prosim o kontrolu logu Vyřešeno

[skrat1]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:37:22, on 11.4.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: AVG8 Firewall (avgfws8) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgfws8.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 5913 bytes

[Reklama]

[jaro3]

Nemáš antivir , jen zbytky po AVG...

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)    
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[skrat1]

Malwarebytes' Anti-Malware 1.36
Verzia databázy: 1970
Windows 5.1.2600 Service Pack 2

12.4.2009 16:41:59
mbam-log-2009-04-12 (16-41-53).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 67923
Uplynutý cas: 1 minute(s), 31 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 1
Infikovaných registracných hodnôt: 1
Infikovaných registracných údajov položiek: 3
Infikovaných priecinkov: 1
Infikovaných súborov: 3

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
HKEY_LOCAL_MACHINE\SOFTWARE\rhc3fvj0eg63 (Rogue.AntivirusXP2008) -> No action taken.

Infikovaných registracných hodnôt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhc3fvj0eg63 (Rogue.AntivirusXP2008) -> No action taken.

Infikovaných registracných údajov položiek:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikovaných priecinkov:
C:\Program Files\RelevantKnowledge (Spyware.Marketscore) -> No action taken.

Infikovaných súborov:
C:\Program Files\RelevantKnowledge\rlls.dll (Spyware.Marketscore) -> No action taken.
C:\Program Files\RelevantKnowledge\rloci.bin (Spyware.Marketscore) -> No action taken.
C:\Program Files\RelevantKnowledge\rlservice.exe (Spyware.Marketscore) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Chybí Ti antivir, pak si něco pořiď...

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[skrat1]

