Prosim o kontrolu logu Vyřešeno

[honza2]

Prosim o kontrolu logu Dekuji

Logfile of HijackThis v1.99.1
Scan saved at 7:59:08, on 9.4.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Genius\ioCentre\gTaskBar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Genius\ioCentre\gMouseTask.exe
C:\Genius\ioCentre\gKbdTask.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Genius\ioCentre\gAutoPan.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Genius\ioCentre\gAutoScroll.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Genius\ioCentre\gZoom.exe
C:\Genius\ioCentre\gMGlass.exe
C:\Genius\ioCentre\gIMMgm.exe
C:\Genius\ioCentre\gDeskMgm.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Genius\ioCentre\gTaskSwitch.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Documents and Settings\acer\Plocha\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60446
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60446
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Registration Brothers In Arms.LNK = E:\Support\Register\RegistrationReminder.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Eurotran XP - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra 'Tools' menuitem: Eurotran XP... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4232399500
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE12E702-33C1-4CFF-B108-AC772B33175C}: NameServer = 10.255.255.10,10.255.255.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer Media Server - Unknown owner - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe (file missing)
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

[Reklama]

[jaro3]

Odinstaluj: ICQToolBar

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[honza2]

Malwarebytes' Anti-Malware 1.36
Verze databáze: 1954
Windows 5.1.2600 Service Pack 3

9.4.2009 18:31:47
mbam-log-2009-04-09 (18-31-41).txt

Typ skenu: Rychlý sken
Objektu skenováno: 159046
Uplynulý cas: 32 minute(s), 24 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 29
Infikované hodnoty registru: 2
Infikované položky dat registru: 2
Infikované složky: 14
Infikované soubory: 22

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{831cbac0-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{831cbac3-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.

Infikované položky dat registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
C:\Documents and Settings\acer\Data aplikací\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.

Infikované soubory:
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\acer\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sfxzmtsmt.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\sfxzmtsmtspm.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtaim.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtforum.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtgtal.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmticq.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtsmt.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtsmtspm.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtwbmail.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtymsg.dll (Malware.Trace) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochranu u Avastu a štít u ST.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[honza2]

log z MbAM

Malwarebytes' Anti-Malware 1.36
Verze databáze: 1954
Windows 5.1.2600 Service Pack 3

9.4.2009 18:31:47
mbam-log-2009-04-09 (18-31-41).txt

Typ skenu: Rychlý sken
Objektu skenováno: 159046
Uplynulý cas: 32 minute(s), 24 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 29
Infikované hodnoty registru: 2
Infikované položky dat registru: 2
Infikované složky: 14
Infikované soubory: 22

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{831cbac0-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{831cbac3-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.

Infikované položky dat registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
C:\Documents and Settings\acer\Data aplikací\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free\Logs (Rogue.DriveCleaner) -> No action taken.

Infikované soubory:
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\acer\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Honza\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Petra\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\Peťka\Data aplikací\DriveCleaner Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\acer\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sfxzmtsmt.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\sfxzmtsmtspm.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtaim.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtforum.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtgtal.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmticq.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtsmt.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtsmtspm.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtwbmail.dll (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\pfxzmtymsg.dll (Malware.Trace) -> No action taken.

log z ComboFix

ComboFix 09-04-04.01 - acer 2009-04-10 21:27:55.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1023.502 [GMT 2:00]
Spuštěný z: c:\documents and settings\acer\Dokumenty\Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090410-0] *On-access scanning disabled* (Updated)
FW: Sunbelt Kerio Personal Firewall *enabled*
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\acer\err.log
c:\documents and settings\acer\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
c:\documents and settings\Honza\err.log
c:\documents and settings\Peťka\err.log
c:\documents and settings\Petra\err.log
c:\windows\system32\dumphive.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-03-10 do 2009-04-10 )))))))))))))))))))))))))))))))
.

