PC-HELP.CZ

Ahoj, prosím o preventivní kontrolu logu (a nevím, jestli to s tím má něco společného, ale přestal mi fungovat internet. Dělal jsem to podle návodu, takže by to mělo být v pořádku . No a tady to je:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:54:20, on 27.6.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\mom.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\Star Downloader\SDIEInt.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9804718327
O17 - HKLM\System\CCS\Services\Tcpip\..\{53DA965E-CC3B-482A-8718-8E890DD88EAC}: NameServer = 93.99.40.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate1c9b8f938ee5722) (gupdate1c9b8f938ee5722) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe

--
End of file - 8702 bytes

Odinstaluj Search settings.

Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou zmáčknout
"Fix checked"):

R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\Star Downloader\SDIEInt.dll (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Nemohl jsem aktualizovat, protože mi nejde net (píšu z jiného pc)

Malwarebytes' Anti-Malware 1.26
Verze databáze: 1103
Windows 5.1.2600 Service Pack 3

27.6.2009 13:04:39
mbam-log-2009-06-27 (13-04-26).txt

Typ skenu: Rychlý sken
Objektu skenováno: 48996
Uplynulý cas: 3 minute(s), 12 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 1
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> No action taken.

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Malwarebytes' Anti-Malware 1.26
Verze databáze: 1103
Windows 5.1.2600 Service Pack 3

27.6.2009 13:17:55
mbam-log-2009-06-27 (13-17-55).txt

Typ skenu: Rychlý sken
Objektu skenováno: 49081
Uplynulý cas: 2 minute(s), 39 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 1
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

A ComboFix:

