Po spuštění: 6,195,765,248

winxpsp1_cs_pro_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

260
PROJÍŽDÍM TO AWASTEM UŽ JSEM SNAD SMAZAL NĚJAKÉHO ČERVA A JEŠTĚ VIRA....DOSUD 20 KUSŮ

PO VYLUXOVÁNÍ AWASTEM JSEM UDĚLAL NOVÝ LOG Z COMBOFIXU :
ComboFix 09-02-02.04 - Duck 2009-02-04 9:06:44.9 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.1.1029.18.2047.1502 [GMT 1:00]
Spuštěný z: c:\documents and settings\Duck\Plocha\ComboFix.exe
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-01-04 do 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-02-03 19:28 . 2009-02-03 19:28 <DIR> d-------- c:\program files\Java
2009-02-03 19:28 . 2009-02-03 19:28 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-30 12:11 . 2009-01-30 12:23 <DIR> d-------- c:\program files\VDOWNLOADER
2009-01-28 18:42 . 2009-01-28 18:42 <DIR> d-------- C:\ZAV_DOMA
2009-01-24 23:00 . 2009-02-02 23:39 <DIR> d-------- c:\program files\Metin2_TESTER
2009-01-06 05:09 . 2009-01-06 05:09 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-01-06 05:09 . 2009-01-06 05:09 <DIR> d-------- c:\program files\AvRack

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-04 07:01 --------- d-----w c:\documents and settings\Duck\Data aplikací\Hamachi
2009-02-03 18:28 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-03 17:27 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-30 12:00 --------- d-----w c:\documents and settings\Duck\Data aplikací\gtk-2.0
2009-01-26 01:50 --------- d-----w c:\program files\OpenOffice.org 2.4
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 17:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\Skype
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-25 16:46 --------- d-----w c:\documents and settings\Duck\Data aplikací\skypePM
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-17 18:21 --------- d-----w c:\documents and settings\Duck\Data aplikací\Desktopicon
2009-01-05 22:42 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2009-01-05 22:10 --------- d-----w c:\documents and settings\Duck\Data aplikací\Zoner
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-28 18:36 --------- d-----w c:\documents and settings\Duck\Data aplikací\ICQ
2008-12-22 10:27 --------- d-----w c:\program files\Panasonic
2008-12-22 10:21 --------- d-----w c:\documents and settings\All Users\Data aplikací\Panasonic
2008-12-22 10:12 --------- d-----w c:\program files\Common Files\Panasonic
2008-12-22 10:10 --------- d-----w c:\program files\Common Files\IviSDK
2008-12-22 10:10 --------- d-----w c:\program files\Common Files\CNC
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-22 10:04 --------- d-----w c:\documents and settings\Duck\Data aplikací\InstallShield
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 23:14 --------- d-----w c:\documents and settings\Duck\Data aplikací\uTorrent
2008-12-20 18:06 --------- d-----w c:\program files\Hamachi
2008-12-20 18:05 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-12-06 18:32 --------- d-----w c:\program files\GameSpy Arcade
2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-21 15:28 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
2008-06-07 22:03 22,328 ----a-w c:\documents and settings\Duck\Data aplikací\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot_2009-02-04_ 8.16.09,70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-26 17:21:30 1,236,208 ----a-w c:\windows\system32\aswBoot.exe
+ 2008-11-26 17:15:10 97,480 ----a-w c:\windows\system32\AvastSS.scr
+ 2008-11-26 17:15:35 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
+ 2008-11-26 17:18:25 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
+ 2008-11-26 17:18:18 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
+ 2008-11-26 17:16:29 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
+ 2008-11-26 17:17:36 111,184 ----a-w c:\windows\system32\drivers\aswSP.sys
+ 2008-11-26 17:16:38 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08825191-C3C7-44e9-8CA6-07AB521FA8F2}]
2007-08-08 16:14 495616 --a------ c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-09-20 13312]
"SpybotSD TeaTimer"="c:\programy\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="c:\windows\System32\sw20.exe" [2006-05-18 208896]
"SW24"="c:\windows\System32\sw24.exe" [2006-05-17 69632]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2005-03-02 278528]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 148888]
"avast!"="c:\programy\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-20 13312]

c:\documents and settings\Duck\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-12-20 625952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\programy\Bluetooth Software\BTTray.exe [2005-10-09 610365]
InterVideo WinCinema Manager.lnk - c:\programy\Common\Bin\WinCinemaMgr.exe [2006-12-11 155648]
MotionSD STUDIO - SD Browser auto start -.lnk - c:\programy\Panasonic\MotionSD STUDIO\SD_Browser\AutoLauncher.exe [2008-12-22 66952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"VIDC.DVSD"= pdvcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /A:* /L:Czech /KBD:2

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2004-09-02 22:57 57344 c:\programy\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 03:10 409600 c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-08-29 66048]
S2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [2006-12-14 208851]
S2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [2006-12-14 10324]
S2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [2006-12-14 34789]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
S3 WFIOCTL;WFIOCTL;\??\c:\programy\WinFast\WFTVFM\WFIOCTL.SYS --> c:\programy\WinFast\WFTVFM\WFIOCTL.SYS [?]
.
Obsah adresáře 'Naplánované úlohy'

2008-11-03 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\programy\Spybot - Search & Destroy\SpybotSD.exe [2008-07-30 14:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.postarticles.net
uInternet Connection Wizard,ShellNext = iexplore
IE: &ICQ Toolbar Search - c:\programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Send to &Bluetooth Device... - c:\programy\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz.
Trusted Zone: mojebanka.cz\www
TCP: {59C95815-4682-43F5-924D-035E849F1004} = 62.240.178.250,10.0.0.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} - hxxp://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
FF - ProfilePath - c:\documents and settings\Duck\Data aplikací\Mozilla\Firefox\Profiles\k4owlely.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/?from=icqhp
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - plugin: c:\programy\DivX\DivX Web Player\npdivx32.dll

---- NASTAVENÍ FIREFOXU ----
c:\programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-04 09:08:02
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-861567501-764733703-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-861567501-764733703-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*'*x*%\OpenWithList]
@Class="Shell"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(856)
c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(912)
c:\windows\System32\dssenh.dll
.
Celkový čas: 2009-02-04 9:10:04
ComboFix-quarantined-files.txt 2009-02-04 08:09:41
ComboFix2.txt 2009-02-04 07:17:43
ComboFix3.txt 2008-09-28 03:05:58
ComboFix4.txt 2008-09-27 16:56:07
ComboFix5.txt 2009-02-04 08:06:25

Před spuštěním: 6 109 589 504
Po spuštění: 6,098,878,464

209

Toto otestuj na Virustotal
c:\program files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
Vlož sem odkaz výsledku.

Stáhni si : Dr. Web CureIt
http://www.studna.cz/go/download/fid/48 ... 8c7f27dce2
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit, smazat, přesunout nebo přejmenovat.

http://www.virustotal.com/cs/analisis/c ... d420be2d0b
Projetí doporučeným programem (expres proskenování) - výsledkem - negativní - bez virů..