2009-04-09 18:04 . 2009-04-09 18:04 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-04-09 09:30 . 2009-04-09 09:30 <DIR> d--hs---- c:\documents and settings\Peťka\IETldCache
2009-04-09 09:30 . 2009-04-09 09:30 <DIR> d--hs---- c:\documents and settings\Peťka\IETldCache
2009-04-09 09:12 . 2009-04-09 09:12 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-04-09 09:12 . 2009-04-09 09:12 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-04-09 09:12 . 2009-04-09 09:12 <DIR> d-------- c:\documents and settings\acer\Data aplikací\Malwarebytes
2009-04-09 09:12 . 2009-04-06 15:32 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 09:12 . 2009-04-06 15:32 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-04-09 08:00 . 2009-04-09 08:00 <DIR> d--hs---- c:\documents and settings\acer\PrivacIE
2009-04-09 07:55 . 2009-04-09 07:55 <DIR> d--hs---- c:\documents and settings\acer\IETldCache
2009-04-08 14:35 . 2009-04-08 14:35 <DIR> d-------- c:\windows\ie8updates
2009-04-08 14:30 . 2009-04-08 14:34 <DIR> d--h-c--- c:\windows\ie8
2009-04-08 14:28 . 2009-02-28 06:55 105,984 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-03-30 17:08 . 2009-03-30 17:08 <DIR> d-------- c:\program files\SuperDVD Video Editor
2009-03-29 15:57 . 2009-01-09 21:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-03-28 21:59 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-28 21:52 . 2009-03-28 21:58 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-28 21:52 . 2009-03-28 21:52 <DIR> d-------- c:\program files\MSBuild
2009-03-28 21:51 . 2009-03-28 21:51 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-28 21:51 . 2008-07-06 14:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-28 21:51 . 2008-07-06 14:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-03-28 21:51 . 2008-07-06 12:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-28 21:51 . 2008-07-06 14:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-28 21:51 . 2008-07-06 14:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-28 21:51 . 2008-07-06 14:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-28 21:51 . 2008-07-06 14:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-28 21:50 . 2009-03-28 22:02 <DIR> d-------- c:\windows\SxsCaPendDel
2009-03-27 15:48 . 2009-03-27 15:48 <DIR> d-------- c:\program files\Gabest
2009-03-27 15:47 . 2009-03-27 15:47 <DIR> d-------- c:\program files\Xvid
2009-03-27 15:47 . 2009-04-05 17:28 <DIR> d-------- c:\program files\AVI ReComp
2009-03-27 15:47 . 2006-11-01 15:52 765,952 --a------ c:\windows\system32\xvidcore.dll
2009-03-27 15:47 . 2006-11-01 15:54 180,224 --a------ c:\windows\system32\xvidvfw.dll
2009-03-27 15:47 . 2006-11-01 16:26 77,824 --a------ c:\windows\system32\xvid.ax
2009-03-27 15:43 . 2009-03-27 15:44 <DIR> d-------- C:\MediaCell
2009-03-11 17:16 . 2009-03-11 17:16 <DIR> d-------- c:\windows\system32\AGEIA
2009-03-11 17:16 . 2009-03-11 17:17 <DIR> d-------- c:\program files\AGEIA Technologies