ComboFix 09-06-26.02 - Aleš 27.06.2009 13:24.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.600 [GMT 2:00]
Spuštěný z: c:\documents and settings\Aleš\Plocha\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-27 do 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-27 10:59 . 2008-09-01 22:16 38528 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-27 10:59 . 2008-09-01 22:16 17200 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-27 10:59 . 2009-06-27 10:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-27 09:54 . 2009-06-27 09:54 -------- d-----w- c:\program files\Trend Micro
2009-06-10 16:25 . 2009-06-10 16:25 -------- d-----w- c:\program files\WBGames
2009-06-10 16:22 . 2009-06-10 16:23 -------- d-----w- c:\program files\TmNationsForever
2009-06-06 09:15 . 2009-06-06 09:15 -------- d-----w- c:\program files\uTorrent
2009-06-05 18:31 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-06-05 18:31 . 2009-03-06 14:23 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-06-05 18:31 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe
2009-06-05 18:31 . 2009-02-09 10:56 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-06-05 18:31 . 2009-02-09 10:56 728064 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-06-05 18:31 . 2009-02-09 10:56 709632 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-06-05 18:31 . 2009-02-09 10:56 684032 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-06-05 18:31 . 2009-02-09 10:56 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-06-05 18:31 . 2009-02-09 10:56 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-06-05 18:28 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 05:22 . 2008-07-14 12:22 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-10 16:25 . 2008-04-30 19:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-10 15:37 . 2009-03-18 18:56 -------- d-----w- c:\program files\Free Video Converter
2009-06-09 16:22 . 2008-04-30 13:55 -------- d-----w- c:\program files\ATI Technologies
2009-06-06 10:02 . 2008-07-14 12:07 -------- d-----w- c:\program files\Electronic Arts
2009-06-06 07:02 . 2006-03-02 12:00 83936 ----a-w- c:\windows\system32\perfc005.dat
2009-06-06 07:02 . 2006-03-02 12:00 440772 ----a-w- c:\windows\system32\perfh005.dat
2009-06-05 18:40 . 2009-04-17 11:45 75096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-05 18:27 . 2008-12-29 16:51 -------- d-----w- c:\program files\Zaklínač
2009-06-05 13:13 . 2008-05-19 12:31 -------- d-----w- c:\program files\Rockstar Games
2009-06-05 12:58 . 2009-03-22 12:39 -------- d-----w- c:\program files\Netscape
2009-06-05 11:16 . 2009-02-16 17:21 -------- d-----w- c:\program files\AMD
2009-05-11 15:18 . 2009-01-24 05:54 -------- d-----w- c:\program files\Google
2009-05-02 07:54 . 2008-12-31 15:19 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-04-29 03:30 . 2008-03-29 06:21 3643904 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-04-29 02:18 . 2008-03-29 04:05 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-04-29 02:17 . 2008-03-29 04:04 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-04-29 02:07 . 2008-03-29 03:56 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-04-29 02:06 . 2008-03-29 03:56 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-04-29 02:06 . 2008-03-29 03:55 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-04-29 02:06 . 2008-03-29 03:55 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-04-29 02:06 . 2008-03-29 03:55 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-04-29 02:04 . 2008-03-29 03:54 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-04-29 02:03 . 2008-03-29 03:52 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-04-29 02:00 . 2008-03-29 03:39 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-04-29 01:56 . 2008-03-29 03:43 2997536 ----a-w- c:\windows\system32\ati3duag.dll
2009-04-29 01:45 . 2009-01-14 05:46 11603968 ----a-w- c:\windows\system32\atioglxx.dll
2009-04-29 01:42 . 2008-03-29 03:36 2687872 ----a-w- c:\windows\system32\ativvaxx.dll
2009-04-29 01:26 . 2009-03-16 19:40 49664 ----a-w- c:\windows\system32\atimpc32.dll
2009-04-29 01:26 . 2008-03-29 03:24 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-04-29 01:22 . 2008-03-29 03:21 479232 ----a-w- c:\windows\system32\atikvmag.dll
2009-04-29 01:20 . 2009-02-04 02:43 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-04-29 01:20 . 2009-02-04 02:42 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-04-29 01:20 . 2009-01-14 03:44 135168 ----a-w- c:\windows\system32\atiadlxx.dll
2009-04-29 01:19 . 2008-03-29 03:19 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-04-29 01:19 . 2008-03-29 03:18 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-04-29 01:18 . 2009-02-04 02:40 3280896 ----a-w- c:\windows\system32\aticaldd.dll
2009-04-29 01:17 . 2008-03-29 04:40 303104 ----a-w- c:\windows\system32\atiok3x2.dll
2009-04-29 01:13 . 2008-03-29 03:12 630784 ----a-w- c:\windows\system32\ati2cqag.dll
2009-04-28 19:05 . 2008-04-30 13:56 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-04-21 04:48 . 2009-04-21 04:48 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-04-01 19:59 . 2008-03-06 14:40 188348 ----a-w- c:\windows\system32\atiicdxx.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-28 198160]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Documents and Settings\\Aleš\\Plocha\\Hry\\Race Driver Grid\\GRID.exe"=
"c:\\Documents and Settings\\Aleš\\Plocha\\Hry\\qwake\\quake3.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009\\RpcAgentSrv.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\Bootstrapper.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\BattleForge.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\WBGames\\Monolith Productions\\F.E.A.R. 2 SP Demo\\FEAR2SPDemo.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5.3.2009 18:15 64160]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe [17.4.2009 13:45 68865]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [3.5.2008 10:30 36864]
S2 gupdate1c9b8f938ee5722;Služba Google Update (gupdate1c9b8f938ee5722);c:\program files\Google\Update\GoogleUpdate.exe [9.4.2009 11:54 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 951120]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [30.4.2008 15:53 26144]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\ALE~1\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\ALE~1\LOCALS~1\Temp\ALSysIO.sys [?]
S3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [6.2.2009 10:03 16269]
S3 MaplomL;MaplomL; [x]
S3 naecd;naecd;\??\c:\docume~1\ALE~1\LOCALS~1\Temp\naecd.sys --> c:\docume~1\ALE~1\LOCALS~1\Temp\naecd.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 19:31 42000]
S3 RTCore32;RTCore32;\??\c:\program files\RMClock\RTCore32.sys --> c:\program files\RMClock\RTCore32.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [4.4.2009 12:17 98488]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-04-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 16:14]

2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-06-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-09 09:52]

2009-06-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 09:54]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: Download with Star Downloader
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout Star Downloaderem
TCP: {53DA965E-CC3B-482A-8718-8E890DD88EAC} = 93.99.40.2
FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-27 13:27
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1275210071-688789844-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c9,20,d7,c2,95,68,63,cc,46,f5,5b,80,68,e6,27,ca,cf,52,ba,d5,5b,3e,6e,
b8,49,c3,b8,10,b7,24,bd,a3,e1,33,f2,6c,63,7e,64,3e,6b,d5,a1,35,ab,c9,bf,c0,\
"??"=hex:22,b9,02,2e,01,31,96,b8,d0,c0,3a,21,db,0e,3f,83

