prosím o kontrolu logu z combofix

[wichin]

ComboFix 09-04-25.A3 - Jaroslav 27.04.2009 14:38.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1414 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jaroslav\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated)
FW: Kerio Personal Firewall *disabled*
* Vytvořen nový Bod Obnovení
* Resident AV is active

.

((((((((((((((((((((((((( Soubory vytvořené od 2009-05-27 do 2009-4-27 )))))))))))))))))))))))))))))))
.

2009-04-26 12:25 . 1992-10-20 22:00 356992 ------w c:\windows\system\vbrun200.dll
2009-04-26 12:10 . 2009-04-26 12:10 -------- d-----w c:\program files\Switlle
2009-04-26 00:01 . 2009-04-26 15:18 -------- d-----w c:\program files\fishsim2
2009-04-25 21:27 . 2009-04-25 21:32 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\SolSuite
2009-04-25 21:27 . 2009-04-25 21:27 -------- d-----w c:\documents and settings\All Users\Data aplikací\TreeCardGames
2009-04-25 21:27 . 2009-04-25 21:31 -------- d-----w c:\program files\SolSuite
2009-04-25 20:25 . 2009-04-25 20:25 -------- d-----w c:\documents and settings\All Users\Data aplikací\Trymedia
2009-04-25 20:25 . 2009-04-25 20:25 -------- d-----w c:\program files\Euro Truck Simulator
2009-04-25 20:24 . 2009-04-26 14:53 -------- d-----w c:\program files\Euro Truck Simulator Gold
2009-04-22 15:27 . 2009-04-22 15:27 -------- d-----w c:\documents and settings\All Users\Data aplikací\MumboJumbo
2009-04-22 15:26 . 2009-04-22 15:26 -------- d-----w c:\program files\Games
2009-04-21 10:45 . 2006-11-10 13:05 18688 ----a-w c:\windows\system32\drivers\afc.sys
2009-04-21 10:45 . 2007-06-19 12:22 56064 ----a-w c:\windows\system32\ArcSoftKsUFilter.dll
2009-04-21 10:45 . 2007-05-30 17:15 13184 ----a-w c:\windows\system32\drivers\ArcSoftKsUFilter.sys
2009-04-21 10:44 . 2009-04-21 10:44 -------- d-----w c:\program files\Hama
2009-04-21 10:44 . 2006-03-30 14:53 212480 ----a-w c:\windows\system32\PCDLIB32.DLL
2009-04-21 10:44 . 2004-05-04 09:53 1645320 ----a-w c:\windows\system32\gdiplus.dll
2009-04-21 10:43 . 2009-04-21 11:07 2359320 ----a-w C:\img2-001.raw
2009-04-21 10:36 . 2007-07-11 14:09 20480 ----a-w c:\windows\FixCamera.exe
2009-04-21 10:36 . 2006-07-03 08:31 94208 ----a-w c:\windows\amcap.exe
2009-04-21 10:36 . 2007-05-10 11:18 835584 ----a-w c:\windows\vsnpstd3.exe
2009-04-21 10:36 . 2007-04-21 07:37 270336 ----a-w c:\windows\tsnpstd3.exe
2009-04-21 10:36 . 2004-02-27 15:36 15498 ----a-w c:\windows\snpstd3.ini
2009-04-21 10:36 . 2004-02-27 15:36 13023 ----a-w c:\windows\snpstd3.src
2009-04-21 10:36 . 2007-10-16 08:35 10376576 ----a-w c:\windows\system32\drivers\snpstd3.sys
2009-04-21 10:36 . 2009-04-21 10:36 -------- d-----w c:\program files\Common Files\snpstd3
2009-04-21 10:36 . 2007-07-23 16:04 155648 ----a-w c:\windows\system32\rsnpstd3.dll
2009-04-21 10:36 . 2007-07-23 15:52 57344 ----a-w c:\windows\system32\vsnpstd3.dll
2009-04-21 10:36 . 2005-11-23 11:55 53248 ----a-w c:\windows\system32\csnpstd3.dll
2009-04-21 10:36 . 2005-11-23 11:55 53248 ----a-w c:\windows\csnpstd3.dll
2009-04-21 10:17 . 2009-04-21 10:22 -------- d-----w c:\program files\TubeSucker
2009-04-20 19:00 . 2005-11-30 19:20 2314332 ----a-w c:\windows\system32\LIBMMD.DLL
2009-04-20 19:00 . 1998-06-23 20:00 609584 ----a-w c:\windows\system32\comctl32.ocx
2009-04-20 18:43 . 2009-04-20 21:40 -------- d-----w c:\program files\VirtualDJ
2009-04-20 18:41 . 2000-01-09 20:14 22891 ----a-w c:\windows\organ.HLP
2009-04-20 18:41 . 1999-04-23 20:22 27632 ----a-w c:\windows\system\CTL3Dv2.DLL
2009-04-20 18:41 . 1993-04-27 21:00 18688 ----a-w c:\windows\system\CMDIALOG.VBX
2009-04-20 18:12 . 2009-04-20 18:15 -------- d-----w c:\program files\Acoustica Beatcraft
2009-04-20 16:00 . 2009-04-20 16:00 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\Media Player Classic
2009-04-20 11:45 . 2009-04-20 11:45 -------- d-----w c:\program files\PowerQuest
2009-04-20 10:38 . 2009-04-20 12:46 -------- d-----r C:\zálohy