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-10 18:57 --------- d-----w c:\program files\Crawler
2009-04-09 17:55 --------- d-----w c:\documents and settings\Peťka\Data aplikací\OpenOffice.org2
2009-04-08 18:17 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-04-08 18:17 --------- d-----w c:\documents and settings\acer\Data aplikací\Spyware Terminator
2009-04-08 17:04 --------- d-----w c:\documents and settings\Honza\Data aplikací\Spyware Terminator
2009-04-08 12:34 --------- d-----w c:\program files\Warcraft III
2009-04-06 19:43 --------- d-----w c:\documents and settings\Petra\Data aplikací\OpenOffice.org2
2009-04-05 06:44 --------- d-----w c:\program files\Call of Duty
2009-04-02 18:56 --------- d-----w c:\program files\World of Warcraft
2009-03-30 17:41 44,800 -c--a-w c:\documents and settings\Peťka\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-29 16:40 --------- d-----w c:\program files\Spyware Terminator
2009-03-29 07:40 44,800 -c--a-w c:\documents and settings\acer\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-27 13:47 --------- d-----w c:\program files\AviSynth 2.5
2009-03-27 13:44 --------- d-----w c:\program files\MediaCell Video Converter
2009-03-15 09:42 9,947 -c--a-w c:\windows\system32\drivers\fwdrv.err
2009-03-15 09:02 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-15 09:02 --------- d-----w c:\program files\Ubisoft
2009-03-13 19:00 --------- d-----w c:\program files\ICQ6
2009-03-11 16:42 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-03-11 15:17 --------- d-----w c:\program files\Electronic Arts
2009-03-11 15:16 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-08 02:34 914,944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:33 18,944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:32 72,704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 45,568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:31 34,816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:22 156,160 ----a-w c:\windows\system32\msls31.dll
2009-02-27 11:37 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-22 20:27 --------- d-----w c:\program files\TorrentMan
2009-02-20 11:28 --------- d-----w c:\program files\ffdshow
2009-02-20 11:27 --------- d-----w c:\program files\VideoThangTM
2009-02-19 18:08 --------- d-----w c:\documents and settings\acer\Data aplikací\GetRightToGo
2009-02-16 18:20 --------- d-----w c:\documents and settings\Petra\Data aplikací\vlc
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-01-26 13:25 0 ----a-r C:\logwmemory.bin
2008-11-30 20:48 44,800 ----a-w c:\documents and settings\Petra\Data aplikací\GDIPFONTCACHEV1.DAT
2008-07-30 21:56 44,800 -c--a-w c:\documents and settings\Honza\Data aplikací\GDIPFONTCACHEV1.DAT
2007-12-25 20:14 9 -c--a-w c:\documents and settings\Peťka\Data aplikací\mdb.bin
2007-01-25 01:52 65,536 ----a-w c:\program files\Common Files\NMSAccessU.exe
2006-12-24 11:03 141,499 -c--a-w c:\program files\firefox-wallpaper-1024x768.zip
2006-12-24 10:51 912,859 -c--a-w c:\program files\Game.rar
2006-12-23 18:17 11,817,800 ----a-w c:\program files\GoogleEarth.exe
2006-10-11 08:04 61,036 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 48,742 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 29,313 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 41,082 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 166,510 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-11-08 12:47 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008110820081109\index.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-03-18 1883672]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2009-03-18 22:50 1883672 --a------ c:\program files\TorrentMan\tbTor0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-03-18 1883672]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7C5C0F58-E061-457D-9033-77307F5ED00C}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-03-18 1883672]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-11-29 57344]