[HKEY_USERS\S-1-5-21-1275210071-688789844-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:9a,ac,1f,c4,f8,07,a2,89,69,c2,b0,ff,9f,4c,9d,e4,f0,01,91,4c,51,
5c,1d,31,cb,45,9f,1b,9c,ec,11,2b,55,35,b3,3d,f7,ea,96,d7,b1,13,ff,fc,f3,eb,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1052)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-06-27 13:28
ComboFix-quarantined-files.txt 2009-06-27 11:28

Před spuštěním: Volných bajtů: 86 904 082 432
Po spuštění: Volných bajtů: 87 433 113 600

198 --- E O F --- 2009-06-05 18:49

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\d3d9caps.dat
c:\docume~1\ALE~1\LOCALS~1\Temp\ALSysIO.sys
c:\docume~1\ALE~1\LOCALS~1\Temp\naecd.sys
c:\program files\RMClock\RTCore32.sys

Driver::
ALSysIO;ALSysIO
ALSysIO
MaplomL;MaplomL
MaplomL
naecd;naecd
naecd
RTCore32;RTCore32
RTCore32




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš zda se něco změnilo.

ComboFix:

ComboFix 09-06-26.02 - Aleš 27.06.2009 14:27.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.571 [GMT 2:00]
Spuštěný z: c:\documents and settings\Aleš\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Aleš\Plocha\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
"c:\docume~1\ALE~1\LOCALS~1\Temp\ALSysIO.sys"
"c:\docume~1\ALE~1\LOCALS~1\Temp\naecd.sys"
"c:\program files\RMClock\RTCore32.sys"
"c:\windows\system32\d3d9caps.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\d3d9caps.dat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ALSYSIO
-------\Legacy_NAECD
-------\Legacy_RTCORE32
-------\Service_ALSysIO
-------\Service_MaplomL
-------\Service_naecd
-------\Service_RTCore32