ComboFix 09-04-13.01 - SKRAT 2009-04-12 19:39.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.2046.1556 [GMT 2:00]
Running from: c:\documents and settings\SKRAT\Desktop\ComboFix.exe
AV: AVG Anti-Virus plus Firewall *On-access scanning enabled* (Updated)
FW: AVG Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\documents and settings\SKRAT\Application Data\Malwarebytes
2009-04-12 14:37 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-12 14:37 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 22:09 . 2009-04-09 22:09 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-04-02 16:39 . 2009-04-02 20:02 66571 ----a-w c:\windows\War3Unin.dat
2009-04-02 16:39 . 2009-04-02 20:01 2829 ----a-w c:\windows\War3Unin.pif
2009-04-02 16:39 . 2009-04-02 20:01 139264 ----a-w c:\windows\War3Unin.exe
2009-04-01 14:33 . 2009-04-01 14:33 -------- d-----w c:\windows\Sun
2009-04-01 14:28 . 2009-04-01 14:28 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-01 14:28 . 2009-04-01 14:28 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-17 17:36 . 2009-03-17 17:36 -------- d-----w c:\documents and settings\SKRAT\Application Data\Samsung
2009-03-17 17:21 . 2006-05-03 21:53 174592 ----a-w c:\windows\system32\framedyn.dll
2009-03-17 17:20 . 2009-03-17 17:35 5632 ----a-w c:\windows\system32\drivers\StarOpen.sys
2009-03-17 17:17 . 2007-07-03 16:00 9256 ----a-w c:\windows\system32\drivers\sscdwhnt.sys
2009-03-17 17:17 . 2007-07-03 16:00 9256 ----a-w c:\windows\system32\drivers\sscdwh.sys
2009-03-17 17:17 . 2007-07-03 15:58 106792 ----a-w c:\windows\system32\drivers\sscdmdm.sys
2009-03-17 17:17 . 2007-07-03 15:57 11944 ----a-w c:\windows\system32\drivers\sscdmdfl.sys
2009-03-17 17:17 . 2007-07-03 15:56 9256 ----a-w c:\windows\system32\drivers\sscdcmnt.sys
2009-03-17 17:17 . 2007-07-03 15:56 9256 ----a-w c:\windows\system32\drivers\sscdcm.sys
2009-03-17 17:17 . 2007-07-03 15:54 80552 ----a-w c:\windows\system32\drivers\sscdbus.sys
2009-03-17 17:16 . 2009-03-17 17:20 -------- d-----w c:\windows\system32\Samsung_USB_Drivers
2009-03-17 17:16 . 2005-08-28 19:51 766 ----a-w c:\windows\system32\Uninstall.ico
2009-03-16 19:40 . 2009-03-16 19:40 49664 ----a-w c:\windows\system32\atimpc32.dll
2009-03-16 19:35 . 2009-03-16 19:35 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-03-16 19:34 . 2009-03-16 19:34 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-03-16 19:33 . 2009-03-16 19:33 3264512 ----a-w c:\windows\system32\aticaldd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 11:23 . 2008-08-09 13:04 -------- d-----w c:\documents and settings\SKRAT\Application Data\uTorrent
2009-04-09 22:06 . 2008-08-05 08:38 -------- d-----w c:\program files\ATI Technologies
2009-04-09 16:24 . 2008-09-18 17:27 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-04-01 14:28 . 2009-04-01 14:28 -------- d-----w c:\program files\Java
2009-03-29 19:05 . 2008-08-06 21:19 -------- d-----w c:\documents and settings\SKRAT\Application Data\XnView
2009-03-29 15:09 . 2009-03-08 14:40 -------- d-----w c:\documents and settings\SKRAT\Application Data\Zoner
2009-03-25 14:20 . 2009-02-21 17:53 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-03-25 14:20 . 2009-02-21 17:53 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-25 14:19 . 2009-02-21 17:53 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-17 19:05 . 2008-08-05 08:38 593920 ------w c:\windows\system32\ati2sgag.exe
2009-03-17 17:20 . 2008-08-05 08:38 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 17:16 . 2009-03-17 17:16 -------- d-----w c:\program files\Samsung
2009-03-16 21:33 . 2007-12-21 03:53 3597312 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-03-16 20:27 . 2008-08-05 08:38 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-03-16 20:26 . 2007-12-21 03:08 328704 ----a-w c:\windows\system32\ati2dvag.dll
2009-03-16 20:17 . 2008-08-05 08:38 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-03-16 20:17 . 2007-12-21 02:59 204800 ----a-w c:\windows\system32\atipdlxx.dll
2009-03-16 20:16 . 2007-12-21 02:59 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-03-16 20:16 . 2007-12-21 02:59 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-03-16 20:16 . 2007-12-21 02:59 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-03-16 20:16 . 2007-12-21 02:58 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-03-16 20:15 . 2007-12-21 02:57 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-03-16 20:13 . 2007-12-21 02:56 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-03-16 20:06 . 2007-12-21 02:47 3820736 ----a-w c:\windows\system32\ati3duag.dll