"Google Update"="c:\documents and settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2008-11-07 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-12 86016]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-08-11 110592]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-07-26 143360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-11-29 40960]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-09-15 1783808]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-09 77824]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"ioCentre"="c:\genius\ioCentre\gTaskBar.exe" [2006-12-08 241664]
"nwiz"="nwiz.exe" [2006-07-12 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petra\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-12-02 393216]

c:\documents and settings\Peśka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-12-02 393216]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-12-01 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-06 111184]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2006-07-18 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2006-07-18 91672]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2007-01-25 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-06 20560]
R3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\drivers\gMouPS2.sys [2007-06-24 17408]
R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [2006-05-16 892032]
R3 psdfilter;psdfilter;c:\windows\system32\drivers\psdfilter.sys [2006-04-07 12288]
R3 psdvdisk;psdvdisk;c:\windows\system32\drivers\psdvdisk.sys [2006-03-08 60416]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys --> c:\windows\system32\DRIVERS\ElbyVCD.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4080011620-249624864-3224598444-1006.job
- c:\documents and settings\acer\Local Settings\Data aplikac []
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &ICQ Toolbar Search - c:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
TCP: {CE12E702-33C1-4CFF-B108-AC772B33175C} = 10.255.255.10,10.255.255.20
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\documents and settings\acer\Data aplikací\Mozilla\Firefox\Profiles\hd8qk2r4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.icq.com/start
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\documents and settings\acer\Data aplikací\Mozilla\Firefox\Profiles\hd8qk2r4.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - component: c:\program files\Crawler\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-10 21:38:27
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1B850185-1089-6DAB-342D-37F70EB006E2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbhgpphblkaidoohmlhihnjmcbelclbdloma"=hex:6a,61,61,6b,6e,6d,67,6e,69,65,68,66,
68,6c,62,66,6b,66,67,61,00,00
"abnfbaddcakdhpeocahdcgbcbbfmccckbg"=hex:6a,61,61,6b,6e,6d,67,6e,69,65,68,66,
68,6c,62,66,6b,66,67,61,00,00
"abdehpbonmbglkmhjemfgeejfljheacoeb"=hex:61,61,00,00
"macecadehfkkgmpbblkclghpjc"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{776858AF-F1D6-CCAD-1FDB-79166F2B658C}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbalonkhmcpehedebpplabhpemojahfahfim"=hex:6a,61,70,62,69,68,6c,69,6e,61,62,63,
68,6e,6d,6b,70,67,6f,69,00,fb
"abkliolbpgjhkhllimfmginhkjppbkaaji"=hex:6a,61,70,62,69,68,6c,69,6e,61,62,63,
68,6e,6d,6b,70,67,6f,69,00,fb
"abmloigopgoicpaoafpfgehjlnbkdokaln"=hex:61,61,00,00
"manlpeiolbhiejgfnniphooipk"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B52586DB-2AE9-1127-CA26-C4FF361EE116}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbboomcdkfpkefgbcnelceeechmhppbfkako"=hex:6a,61,67,66,65,66,6f,62,65,67,6d,69,
66,67,64,70,6c,67,6f,69,00,fb
"ablneohihladldhhejhfaoiiefcpbblmcj"=hex:6a,61,67,66,65,66,6f,62,65,67,6d,69,
66,67,64,70,6c,67,6f,69,00,fb
"iaboomcdkfpkefgbcn"=hex:61,61,00,00
"halneohihladldhh"=hex:61,61,00,00
"iafppfndhmgnpogami"=hex:61,61,00,00
.
Celkový čas: 2009-04-10 21:42:08
ComboFix-quarantined-files.txt 2009-04-10 19:42:02