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-27 do 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-27 11:27 . 2009-06-27 11:27 -------- dc----w- c:\windows\system32\dllcache\cache
2009-06-27 10:59 . 2008-09-01 22:16 38528 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-27 10:59 . 2008-09-01 22:16 17200 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-27 10:59 . 2009-06-27 10:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-27 09:54 . 2009-06-27 09:54 -------- d-----w- c:\program files\Trend Micro
2009-06-10 16:25 . 2009-06-10 16:25 -------- d-----w- c:\program files\WBGames
2009-06-10 16:22 . 2009-06-10 16:23 -------- d-----w- c:\program files\TmNationsForever
2009-06-06 09:15 . 2009-06-06 09:15 -------- d-----w- c:\program files\uTorrent
2009-06-05 18:31 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-06-05 18:31 . 2009-03-06 14:23 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-06-05 18:31 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe
2009-06-05 18:31 . 2009-02-09 10:56 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-06-05 18:31 . 2009-02-09 10:56 728064 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-06-05 18:31 . 2009-02-09 10:56 709632 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-06-05 18:31 . 2009-02-09 10:56 684032 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-06-05 18:31 . 2009-02-09 10:56 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-06-05 18:31 . 2009-02-09 10:56 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-06-05 18:28 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 05:22 . 2008-07-14 12:22 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-10 16:25 . 2008-04-30 19:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-10 15:37 . 2009-03-18 18:56 -------- d-----w- c:\program files\Free Video Converter
2009-06-09 16:22 . 2008-04-30 13:55 -------- d-----w- c:\program files\ATI Technologies
2009-06-06 10:02 . 2008-07-14 12:07 -------- d-----w- c:\program files\Electronic Arts
2009-06-06 07:02 . 2006-03-02 12:00 83936 ----a-w- c:\windows\system32\perfc005.dat
2009-06-06 07:02 . 2006-03-02 12:00 440772 ----a-w- c:\windows\system32\perfh005.dat
2009-06-05 18:40 . 2009-04-17 11:45 75096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-05 18:27 . 2008-12-29 16:51 -------- d-----w- c:\program files\Zaklínač
2009-06-05 13:13 . 2008-05-19 12:31 -------- d-----w- c:\program files\Rockstar Games
2009-06-05 12:58 . 2009-03-22 12:39 -------- d-----w- c:\program files\Netscape
2009-06-05 11:16 . 2009-02-16 17:21 -------- d-----w- c:\program files\AMD
2009-05-11 15:18 . 2009-01-24 05:54 -------- d-----w- c:\program files\Google
2009-04-29 03:30 . 2008-03-29 06:21 3643904 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-04-29 02:18 . 2008-03-29 04:05 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-04-29 02:17 . 2008-03-29 04:04 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-04-29 02:07 . 2008-03-29 03:56 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-04-29 02:06 . 2008-03-29 03:56 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-04-29 02:06 . 2008-03-29 03:55 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-04-29 02:06 . 2008-03-29 03:55 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-04-29 02:06 . 2008-03-29 03:55 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-04-29 02:04 . 2008-03-29 03:54 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-04-29 02:03 . 2008-03-29 03:52 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-04-29 02:00 . 2008-03-29 03:39 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-04-29 01:56 . 2008-03-29 03:43 2997536 ----a-w- c:\windows\system32\ati3duag.dll
2009-04-29 01:45 . 2009-01-14 05:46 11603968 ----a-w- c:\windows\system32\atioglxx.dll
2009-04-29 01:42 . 2008-03-29 03:36 2687872 ----a-w- c:\windows\system32\ativvaxx.dll
2009-04-29 01:26 . 2009-03-16 19:40 49664 ----a-w- c:\windows\system32\atimpc32.dll
2009-04-29 01:26 . 2008-03-29 03:24 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-04-29 01:22 . 2008-03-29 03:21 479232 ----a-w- c:\windows\system32\atikvmag.dll
2009-04-29 01:20 . 2009-02-04 02:43 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-04-29 01:20 . 2009-02-04 02:42 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-04-29 01:20 . 2009-01-14 03:44 135168 ----a-w- c:\windows\system32\atiadlxx.dll
2009-04-29 01:19 . 2008-03-29 03:19 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-04-29 01:19 . 2008-03-29 03:18 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-04-29 01:18 . 2009-02-04 02:40 3280896 ----a-w- c:\windows\system32\aticaldd.dll
2009-04-29 01:17 . 2008-03-29 04:40 303104 ----a-w- c:\windows\system32\atiok3x2.dll
2009-04-29 01:13 . 2008-03-29 03:12 630784 ----a-w- c:\windows\system32\ati2cqag.dll
2009-04-28 19:05 . 2008-04-30 13:56 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-04-21 04:48 . 2009-04-21 04:48 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-04-01 19:59 . 2008-03-06 14:40 188348 ----a-w- c:\windows\system32\atiicdxx.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-06-27_11.27.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-27 12:31 . 2009-06-27 12:31 16384 c:\windows\Temp\Perflib_Perfdata_2c4.dat
+ 2009-06-27 11:27 . 2008-10-16 13:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-27 11:27 . 2008-04-14 07:52 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-27 11:27 . 2008-04-14 07:52 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-27 11:27 . 2008-04-14 07:52 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-27 11:27 . 2008-04-14 07:52 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-27 11:27 . 2008-04-14 07:51 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-27 11:27 . 2008-04-14 07:52 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-27 11:27 . 2008-04-14 06:59 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-27 11:27 . 2008-04-13 23:23 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-27 11:27 . 2008-04-14 07:52 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
- 2009-06-22 13:34 . 2007-11-30 12:39 26488 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\update\spcustom.dll
- 2009-06-22 13:34 . 2007-11-30 12:39 18296 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\spmsg.dll
+ 2009-06-27 11:27 . 2008-04-14 07:52 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-27 11:27 . 2009-03-08 03:34 914944 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-27 11:27 . 2008-04-14 07:52 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-27 11:27 . 2008-04-14 07:52 295936 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-27 11:27 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-27 11:27 . 2009-02-09 11:25 111104 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-27 11:27 . 2008-04-13 23:50 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-27 11:27 . 2009-03-21 14:09 988160 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-27 11:27 . 2008-04-14 07:51 110080 c:\windows\system32\dllcache\cache\imm32.dll
- 2009-06-22 13:34 . 2007-11-30 12:39 391032 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\update\updspapi.dll
- 2009-06-22 13:34 . 2007-11-30 12:39 759160 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\update\update.exe
- 2009-06-22 13:34 . 2007-11-30 12:39 233848 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\spuninst.exe
- 2009-06-22 13:34 . 2008-04-14 07:51 584704 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\backup\sp3qfe\rpcrt4.dll
- 2009-06-22 13:34 . 2008-04-14 07:51 584704 c:\windows\SoftwareDistribution\Download\8058ebceb452c83425841a510aaccdfb\backup\sp3gdr\rpcrt4.dll
+ 2009-06-27 11:27 . 2008-04-14 07:51 1571840 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-27 11:27 . 2009-02-09 11:26 2147328 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-27 11:27 . 2009-02-09 11:26 2025984 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-27 11:27 . 2008-04-14 07:52 1034240 c:\windows\system32\dllcache\cache\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-28 198160]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Documents and Settings\\Aleš\\Plocha\\Hry\\Race Driver Grid\\GRID.exe"=
"c:\\Documents and Settings\\Aleš\\Plocha\\Hry\\qwake\\quake3.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009\\RpcAgentSrv.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\Bootstrapper.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\BattleForge.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\WBGames\\Monolith Productions\\F.E.A.R. 2 SP Demo\\FEAR2SPDemo.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5.3.2009 18:15 64160]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe [17.4.2009 13:45 68865]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 951120]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [3.5.2008 10:30 36864]
S2 gupdate1c9b8f938ee5722;Služba Google Update (gupdate1c9b8f938ee5722);c:\program files\Google\Update\GoogleUpdate.exe [9.4.2009 11:54 133104]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [30.4.2008 15:53 26144]
S3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [6.2.2009 10:03 16269]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 19:31 42000]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [4.4.2009 12:17 98488]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-04-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 16:14]