2009-03-16 20:04 . 2008-08-01 05:40 11563008 ----a-w c:\windows\system32\atioglxx.dll
2009-03-16 19:53 . 2007-12-21 02:36 2675328 ----a-w c:\windows\system32\ativvaxx.dll
2009-03-16 19:40 . 2007-12-21 02:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-03-16 19:36 . 2007-12-21 02:20 475136 ----a-w c:\windows\system32\atikvmag.dll
2009-03-16 19:35 . 2007-12-21 02:15 303104 ----a-w c:\windows\system32\atiok3x2.dll
2009-03-16 19:35 . 2008-08-01 03:40 131072 ----a-w c:\windows\system32\atiadlxx.dll
2009-03-16 19:34 . 2007-12-21 02:18 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-03-16 19:34 . 2007-12-21 02:17 53248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-03-16 19:28 . 2007-12-21 02:11 630784 ----a-w c:\windows\system32\ati2cqag.dll
2009-03-13 14:08 . 2008-08-05 09:19 -------- d-----w c:\program files\ICQ6
2009-03-08 14:40 . 2009-03-08 14:40 -------- d-----w c:\program files\Zoner
2009-03-07 15:31 . 2009-03-27 22:44 177822 ----a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-03-03 19:56 . 2009-03-03 19:56 118784 ----a-w c:\windows\system32\atibtmon.exe
2009-03-01 12:28 . 2009-03-01 12:28 -------- d-----w c:\documents and settings\SKRAT\Application Data\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\program files\Common Files\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\program files\ACD Systems
2009-03-01 09:41 . 2008-08-05 09:23 -------- d-----w c:\program files\XnView
2009-03-01 09:37 . 2009-03-01 09:29 -------- d-----w c:\program files\IrfanView
2009-02-28 20:18 . 2009-02-21 17:52 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-02-28 16:10 . 2008-08-05 09:19 -------- d-----w c:\documents and settings\SKRAT\Application Data\ICQ
2009-02-24 01:30 . 2009-02-24 01:30 -------- d-----w c:\program files\Longtion
2009-02-24 01:28 . 2009-02-24 01:28 -------- d-----w c:\program files\Beneton Software
2009-02-23 21:39 . 2008-08-05 08:38 184394 ----a-w c:\windows\system32\atiicdxx.dat
2009-02-22 10:28 . 2009-02-21 17:52 50968 ----a-w c:\windows\system32\avgfwdx.dll
2009-02-22 10:28 . 2009-02-21 17:52 29208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2009-02-22 10:28 . 2009-02-21 17:53 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-02-20 17:10 . 2009-02-20 17:08 -------- d-----w c:\documents and settings\SKRAT\Application Data\Mozilla(2)
2009-02-19 01:44 . 2009-02-19 01:44 -------- d-----w c:\documents and settings\SKRAT\Application Data\ZoomBrowser EX
2009-02-19 01:08 . 2009-02-18 20:37 -------- d-----w c:\program files\Canon
2009-02-19 01:08 . 2009-02-18 20:36 -------- d-----w c:\program files\Common Files\Canon
2009-02-19 00:58 . 2009-02-19 00:58 -------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-02-18 20:41 . 2009-02-18 20:41 -------- d-----w c:\documents and settings\SKRAT\Application Data\Canon
2009-02-18 17:55 . 2007-08-21 22:51 294912 ----a-w c:\windows\system32\ATIODE.exe
2009-02-16 21:41 . 2009-02-16 21:41 -------- d-----w c:\program files\Smoky City Design
2009-02-16 16:22 . 2009-02-03 21:37 -------- d-----w c:\program files\WebSite X5 Evolution
2009-02-03 20:52 . 2007-08-21 20:36 45056 ----a-w c:\windows\system32\ATIODCLI.exe
2009-01-06 02:16 . 2009-01-06 02:16 22328 ----a-w c:\documents and settings\SKRAT\Application Data\PnkBstrK.sys
2008-11-23 22:22 . 2008-11-23 22:21 706536 ----a-w c:\documents and settings\SKRAT\setup_Moj_CeWe_Fotosvet.exe
2009-04-12 11:53 . 2008-09-30 18:48 900 --sha-w c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2008-08-05 09:14 502272 6E8CA4FCB30282F216F5DB9DD58A5F81 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Diamondback"="c:\program files\Razer\Diamondback\razerhid.exe" [2007-02-14 147456]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-17 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-27 c:\windows\RTHDCPL.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 c:\windows\SoundMan.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-25 16:20 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"VIDC.ACDV"= ACDV.dll

[HKLM\~\startupfolder\C:^Documents and Settings^SKRAT^Start Menu^Programs^Startup^µTorrent.lnk]
path=c:\documents and settings\SKRAT\Start Menu\Programs\Startup\µTorrent.lnk
backup=c:\windows\pss\µTorrent.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
--a------ 2008-08-14 08:58 611712 c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-07-04 14:01 148776 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2006-03-20 18:34 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2006-03-20 18:34 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2006-03-20 18:34 86960 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-06-20 12:49 451872 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-04-01 16:28 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
--a------ 2008-06-19 16:42 2808832 c:\windows\alcwzrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 2004-08-04 04:56 110592 c:\windows\system32\bthprops.cpl

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"d:\\Hry\\Steam\\SteamApps\\inet07@post.sk\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\kav\\kav8.0\\english\\setup.exe"=
"d:\\Hry\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"d:\\Hry\\DiRT\\DiRT.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Hry\\Call of Duty - World at War\\CoDWaWmp.exe"=
"d:\\Hry\\Call of Duty - World at War\\CoDWaW.exe"=
"d:\\Hry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Hry\\GRID\\GRID.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 avg8emc;AVG8 E-mail Scanner; [x]
R2 avg8wd;AVG8 WatchDog; [x]
R2 avgfws8;AVG8 Firewall; [x]
R2 CX88XBAR;MSI 8606 Crossbar;c:\windows\system32\drivers\CX88XBar.SYS [2003-03-19 9159]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-02-22 29208]
R3 FlyPCI;FlyPCI;c:\windows\system32\drivers\FlyPCI.sys [2003-10-10 4134]
R3 MPCSYS;MPCSYS;c:\windows\system32\DRIVERS\mpcsys.sys [2008-12-24 15360]
R3 UltraMonMirror;UltraMonMirror; [x]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-02-22 12552]
S0 hotcore2;hotcore2;c:\windows\system32\drivers\hotcore2.sys [2006-11-13 30808]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-25 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-25 108552]
S2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\000.fcl [2007-11-03 01:12 41456]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-02-22 29208]
S3 PSched;QoS Packet Scheduler;c:\windows\system32\DRIVERS\psched.sys [2004-08-04 69120]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8ef0586-c821-11dd-aedc-000272c0fde0}]
\Shell\AutoRun\command - I:\wdsync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\SKRAT\Application Data\Mozilla\Firefox\Profiles\ifsgs90p.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 19:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1229272821-329068152-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b0,53,e5,36,5c,bc,7b,4f,b9,67,66,0a,3c,b5,6a,8b,c3,49,f5,eb,2f,1b,d5,
71,d5,e0,a0,47,17,48,0f,ca,4f,c5,bb,4b,de,c4,3b,cc,8a,e4,59,d2,4d,75,17,b7,\
"??"=hex:35,1e,48,09,3c,b0,d9,c1,14,69,29,9c,5e,35,08,7d

[HKEY_USERS\S-1-5-21-1229272821-329068152-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:6a,d7,44,34,77,2a,72,7d,b9,7e,70,24,cb,0d,2b,38,18,66,64,8e,9d,
fc,a9,cb,f5,44,55,68,e6,24,40,cc,3d,90,52,19,e2,c2,bb,72,d9,f1,2a,9b,68,20,\
"rkeysecu"=hex:6c,a5,58,5a,78,64,bb,90,f4,d5,fa,62,14,ee,7f,9c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2009-04-13 19:42
ComboFix-quarantined-files.txt 2009-04-13 17:42
ComboFix2.txt 2008-08-10 17:59

Pre-Run: 2 869 907 456 bytes free
Post-Run: 2,885,488,640 voľných bajtov

245


Malwarebytes' Anti-Malware 1.36
Verzia databázy: 1970
Windows 5.1.2600 Service Pack 2

12.4.2009 19:30:15
mbam-log-2009-04-12 (19-30-15).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 67930
Uplynutý cas: 38 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 1
Infikovaných registracných hodnôt: 1
Infikovaných registracných údajov položiek: 3
Infikovaných priecinkov: 1
Infikovaných súborov: 3

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
HKEY_LOCAL_MACHINE\SOFTWARE\rhc3fvj0eg63 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Infikovaných registracných hodnôt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhc3fvj0eg63 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Infikovaných registracných údajov položiek:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikovaných priecinkov:
C:\Program Files\RelevantKnowledge (Spyware.Marketscore) -> Quarantined and deleted successfully.

Infikovaných súborov:
C:\Program Files\RelevantKnowledge\rlls.dll (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rloci.bin (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlservice.exe (Spyware.Marketscore) -> Quarantined and deleted successfully.

[jaro3]

Tak , skoro čisto, ještě tam máš zbytek po Kaspersky..
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\KGyGaAvL.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\kav\\kav8.0\\english\\setup.exe"=-

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[skrat1]

ComboFix 09-04-13.03 - SKRAT 2009-04-13 20:26.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.2046.1607 [GMT 2:00]
Running from: c:\documents and settings\SKRAT\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\SKRAT\Desktop\CFScript.txt
AV: AVG Anti-Virus plus Firewall *On-access scanning enabled* (Updated)
FW: AVG Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\KGyGaAvL.sys