Před spuštěním: Volných bajtů: 24 676 405 248
Po spuštění: Volných bajtů: 26,934,063,104

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
279 --- E O F --- 2009-04-09 19:28:44

[jaro3]

Dal si sem omylem znova stejný log z MbaM před výmazem , doufám , že si vše smazal , jak jsem psal výše.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Folder::
c:\windows\SxsCaPendDel

Registry::
[-HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
[-HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[honza2]

Vložil jsem to tam omylem ale vše jsem smazal.

ComboFix 09-04-13.A2 - acer 2009-04-13 18:25.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1023.629 [GMT 2:00]
Spuštěný z: c:\documents and settings\acer\Dokumenty\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\acer\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090413-0] *On-access scanning disabled* (Updated)
FW: Sunbelt Kerio Personal Firewall *enabled*
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SxsCaPendDel

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-03-13 do 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-09 16:04 . 2009-04-09 16:04 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-09 07:30 . 2009-04-09 07:30 -------- d-sh--w c:\documents and settings\Peťka\IETldCache
2009-04-09 07:30 . 2009-04-09 07:30 -------- d-sh--w c:\documents and settings\Peťka\IETldCache
2009-04-09 07:12 . 2009-04-09 07:12 -------- d-----w c:\documents and settings\acer\Data aplikací\Malwarebytes
2009-04-09 07:12 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-09 07:12 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 07:12 . 2009-04-09 07:12 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-04-09 07:12 . 2009-04-09 07:12 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-09 06:00 . 2009-04-09 06:00 -------- d-sh--w c:\documents and settings\acer\PrivacIE
2009-04-09 05:55 . 2009-04-09 05:55 -------- d-sh--w c:\documents and settings\acer\IETldCache
2009-04-08 12:35 . 2009-04-08 12:35 -------- d-----w c:\windows\ie8updates
2009-04-08 12:30 . 2009-04-08 12:34 -------- dc-h--w c:\windows\ie8
2009-04-08 12:28 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-03-30 15:08 . 2009-03-30 15:08 -------- d-----w c:\program files\SuperDVD Video Editor
2009-03-29 13:57 . 2009-01-09 19:19 1089883 -c----w c:\windows\system32\dllcache\ntprint.cat
2009-03-28 19:59 . 2006-06-29 12:07 14048 ------w c:\windows\system32\spmsg2.dll
2009-03-28 19:52 . 2009-03-28 19:58 -------- d-----w c:\windows\system32\XPSViewer
2009-03-28 19:52 . 2009-03-28 19:52 -------- d-----w c:\program files\MSBuild
2009-03-28 19:51 . 2009-03-28 19:51 -------- d-----w c:\program files\Reference Assemblies
2009-03-28 19:51 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-28 19:51 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-28 19:51 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-03-28 19:51 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-03-28 19:51 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-03-28 19:51 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-03-28 19:51 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-27 13:48 . 2009-03-27 13:48 -------- d-----w c:\program files\Gabest
2009-03-27 13:47 . 2009-03-27 13:47 -------- d-----w c:\program files\Xvid
2009-03-27 13:47 . 2006-11-01 14:26 77824 ----a-w c:\windows\system32\xvid.ax
2009-03-27 13:47 . 2006-11-01 13:54 180224 ----a-w c:\windows\system32\xvidvfw.dll
2009-03-27 13:47 . 2006-11-01 13:52 765952 ----a-w c:\windows\system32\xvidcore.dll
2009-03-27 13:47 . 2009-04-05 15:28 -------- d-----w c:\program files\AVI ReComp
2009-03-27 13:43 . 2009-03-27 13:44 -------- d-----w C:\MediaCell