2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-06-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-09 09:52]

2009-06-27 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 09:54]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: Download with Star Downloader
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout Star Downloaderem
TCP: {53DA965E-CC3B-482A-8718-8E890DD88EAC} = 93.99.40.2
FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-27 14:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1275210071-688789844-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c9,20,d7,c2,95,68,63,cc,46,f5,5b,80,68,e6,27,ca,cf,52,ba,d5,5b,3e,6e,
b8,49,c3,b8,10,b7,24,bd,a3,e1,33,f2,6c,63,7e,64,3e,6b,d5,a1,35,ab,c9,bf,c0,\
"??"=hex:22,b9,02,2e,01,31,96,b8,d0,c0,3a,21,db,0e,3f,83

[HKEY_USERS\S-1-5-21-1275210071-688789844-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:9a,ac,1f,c4,f8,07,a2,89,69,c2,b0,ff,9f,4c,9d,e4,f0,01,91,4c,51,
5c,1d,31,cb,45,9f,1b,9c,ec,11,2b,55,35,b3,3d,f7,ea,96,d7,b1,13,ff,fc,f3,eb,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1056)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2596)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Celkový čas: 2009-06-27 14:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-27 12:35
ComboFix2.txt 2009-06-27 11:28

Před spuštěním: Volných bajtů: 94 996 373 504
Po spuštění: Volných bajtů: 94 898 331 648

262 --- E O F --- 2009-06-05 18:49

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:06, on 27.6.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9804718327
O17 - HKLM\System\CCS\Services\Tcpip\..\{53DA965E-CC3B-482A-8718-8E890DD88EAC}: NameServer = 93.99.40.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate1c9b8f938ee5722) (gupdate1c9b8f938ee5722) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe

--
End of file - 7824 bytes

Systém rychleji bootoval a víc změn jsem zatím nezaznamenal. Co přibližně se mělo stát? Je to hotové, nebo mám ještě něco udělat?

No, trochu se to rozsvítilo . Ovladače k internetu máš jsou v pořádku, vir tam nemáš. Internet by ti měl jít.

Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž
a zapni si AVG.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Označ topic za vyřešený (zelená fajfka) a měj se.

Jo, moc dekuju za rady a snahu a taky se mej