2009-04-19 10:38 . 2009-04-19 10:38 -------- d-----w C:\VundoFix Backups
2009-04-19 09:51 . 2009-04-19 16:45 -------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-04-19 09:51 . 2009-04-19 09:57 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-18 23:41 . 2009-04-18 23:41 25600 ----a-w c:\windows\system32\update14995750.exe
2009-04-18 22:30 . 2009-04-18 22:30 25088 ----a-w c:\windows\system32\update10697718.exe
2009-04-18 22:30 . 2009-04-18 22:30 5 ----a-w c:\windows\system32\_id.dat
2009-04-18 19:38 . 2004-09-23 16:57 430592 ----a-w c:\windows\system32\QuickTimeVR.qtx
2009-04-18 19:38 . 2004-09-23 16:57 6676480 ----a-w c:\windows\system32\QuickTime.qts
2009-04-18 19:34 . 2009-04-18 19:34 -------- d-----w c:\program files\Real Alternative
2009-04-18 19:34 . 2009-04-18 19:34 -------- d-----w c:\documents and settings\Jaroslav\Local Settings\Data aplikací\Real
2009-04-18 19:31 . 2009-03-30 18:01 50688 ----a-w c:\windows\system32\ff_acm.acm
2009-04-18 19:26 . 2009-04-18 19:38 -------- d-----w c:\windows\system32\QuickTime
2009-04-18 19:26 . 2004-09-23 16:57 70144 ----a-w c:\windows\system32\QuickTimeCheck.ocx
2009-04-18 19:26 . 2004-09-23 16:57 747008 ----a-w c:\windows\system32\Indeo4.qtx
2009-04-18 19:26 . 2004-09-23 16:57 323072 ----a-w c:\windows\system32\QuickTime.cpl
2009-04-18 19:26 . 2002-12-20 10:40 675328 ----a-w c:\windows\system32\ir50_32.qtx
2009-04-18 19:26 . 2004-10-27 11:01 360504 ----a-w c:\windows\system32\QTPlugin.ocx
2009-04-18 19:26 . 2004-01-12 15:57 86016 ----a-w c:\windows\system32\QuickTime.ax
2009-04-18 19:26 . 2009-04-18 19:38 -------- d-----w c:\program files\Media Player Classic
2009-04-18 19:26 . 2009-04-18 19:38 -------- d-----w c:\program files\QuickTime Alternative
2009-04-15 19:15 . 2009-04-15 19:15 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\AdobeUM
2009-04-15 19:10 . 2009-04-15 19:10 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-04-15 19:10 . 2009-04-15 19:10 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-04-15 19:10 . 2008-03-21 11:57 14640 ------w c:\windows\system32\spmsgXP_2k3.dll
2009-04-15 19:05 . 2009-04-15 19:05 24616 ----a-w c:\windows\system32\drivers\ggsemc.sys
2009-04-15 19:05 . 2009-04-15 19:05 13224 ----a-w c:\windows\system32\drivers\ggflt.sys
2009-04-15 19:05 . 2009-04-15 19:05 1107296 ----a-w c:\windows\system32\WdfCoInstaller01007.dll
2009-04-15 19:05 . 2009-04-15 19:05 -------- d-----w c:\program files\Sony Ericsson
2009-04-15 18:03 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-15 18:03 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-15 18:03 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 18:03 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 18:03 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 18:03 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 18:03 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 18:03 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 18:03 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 18:03 . 2009-03-27 06:53 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 18:03 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 15:39 . 2009-04-15 15:39 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\Any Video Converter
2009-04-15 15:39 . 2009-04-15 15:39 -------- d-----w c:\program files\Any Video Converter
2009-04-15 14:50 . 2009-04-15 14:50 0 ----a-w c:\windows\mpegableX4live.INI
2009-04-14 15:20 . 2009-04-14 15:20 -------- d-----w c:\documents and settings\Jaroslav\Local Settings\Data aplikací\Identities
2009-04-13 20:17 . 2009-04-13 20:17 -------- d-----w c:\windows\system32\Attansic
2009-04-13 20:17 . 2009-04-13 20:17 -------- d-----w c:\program files\Attansic
2009-04-13 20:16 . 2006-11-01 01:10 35840 ----a-w c:\windows\system32\drivers\atl01_xp.sys
2009-04-13 20:14 . 2008-12-04 07:31 53248 ----a-w c:\windows\system32\CSVer.dll
2009-04-11 23:32 . 2009-04-11 23:32 -------- d-----w c:\documents and settings\LocalService\Data aplikací\CyberLink