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-10 19:44 . 2007-08-27 17:36 -------- d-----w c:\program files\Crawler
2009-04-09 17:55 . 2007-03-07 14:18 -------- d-----w c:\documents and settings\Peťka\Data aplikací\OpenOffice.org2
2009-04-08 18:17 . 2007-01-25 16:00 -------- d-----w c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-04-08 18:17 . 2008-03-09 06:47 -------- d-----w c:\documents and settings\acer\Data aplikací\Spyware Terminator
2009-04-08 17:04 . 2008-03-11 20:21 -------- d-----w c:\documents and settings\Honza\Data aplikací\Spyware Terminator
2009-04-08 12:34 . 2008-02-07 13:02 -------- d-----w c:\program files\Warcraft III
2009-04-08 12:33 . 2008-02-07 13:08 146608 -c--a-w c:\windows\War3Unin.dat
2009-04-06 19:43 . 2007-03-12 21:17 -------- d-----w c:\documents and settings\Petra\Data aplikací\OpenOffice.org2
2009-04-05 06:44 . 2008-03-15 16:40 -------- d-----w c:\program files\Call of Duty
2009-04-02 18:56 . 2008-12-06 13:23 -------- d-----w c:\program files\World of Warcraft
2009-03-30 17:41 . 2007-02-13 15:40 44800 -c--a-w c:\documents and settings\Peťka\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-29 19:25 . 2006-12-11 17:47 44800 -c--a-w c:\documents and settings\Petra\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-29 17:12 . 2006-12-10 07:54 44800 -c--a-w c:\documents and settings\Peťka\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-29 16:40 . 2006-12-25 17:20 44800 -c--a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-03-29 16:40 . 2007-01-25 16:00 -------- d-----w c:\program files\Spyware Terminator
2009-03-29 07:40 . 2007-01-06 10:28 44800 -c--a-w c:\documents and settings\acer\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-29 07:28 . 2006-08-17 19:05 439152 ----a-w c:\windows\system32\perfh005.dat
2009-03-29 07:28 . 2006-08-17 19:05 83388 ----a-w c:\windows\system32\perfc005.dat
2009-03-28 20:10 . 2006-12-01 07:45 44800 -c--a-w c:\documents and settings\acer\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-03-27 13:47 . 2009-02-20 11:27 -------- d-----w c:\program files\AviSynth 2.5
2009-03-27 13:44 . 2009-02-14 16:45 -------- d-----w c:\program files\MediaCell Video Converter
2009-03-15 09:42 . 2007-02-13 15:51 9947 -c--a-w c:\windows\system32\drivers\fwdrv.err
2009-03-15 09:02 . 2007-11-19 15:15 -------- d-----w c:\program files\Ubisoft
2009-03-15 09:02 . 2006-08-17 19:09 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-13 19:00 . 2008-07-09 18:44 -------- d-----w c:\program files\ICQ6
2009-03-11 16:42 . 2007-01-08 13:33 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-03-11 15:17 . 2007-01-22 14:31 -------- d-----w c:\program files\Electronic Arts
2009-03-11 15:17 . 2009-03-11 15:16 -------- d-----w c:\program files\AGEIA Technologies
2009-03-11 15:16 . 2007-06-26 17:38 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-08 02:34 . 2006-03-04 04:01 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-18 20:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-18 20:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-18 20:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-18 20:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-08-18 20:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-08-18 20:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-08-18 20:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-08-18 20:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2004-08-18 20:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-02-27 11:37 . 2008-09-12 15:55 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-22 20:27 . 2009-01-09 18:50 -------- d-----w c:\program files\TorrentMan
2009-02-20 11:28 . 2009-02-20 11:27 -------- d-----w c:\program files\ffdshow
2009-02-20 11:27 . 2009-02-20 11:27 -------- d-----w c:\program files\VideoThangTM
2009-02-19 18:08 . 2009-02-19 18:07 -------- d-----w c:\documents and settings\acer\Data aplikací\GetRightToGo
2009-02-16 18:20 . 2009-02-16 18:20 -------- d-----w c:\documents and settings\Petra\Data aplikací\vlc
2009-02-14 16:45 . 2009-02-14 16:45 56 ----a-w C:\ioAskNo.ini
2009-02-09 14:07 . 2005-10-06 03:10 1846784 ----a-w c:\windows\system32\win32k.sys
2009-01-26 13:25 . 2009-01-26 13:25 0 ----a-r C:\logwmemory.bin
2008-11-30 20:48 . 2008-11-30 20:48 44800 ----a-w c:\documents and settings\Petra\Data aplikací\GDIPFONTCACHEV1.DAT
2008-07-30 21:56 . 2007-06-03 20:11 44800 -c--a-w c:\documents and settings\Honza\Data aplikací\GDIPFONTCACHEV1.DAT
2007-12-25 20:14 . 2007-12-25 20:14 9 -c--a-w c:\documents and settings\Peťka\Data aplikací\mdb.bin
2007-01-25 01:52 . 2007-01-25 01:52 65536 ----a-w c:\program files\Common Files\NMSAccessU.exe
2006-12-25 17:20 . 2006-12-10 14:28 8224 -c--a-w c:\documents and settings\Honza\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2006-12-24 11:03 . 2006-12-24 11:03 141499 -c--a-w c:\program files\firefox-wallpaper-1024x768.zip
2006-12-24 10:51 . 2006-12-24 10:51 912859 -c--a-w c:\program files\Game.rar
2006-12-23 18:17 . 2006-12-23 18:17 11817800 ----a-w c:\program files\GoogleEarth.exe
2006-12-11 17:47 . 2006-12-11 17:46 125 ----a-w c:\documents and settings\Petra\Local Settings\Data aplikací\fusioncache.dat
2006-12-10 14:28 . 2006-12-10 14:28 125 ----a-w c:\documents and settings\Honza\Local Settings\Data aplikací\fusioncache.dat
2006-12-10 07:54 . 2006-12-10 07:54 125 ----a-w c:\documents and settings\Peťka\Local Settings\Data aplikací\fusioncache.dat
2006-12-01 07:42 . 2006-12-01 07:37 124 ----a-w c:\documents and settings\acer\Local Settings\Data aplikací\fusioncache.dat
2006-10-11 08:2006-12-24 11:06 04:58 . c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:2006-12-24 11:06 04:59 . c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:2006-12-24 11:06 05:03 . c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:2006-12-24 11:06 05:03 . c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:2006-12-24 11:06 04:58 . c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-11-29 57344]
"Google Update"="c:\documents and settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2008-11-07 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-12 86016]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-08-11 110592]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-07-26 143360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-11-29 40960]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-09-15 1783808]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-09 77824]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"ioCentre"="c:\genius\ioCentre\gTaskBar.exe" [2006-12-08 241664]
"nwiz"="nwiz.exe" [2006-07-12 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petra\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-12-02 393216]