.
((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\documents and settings\SKRAT\Application Data\Malwarebytes
2009-04-12 14:37 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-12 14:37 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 22:09 . 2009-04-09 22:09 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-04-02 16:39 . 2009-04-02 20:02 66571 ----a-w c:\windows\War3Unin.dat
2009-04-02 16:39 . 2009-04-02 20:01 2829 ----a-w c:\windows\War3Unin.pif
2009-04-02 16:39 . 2009-04-02 20:01 139264 ----a-w c:\windows\War3Unin.exe
2009-04-01 14:33 . 2009-04-01 14:33 -------- d-----w c:\windows\Sun
2009-04-01 14:28 . 2009-04-01 14:28 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-01 14:28 . 2009-04-01 14:28 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-17 17:36 . 2009-03-17 17:36 -------- d-----w c:\documents and settings\SKRAT\Application Data\Samsung
2009-03-17 17:21 . 2006-05-03 21:53 174592 ----a-w c:\windows\system32\framedyn.dll
2009-03-17 17:20 . 2009-03-17 17:35 5632 ----a-w c:\windows\system32\drivers\StarOpen.sys
2009-03-17 17:17 . 2007-07-03 16:00 9256 ----a-w c:\windows\system32\drivers\sscdwhnt.sys
2009-03-17 17:17 . 2007-07-03 16:00 9256 ----a-w c:\windows\system32\drivers\sscdwh.sys
2009-03-17 17:17 . 2007-07-03 15:58 106792 ----a-w c:\windows\system32\drivers\sscdmdm.sys
2009-03-17 17:17 . 2007-07-03 15:57 11944 ----a-w c:\windows\system32\drivers\sscdmdfl.sys
2009-03-17 17:17 . 2007-07-03 15:56 9256 ----a-w c:\windows\system32\drivers\sscdcmnt.sys
2009-03-17 17:17 . 2007-07-03 15:56 9256 ----a-w c:\windows\system32\drivers\sscdcm.sys
2009-03-17 17:17 . 2007-07-03 15:54 80552 ----a-w c:\windows\system32\drivers\sscdbus.sys
2009-03-17 17:16 . 2009-03-17 17:20 -------- d-----w c:\windows\system32\Samsung_USB_Drivers
2009-03-17 17:16 . 2005-08-28 19:51 766 ----a-w c:\windows\system32\Uninstall.ico
2009-03-16 19:40 . 2009-03-16 19:40 49664 ----a-w c:\windows\system32\atimpc32.dll
2009-03-16 19:35 . 2009-03-16 19:35 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-03-16 19:34 . 2009-03-16 19:34 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-03-16 19:33 . 2009-03-16 19:33 3264512 ----a-w c:\windows\system32\aticaldd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 14:37 . 2009-04-12 14:37 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 11:23 . 2008-08-09 13:04 -------- d-----w c:\documents and settings\SKRAT\Application Data\uTorrent
2009-04-09 22:06 . 2008-08-05 08:38 -------- d-----w c:\program files\ATI Technologies
2009-04-09 16:24 . 2008-09-18 17:27 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-04-01 14:28 . 2009-04-01 14:28 -------- d-----w c:\program files\Java
2009-03-29 19:05 . 2008-08-06 21:19 -------- d-----w c:\documents and settings\SKRAT\Application Data\XnView
2009-03-29 15:09 . 2009-03-08 14:40 -------- d-----w c:\documents and settings\SKRAT\Application Data\Zoner
2009-03-25 14:20 . 2009-02-21 17:53 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-03-25 14:20 . 2009-02-21 17:53 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-25 14:19 . 2009-02-21 17:53 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-17 19:05 . 2008-08-05 08:38 593920 ------w c:\windows\system32\ati2sgag.exe
2009-03-17 17:20 . 2008-08-05 08:38 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 17:16 . 2009-03-17 17:16 -------- d-----w c:\program files\Samsung
2009-03-16 21:33 . 2007-12-21 03:53 3597312 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-03-16 20:27 . 2008-08-05 08:38 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-03-16 20:26 . 2007-12-21 03:08 328704 ----a-w c:\windows\system32\ati2dvag.dll
2009-03-16 20:17 . 2008-08-05 08:38 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-03-16 20:17 . 2007-12-21 02:59 204800 ----a-w c:\windows\system32\atipdlxx.dll
2009-03-16 20:16 . 2007-12-21 02:59 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-03-16 20:16 . 2007-12-21 02:59 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-03-16 20:16 . 2007-12-21 02:59 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-03-16 20:16 . 2007-12-21 02:58 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-03-16 20:15 . 2007-12-21 02:57 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-03-16 20:13 . 2007-12-21 02:56 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-03-16 20:06 . 2007-12-21 02:47 3820736 ----a-w c:\windows\system32\ati3duag.dll
2009-03-16 20:04 . 2008-08-01 05:40 11563008 ----a-w c:\windows\system32\atioglxx.dll
2009-03-16 19:53 . 2007-12-21 02:36 2675328 ----a-w c:\windows\system32\ativvaxx.dll
2009-03-16 19:40 . 2007-12-21 02:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-03-16 19:36 . 2007-12-21 02:20 475136 ----a-w c:\windows\system32\atikvmag.dll
2009-03-16 19:35 . 2007-12-21 02:15 303104 ----a-w c:\windows\system32\atiok3x2.dll
2009-03-16 19:35 . 2008-08-01 03:40 131072 ----a-w c:\windows\system32\atiadlxx.dll
2009-03-16 19:34 . 2007-12-21 02:18 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-03-16 19:34 . 2007-12-21 02:17 53248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-03-16 19:28 . 2007-12-21 02:11 630784 ----a-w c:\windows\system32\ati2cqag.dll
2009-03-13 14:08 . 2008-08-05 09:19 -------- d-----w c:\program files\ICQ6
2009-03-08 14:40 . 2009-03-08 14:40 -------- d-----w c:\program files\Zoner
2009-03-07 15:31 . 2009-03-27 22:44 177822 ----a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-03-03 19:56 . 2009-03-03 19:56 118784 ----a-w c:\windows\system32\atibtmon.exe
2009-03-01 12:28 . 2009-03-01 12:28 -------- d-----w c:\documents and settings\SKRAT\Application Data\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\program files\Common Files\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-03-01 12:26 . 2009-03-01 12:26 -------- d-----w c:\program files\ACD Systems
2009-03-01 09:41 . 2008-08-05 09:23 -------- d-----w c:\program files\XnView
2009-03-01 09:37 . 2009-03-01 09:29 -------- d-----w c:\program files\IrfanView
2009-02-28 20:18 . 2009-02-21 17:52 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-02-28 16:10 . 2008-08-05 09:19 -------- d-----w c:\documents and settings\SKRAT\Application Data\ICQ
2009-02-24 01:30 . 2009-02-24 01:30 -------- d-----w c:\program files\Longtion
2009-02-24 01:28 . 2009-02-24 01:28 -------- d-----w c:\program files\Beneton Software
2009-02-23 21:39 . 2008-08-05 08:38 184394 ----a-w c:\windows\system32\atiicdxx.dat
2009-02-22 10:28 . 2009-02-21 17:52 50968 ----a-w c:\windows\system32\avgfwdx.dll
2009-02-22 10:28 . 2009-02-21 17:52 29208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2009-02-22 10:28 . 2009-02-21 17:53 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-02-20 17:10 . 2009-02-20 17:08 -------- d-----w c:\documents and settings\SKRAT\Application Data\Mozilla(2)
2009-02-19 01:44 . 2009-02-19 01:44 -------- d-----w c:\documents and settings\SKRAT\Application Data\ZoomBrowser EX
2009-02-19 01:08 . 2009-02-18 20:37 -------- d-----w c:\program files\Canon
2009-02-19 01:08 . 2009-02-18 20:36 -------- d-----w c:\program files\Common Files\Canon
2009-02-19 00:58 . 2009-02-19 00:58 -------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-02-18 20:41 . 2009-02-18 20:41 -------- d-----w c:\documents and settings\SKRAT\Application Data\Canon
2009-02-18 17:55 . 2007-08-21 22:51 294912 ----a-w c:\windows\system32\ATIODE.exe
2009-02-16 21:41 . 2009-02-16 21:41 -------- d-----w c:\program files\Smoky City Design
2009-02-16 16:22 . 2009-02-03 21:37 -------- d-----w c:\program files\WebSite X5 Evolution
2009-02-03 20:52 . 2007-08-21 20:36 45056 ----a-w c:\windows\system32\ATIODCLI.exe
2009-01-06 02:16 . 2009-01-06 02:16 22328 ----a-w c:\documents and settings\SKRAT\Application Data\PnkBstrK.sys
2008-11-23 22:22 . 2008-11-23 22:21 706536 ----a-w c:\documents and settings\SKRAT\setup_Moj_CeWe_Fotosvet.exe
.