2009-04-11 23:24 . 2009-04-12 00:06 -------- d-----w c:\documents and settings\All Users\Data aplikací\SmartSound Software Inc
2009-04-11 23:24 . 2009-04-11 23:24 -------- d-----w c:\program files\SmartSound Software
2009-04-11 23:23 . 2009-04-18 19:21 -------- d-----w c:\program files\QuickTime
2009-04-11 22:51 . 2009-04-11 22:51 -------- d-----w c:\documents and settings\All Users\Data aplikací\MinigolfAdventures
2009-04-11 21:48 . 2009-04-11 22:10 -------- d-----w c:\documents and settings\All Users\CyberLink
2009-04-11 21:44 . 2009-04-11 21:44 -------- d-----w c:\documents and settings\All Users\Data aplikací\CyberLink
2009-04-11 21:44 . 2009-04-11 21:44 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\CyberLink
2009-04-11 21:38 . 2009-04-11 23:21 -------- d-----w c:\documents and settings\Jarda\Plocha
2009-04-11 21:38 . 2009-04-11 21:38 -------- d-----w c:\documents and settings\Jarda\Nabídka Start
2009-04-11 21:36 . 2009-04-11 23:26 -------- d-----w c:\program files\CyberLink
2009-04-11 21:28 . 2009-04-11 21:28 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\vlc
2009-04-11 21:20 . 2009-04-11 21:20 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\dvdcss
2009-04-11 21:19 . 2009-04-11 21:19 -------- d-----w c:\program files\VideoLAN
2009-04-11 21:11 . 2009-04-19 00:15 -------- d-----w c:\program files\Unlocker
2009-04-09 21:49 . 2009-04-09 21:49 -------- d-----w c:\documents and settings\All Users\Data aplikací\Electronic Arts
2009-04-09 21:48 . 2009-04-09 21:48 -------- d-----w c:\documents and settings\Jaroslav\Local Settings\Data aplikací\Criterion Games
2009-04-09 21:47 . 2009-04-09 21:47 1196 ----a-w c:\windows\system32\ealregsnapshot1.reg
2009-04-09 21:47 . 2009-04-09 21:47 -------- d-----w c:\documents and settings\Jaroslav\Local Settings\Data aplikací\Downloaded Installations
2009-04-08 20:15 . 2009-04-09 16:30 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\IObit
2009-04-08 20:15 . 2009-04-08 20:15 -------- d-----w c:\program files\IObit
2009-04-08 19:26 . 2009-04-08 19:26 30080 ----a-w c:\windows\system32\drivers\tifsfilt.sys
2009-04-08 19:26 . 2009-04-08 19:26 247008 ----a-w c:\windows\system32\drivers\timntr.sys
2009-04-08 14:28 . 2004-02-22 23:00 1386496 ----a-w c:\windows\system32\MSVBVM60.DLL
2009-04-07 18:51 . 2009-04-07 18:59 -------- d-----w c:\program files\Capture-A-ScreenShot
2009-04-06 18:34 . 2005-03-14 05:01 766 ------w c:\windows\Uninstall.ico
2009-04-06 18:34 . 2009-04-06 18:34 -------- d-----w c:\program files\Samsung ML-2010 Series
2009-04-06 18:34 . 2005-04-08 02:29 20622 ----a-w c:\windows\system32\SUGS2LMK.DLL
2009-04-06 18:34 . 2005-03-03 11:23 604 ----a-w c:\windows\system32\SUGS2LMK.SMT
2009-04-06 18:34 . 2005-03-03 04:32 151552 ----a-w c:\windows\system32\SSCoInst.exe
2009-04-06 18:34 . 2005-03-03 10:09 57344 ----a-w c:\windows\system32\SSCoInst.dll
2009-04-06 18:33 . 2009-04-06 18:34 -------- d-----w c:\windows\Samsung
2009-04-06 18:33 . 2005-07-08 20:54 11502 ------w c:\windows\system32\SP119.ICO
2009-04-06 18:33 . 2005-03-14 05:01 208896 ------w c:\windows\system32\SSRemove.exe
2009-04-06 18:33 . 2008-04-13 18:47 25856 -c--a-w c:\windows\system32\dllcache\usbprint.sys
2009-04-06 18:33 . 2008-04-13 18:47 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-04-06 18:32 . 2005-03-14 05:01 41984 ------w c:\windows\system32\drivers\DGIVECP.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 10:49 . 2009-04-02 15:09 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\ArcSoft
2009-04-21 10:45 . 2009-04-02 15:09 -------- d-----w c:\program files\Common Files\ArcSoft
2009-04-21 10:44 . 2009-03-31 22:38 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-20 11:47 . 2009-04-20 11:47 128 --sha-w c:\program files\desktop.ini
2009-04-19 00:29 . 2009-03-31 22:43 -------- d-----w c:\program files\Eset
2009-04-18 19:32 . 2009-03-31 23:34 -------- d-----w c:\program files\ffdshow
2009-04-18 17:07 . 2009-03-31 23:39 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\BSplayer PRO