c:\documents and settings\Peśka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-12-02 393216]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-12-01 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=

R0 ElbyVCD;ElbyVCD; [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
S1 aswSP;avast! Self Protection; [x]
S1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2006-07-18 284184]
S1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2006-07-18 91672]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-05-12 141312]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\DRIVERS\gMouPS2.sys [2006-07-12 17408]
S3 LVHybrid;LVHybrid service;c:\windows\system32\DRIVERS\LVHybrid.sys [2006-05-16 892032]
S3 psdfilter;psdfilter;c:\windows\system32\Drivers\psdfilter.sys [2006-04-07 12288]
S3 psdvdisk;psdvdisk;c:\windows\system32\Drivers\psdvdisk.sys [2006-03-08 60416]


--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - UBHELPER

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4080011620-249624864-3224598444-1006.job
- c:\documents and settings\acer\Local Settings\Data aplikac []
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
BHO-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
Toolbar-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
WebBrowser-{7C5C0F58-E061-457D-9033-77307F5ED00C} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &ICQ Toolbar Search - c:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
TCP: {CE12E702-33C1-4CFF-B108-AC772B33175C} = 10.255.255.10,10.255.255.20
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\documents and settings\acer\Data aplikací\Mozilla\Firefox\Profiles\hd8qk2r4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.icq.com/start
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\documents and settings\acer\Data aplikací\Mozilla\Firefox\Profiles\hd8qk2r4.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - component: c:\program files\Crawler\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 18:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1B850185-1089-6DAB-342D-37F70EB006E2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbhgpphblkaidoohmlhihnjmcbelclbdloma"=hex:6a,61,61,6b,6e,6d,67,6e,69,65,68,66,
68,6c,62,66,6b,66,67,61,00,00
"abnfbaddcakdhpeocahdcgbcbbfmccckbg"=hex:6a,61,61,6b,6e,6d,67,6e,69,65,68,66,
68,6c,62,66,6b,66,67,61,00,00
"abdehpbonmbglkmhjemfgeejfljheacoeb"=hex:61,61,00,00
"macecadehfkkgmpbblkclghpjc"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{776858AF-F1D6-CCAD-1FDB-79166F2B658C}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbalonkhmcpehedebpplabhpemojahfahfim"=hex:6a,61,70,62,69,68,6c,69,6e,61,62,63,
68,6e,6d,6b,70,67,6f,69,00,fb
"abkliolbpgjhkhllimfmginhkjppbkaaji"=hex:6a,61,70,62,69,68,6c,69,6e,61,62,63,
68,6e,6d,6b,70,67,6f,69,00,fb
"abmloigopgoicpaoafpfgehjlnbkdokaln"=hex:61,61,00,00
"manlpeiolbhiejgfnniphooipk"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-4080011620-249624864-3224598444-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B52586DB-2AE9-1127-CA26-C4FF361EE116}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"bbboomcdkfpkefgbcnelceeechmhppbfkako"=hex:6a,61,67,66,65,66,6f,62,65,67,6d,69,
66,67,64,70,6c,67,6f,69,00,fb
"ablneohihladldhhejhfaoiiefcpbblmcj"=hex:6a,61,67,66,65,66,6f,62,65,67,6d,69,
66,67,64,70,6c,67,6f,69,00,fb
"iaboomcdkfpkefgbcn"=hex:61,61,00,00
"halneohihladldhh"=hex:61,61,00,00
"iafppfndhmgnpogami"=hex:61,61,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(4016)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-04-13 18:34
ComboFix-quarantined-files.txt 2009-04-13 16:34
ComboFix2.txt 2009-04-10 19:42

Před spuštěním: Volných bajtů: 26 885 402 624
Po spuštění: Volných bajtů: 26,865,811,456

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
285 --- E O F --- 2009-04-10 19:58

A tady log z HJT

HJTLogfile of HijackThis v1.99.1
Scan saved at 18:40:25, on 13.4.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\acer\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\acer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Registration Brothers In Arms.LNK = E:\Support\Register\RegistrationReminder.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Eurotran XP - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra 'Tools' menuitem: Eurotran XP... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4232399500
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE12E702-33C1-4CFF-B108-AC772B33175C}: NameServer = 10.255.255.10,10.255.255.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer Media Server - Unknown owner - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe (file missing)
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

[jaro3]

Příště novější verzi HJT (2.02.):
http://www.trendsecure.com/portal/en-US ... s/download


Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O11 - Options group: [INTERNATIONAL] International


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Aktualizuj javu:
Java SE Runtime Environment 6u13
Vyber OS ( předpokládám Windows), dej zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u13-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Vše.

[honza2]

Dik moc , vse provedeno dle pokynu