------- Sigcheck -------

[-] 2008-08-05 09:14 502272 6E8CA4FCB30282F216F5DB9DD58A5F81 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Diamondback"="c:\program files\Razer\Diamondback\razerhid.exe" [2007-02-14 147456]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-17 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-27 c:\windows\RTHDCPL.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 c:\windows\SoundMan.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-25 16:20 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"VIDC.ACDV"= ACDV.dll

[HKLM\~\startupfolder\C:^Documents and Settings^SKRAT^Start Menu^Programs^Startup^µTorrent.lnk]
path=c:\documents and settings\SKRAT\Start Menu\Programs\Startup\µTorrent.lnk
backup=c:\windows\pss\µTorrent.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
--a------ 2008-08-14 08:58 611712 c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-07-04 14:01 148776 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2006-03-20 18:34 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2006-03-20 18:34 213936 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2006-03-20 18:34 86960 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-06-20 12:49 451872 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-04-01 16:28 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
--a------ 2008-06-19 16:42 2808832 c:\windows\alcwzrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 2004-08-04 04:56 110592 c:\windows\system32\bthprops.cpl

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"d:\\Hry\\Steam\\SteamApps\\inet07@post.sk\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Hry\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"d:\\Hry\\DiRT\\DiRT.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Hry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Hry\\Call of Duty - World at War\\CoDWaWmp.exe"=
"d:\\Hry\\Call of Duty - World at War\\CoDWaW.exe"=
"d:\\Hry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Hry\\GRID\\GRID.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 avg8emc;AVG8 E-mail Scanner; [x]
R2 avg8wd;AVG8 WatchDog; [x]
R2 avgfws8;AVG8 Firewall; [x]
R2 CX88XBAR;MSI 8606 Crossbar;c:\windows\system32\drivers\CX88XBar.SYS [2003-03-19 9159]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-02-22 29208]
R3 FlyPCI;FlyPCI;c:\windows\system32\drivers\FlyPCI.sys [2003-10-10 4134]
R3 MPCSYS;MPCSYS;c:\windows\system32\DRIVERS\mpcsys.sys [2008-12-24 15360]
R3 UltraMonMirror;UltraMonMirror; [x]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-02-22 12552]
S0 hotcore2;hotcore2;c:\windows\system32\drivers\hotcore2.sys [2006-11-13 30808]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-25 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-25 108552]
S2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\000.fcl [2007-11-03 01:12 41456]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-02-22 29208]
S3 PSched;QoS Packet Scheduler;c:\windows\system32\DRIVERS\psched.sys [2004-08-04 69120]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8ef0586-c821-11dd-aedc-000272c0fde0}]
\Shell\AutoRun\command - I:\wdsync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\SKRAT\Application Data\Mozilla\Firefox\Profiles\ifsgs90p.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 20:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1229272821-329068152-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b0,53,e5,36,5c,bc,7b,4f,b9,67,66,0a,3c,b5,6a,8b,c3,49,f5,eb,2f,1b,d5,
71,d5,e0,a0,47,17,48,0f,ca,4f,c5,bb,4b,de,c4,3b,cc,8a,e4,59,d2,4d,75,17,b7,\
"??"=hex:35,1e,48,09,3c,b0,d9,c1,14,69,29,9c,5e,35,08,7d

[HKEY_USERS\S-1-5-21-1229272821-329068152-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:84,a9,e5,12,52,1f,ee,97,d7,19,d3,7f,64,84,e1,76,04,a6,43,bb,d9,
78,ea,33,68,be,68,b1,12,25,4e,36,39,d0,9f,f5,01,81,d4,69,6a,01,64,57,dc,1b,\
"rkeysecu"=hex:cb,e6,eb,4e,85,ad,f9,3f,9f,d6,5b,bb,7e,81,c7,74
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2009-04-13 20:29
ComboFix-quarantined-files.txt 2009-04-13 18:29
ComboFix2.txt 2009-04-13 17:42
ComboFix3.txt 2008-08-10 17:59

Pre-Run: 2 857 189 376 bytes free
Post-Run: 2,841,772,032 voľných bajtov

249
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:32:12, on 13.4.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: AVG8 Firewall (avgfws8) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgfws8.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 5333 bytes

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž a zapni si AVG.


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Pokud nejsou problémy je to vše.

[skrat1]

dakujem za pomoc. . .

[jaro3]

Nemáš zač, dej vyřešeno , fajfku.