2009-04-17 12:53 . 2001-10-25 12:00 68916 ----a-w c:\windows\system32\perfc005.dat
2009-04-17 12:53 . 2001-10-25 12:00 389938 ----a-w c:\windows\system32\perfh005.dat
2009-04-15 15:39 . 2009-03-31 23:09 23720 ----a-w c:\documents and settings\Jaroslav\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-04-09 22:08 . 2009-04-09 21:43 -------- d-----w c:\program files\Electronic Arts
2009-04-09 16:30 . 2009-04-01 00:01 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-08 19:29 . 2009-03-31 22:23 -------- d-----w c:\documents and settings\All Users\Data aplikací\Acronis
2009-04-08 19:26 . 2009-03-31 22:20 -------- d-----w c:\program files\Common Files\Acronis
2009-04-08 19:26 . 2009-03-31 22:20 -------- d-----w c:\program files\Acronis
2009-04-02 15:16 . 2009-04-02 15:09 -------- d-----w c:\program files\Common Files\Ulead Systems
2009-04-02 15:15 . 2009-04-02 15:08 -------- d-----w c:\program files\WinFast
2009-04-02 15:09 . 2009-04-02 15:09 -------- d-----w c:\documents and settings\All Users\Data aplikací\ArcSoft
2009-04-01 06:33 . 2009-03-31 23:57 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-01 01:30 . 2009-03-31 23:30 71918 ----a-w c:\windows\BricoPackUninst.cmd
2009-04-01 01:30 . 2002-09-20 16:04 219648 ----a-w c:\windows\system32\uxtheme.dll
2009-04-01 01:19 . 2009-03-31 22:15 86327 ----a-w c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-04-01 01:13 . 2002-08-28 23:05 250576 --sha-r C:\ntldr
2009-04-01 00:43 . 2009-04-01 00:42 -------- d-----w c:\program files\DAEMON Tools
2009-04-01 00:40 . 2009-04-01 00:40 685816 ----a-w c:\windows\system32\drivers\sptd.sys
2009-04-01 00:40 . 2009-04-01 00:40 2678 ----a-w c:\windows\java\Packages\Data\NPZ57VX3.DAT
2009-04-01 00:40 . 2009-04-01 00:40 2678 ----a-w c:\windows\java\Packages\Data\XV97BR5J.DAT
2009-04-01 00:40 . 2009-04-01 00:40 2678 ----a-w c:\windows\java\Packages\Data\VXZJNHZ3.DAT
2009-04-01 00:40 . 2009-04-01 00:40 2678 ----a-w c:\windows\java\Packages\Data\N5RFNP7L.DAT
2009-04-01 00:40 . 2009-04-01 00:40 2678 ----a-w c:\windows\java\Packages\Data\7TNLZ5JL.DAT
2009-04-01 00:39 . 2009-04-01 00:39 -------- d-----w c:\program files\Common Files\Adobe
2009-04-01 00:37 . 2009-03-31 23:16 -------- d-----w c:\program files\Opera
2009-04-01 00:32 . 2009-04-01 00:32 -------- d-----w c:\program files\LS
2009-04-01 00:18 . 2009-04-01 00:18 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\Lavasoft
2009-04-01 00:18 . 2009-04-01 00:18 -------- d-----w c:\program files\Lavasoft
2009-03-31 23:49 . 2009-03-31 23:49 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-31 23:44 . 2009-03-31 23:44 -------- d-----w c:\documents and settings\Jaroslav\Data aplikací\InterVideo
2009-03-31 23:43 . 2009-03-31 23:43 -------- d-----w c:\program files\InterVideo
2009-03-31 23:43 . 2009-03-31 22:38 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-31 23:38 . 2009-03-31 23:38 -------- d-----w c:\program files\Webteh
2009-03-31 23:34 . 2009-03-31 23:34 -------- d-----w c:\program files\CCleaner
2009-03-31 23:14 . 2009-03-31 23:14 -------- d-----w c:\program files\Kerio
2009-03-31 22:58 . 2009-03-31 22:58 -------- d-----w c:\documents and settings\All Users\Data aplikací\Office Genuine Advantage
2009-03-31 22:49 . 2009-03-31 22:49 -------- d-----w c:\program files\My Company Name
2009-03-31 22:43 . 2009-03-31 22:43 270336 ----a-w c:\windows\system32\imon.dll
2009-03-31 22:43 . 2009-03-31 22:43 502208 ----a-w c:\windows\system32\drivers\amon.sys
2009-03-31 22:38 . 2009-03-31 22:38 -------- d-----w c:\program files\Realtek
2009-03-31 22:38 . 2009-03-31 22:38 315392 ----a-w c:\windows\HideWin.exe
2009-03-31 22:33 . 2009-03-31 22:33 -------- d-----w c:\program files\Intel
2009-03-31 22:29 . 2009-03-31 22:23 1075712 ----a-w c:\windows\system32\AutoPartNt.exe
2009-03-31 22:20 . 2009-03-31 22:20 97248 ----a-w c:\windows\system32\drivers\snapman.sys
2009-03-31 22:16 . 2009-03-31 22:16 -------- d-----w c:\program files\microsoft frontpage
2009-03-31 22:15 . 2009-03-31 22:15 558142 ----a-w c:\windows\java\Packages\TVX73F7T.ZIP
2009-03-31 22:15 . 2009-03-31 22:15 155995 ----a-w c:\windows\java\Packages\H7DV3BTB.ZIP
2009-03-31 22:13 . 2009-03-31 22:13 21812 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-30 18:01 . 2009-03-31 23:34 84480 ----a-w c:\windows\system32\ff_vfw.dll
2009-03-06 14:23 . 2002-09-20 16:04 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:14 . 2002-09-20 16:05 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 17:13 . 2009-03-31 23:03 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-16 21:17 . 2009-03-31 22:47 453152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-02-09 14:07 . 2002-09-20 15:41 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2002-09-20 17:12 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2002-09-20 15:12 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2001-10-25 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2002-09-20 16:04 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2002-09-20 16:04 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2002-09-20 16:03 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:56 . 2002-09-20 16:03 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2001-10-25 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2002-09-20 16:04 56832 ----a-w c:\windows\system32\secur32.dll
2006-07-27 16:2009-03-31 23:53 26:10 . c:\program files\opera\program\plugins\spellcheck.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-08-16 167368]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-03-31 917504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2008-02-21 453936]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2004-03-12 159744]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-10-03 997042]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-04-10 16126464]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\documents and settings\Jaroslav\Plocha\ČISTÍME\EVEREST Ultimate Engineer Edition 4.50.1340\everestultimate_build_1340_gshd4fn0qsx\kerneld.wnt [2008-03-09 23152]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-15 13224]
S1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2004-11-02 262144]
S2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [2006-04-20 59776]
S2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [2006-04-20 19456]
S2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kxbar.sys [2006-04-20 9600]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2007-05-30 13184]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\atl01_xp.sys [2006-11-01 35840]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.SYS [2003-09-10 9510]

.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
mStart Page = hxxp://www.msn.com
LSP: imon.dll
TCP: {10FB5C9F-C1D4-4B2B-AA8B-640DAE9DFF94} = 192.168.2.133,217.197.152.135
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-27 14:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\documents and settings\Jaroslav\Plocha\ČISTÍME\EVEREST Ultimate Engineer Edition 4.50.1340\everestultimate_build_1340_gshd4fn0qsx\kerneld.wnt"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(1160)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(2824)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Kerio\Personal Firewall 4\kpf4ss.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\program files\Kerio\Personal Firewall 4\kpf4gui.exe
.
**************************************************************************
.
Celkový čas: 2009-04-27 14:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-04-27 12:43

Před spuštěním: Volných bajtů: 48 085 856 256
Po spuštění: Volných bajtů: 48 503 754 752

303 --- E O F --- 2009-04-16 17:57

[Reklama]

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\system32\update14995750.exe
c:\windows\system32\update10697718.exe
c:\windows\system32\_id.dat

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT