Prosim o kontrolu logu-problem s pc Vyřešeno

[aturk]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:44, on 11.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
E:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\Eset\nod32krn.exe
E:\WINDOWS\system32\PnkBstrA.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
E:\Program Files\Eset\nod32kui.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
E:\Program Files\Skype\Phone\Skype.exe
E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
E:\Program Files\RocketDock\RocketDock.exe
E:\Program Files\VisualTaskTips\VisualTaskTips.exe
E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Skype\Plugin Manager\skypePM.exe
E:\Program Files\Eset\nod32.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Documents and Settings\Ja\Plocha\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office 2007\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] E:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] E:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OEXPRESS] E:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EA Core] "E:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [Shockwave Updater] E:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; cs; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7" -"http://hry2.1001hry.cz/e2921b1388347a6f806af1ed7107f6a5/game.php?file=687474703a2f2f687279322e313030316872792e637a2f65323932316231333838333437613666383036616631656437313037663661352f313438352e646372&width=100%&height=100%&1001hry=1&cr=1&ovrprldr=1"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: rncsys32.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = E:\Program Files\Microsoft Office 2007\Office12\ONENOTEM.EXE
O4 - Global Startup: AVer HID Receiver.lnk = E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office 2007\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVerRemote - AVerMedia - E:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - E:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 11174 bytes
predem diky

[Reklama]

[Damned]

Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou, zmáčknout
"Fix checked"):

O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\RunOnce: [Shockwave Updater] E:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; cs; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7" -"http://hry2.1001hry.cz/e2921b1388347a6f806af1ed7107f6a5/game.php?file=68747470 3a2f2f687279322e313030316872792e637a2f653239323162313338383334376136663830366166 31656437313037663661352f313438352e646372&width=100%&height=100%&1001hry=1&cr=1&o vrprldr=1"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: rncsys32.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
*****************************************************************************************************************************************
Máš tam MbaM:
-Aktualizuj ho a spusť nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[aturk]

tak jsem udělal vše jak jsi napsal a vyšlo toto.Před tím mi to hlasilo naky trojsky kone a win defender hlasil PWS:win32/Daurso.A


Malwarebytes' Anti-Malware 1.38
Verze databáze: 2408
Windows 5.1.2600 Service Pack 3

11.7.2009 19:33:05
mbam-log-2009-07-11 (19-33-05).txt

Typ skenu: Rychlý sken
Objektu skenováno: 90523
Uplynulý cas: 2 minute(s), 59 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[Damned]

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[aturk]

ComboFix 09-07-09.08 - Ja 11.07.2009 20:04.1.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1382 [GMT 2:00]
Spuštěný z: e:\documents and settings\Ja\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\recycler\S-1-5-21-299502267-1965331169-725345543-1003
e:\windows\OPTIONS\CABS\_desktop.ini
e:\windows\system32\Cache

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-06-11 do 2009-07-11 )))))))))))))))))))))))))))))))
.

2009-07-11 13:19 . 2009-07-11 13:19 512096 ----a-w- e:\windows\system32\drivers\amon.sys
2009-07-11 13:19 . 2009-07-11 13:19 298104 ----a-w- e:\windows\system32\imon.dll
2009-07-11 13:19 . 2009-07-11 13:19 15424 ----a-w- e:\windows\system32\drivers\nod32drv.sys
2009-07-11 12:42 . 2009-07-11 12:42 -------- d-sh--w- e:\documents and settings\LocalService\IETldCache
2009-07-11 12:31 . 2009-06-17 09:27 38160 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 12:31 . 2009-07-11 12:31 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2009-07-11 12:31 . 2009-06-17 09:27 19096 ----a-w- e:\windows\system32\drivers\mbam.sys
2009-07-11 12:02 . 2009-07-11 12:19 -------- d-----w- e:\program files\Spybot - Search & Destroy
2009-06-22 15:04 . 2009-06-22 15:04 -------- d-----w- e:\program files\Atari

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-11 18:04 . 2008-10-24 22:06 -------- d-----w- e:\program files\Eset
2009-07-08 16:19 . 2001-10-25 11:00 99296 ----a-w- e:\windows\system32\perfc005.dat
2009-07-08 16:19 . 2001-10-25 11:00 484484 ----a-w- e:\windows\system32\perfh005.dat
2009-07-08 16:06 . 2008-10-25 08:58 -------- d--h--w- e:\program files\InstallShield Installation Information
2009-05-13 05:05 . 2007-12-27 10:39 915456 ----a-w- e:\windows\system32\wininet.dll
2009-05-07 15:33 . 2004-08-17 12:49 346624 ----a-w- e:\windows\system32\localspl.dll
2009-04-19 19:52 . 2004-08-17 12:44 1847168 ----a-w- e:\windows\system32\win32k.sys
2009-04-18 17:48 . 2009-04-18 17:48 410984 ----a-w- e:\windows\system32\deploytk.dll
2009-04-15 14:54 . 2004-08-17 12:49 585216 ----a-w- e:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OEXPRESS"="e:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-10-28 26624]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"EA Core"="e:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]
"DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"Skype"="e:\program files\Skype\Phone\Skype.exe" [2009-03-16 24095528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="e:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"GrooveMonitor"="e:\program files\Microsoft Office 2007\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"JMB36X IDE Setup"="e:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="e:\windows\system32\JMRaidSetup.exe" [2007-02-06 1953792]
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"StartCCC"="e:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"nod32kui"="e:\program files\Eset\nod32kui.exe" [2009-07-11 949376]
"RTHDCPL"="RTHDCPL.EXE" - e:\windows\RTHDCPL.EXE [2008-10-09 17021440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="e:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

e:\documents and settings\Ja\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - e:\program files\Microsoft Office 2007\Office12\ONENOTEM.EXE [2007-12-7 101440]

e:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
AVer HID Receiver.lnk - e:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2009-1-20 159744]
AVerQuick.lnk - e:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2009-1-20 663552]
RocketDock.lnk - e:\program files\RocketDock\RocketDock.exe [2008-10-25 495616]
VisualTaskTips.lnk - e:\program files\VisualTaskTips\VisualTaskTips.exe [2007-9-5 36352]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Hry\\Pro Evolution Soccer 2009\\pes2009.exe"=
"e:\\Hry\\Mass Effect\\Binaries\\MassEffect.exe"=
"e:\\Hry\\Mass Effect\\MassEffectLauncher.exe"=
"e:\\Hry\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"e:\\Hry\\FlatOut Ultimate Carnage\\Fouc.exe"=
"e:\\Hry\\Football Manager 2009\\fm.exe"=
"e:\\Program Files\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"e:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"e:\\Hry\\Pro Evolution Soccer 2009\\GCP2009.exe"=
"e:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"e:\\Hry\\Rise of the Argonauts\\Binaries\\RiseOfTheArgonauts.exe"=
"e:\\Hry\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"e:\\Hry\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"e:\\Hry\\Pro Cycling Manager 2008\\PCM.exe"=
"e:\\Hry\\Pro Cycling Manager 2008\\AutoRun\\Exe\\Autorun.exe"=
"e:\\Hry\\Prince of Persia\\Prince of Persia.exe"=
"e:\\Hry\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"e:\\Hry\\World of Warcraft\\Launcher.exe"=
"e:\\Hry\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"e:\\Hry\\EF2\\EF2.exe"=
"e:\\Hry\\Metin2_CZ\\metin2.bin"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10907:TCP"= 10907:TCP:BitComet 10907 TCP
"10907:UDP"= 10907:UDP:BitComet 10907 UDP

R1 nod32drv;nod32drv;e:\windows\system32\drivers\nod32drv.sys [11.7.2009 15:19 15424]
R2 acedrv11;acedrv11;e:\windows\system32\drivers\acedrv11.sys [30.7.2008 7:51 277736]
R2 AVerRemote;AVerRemote;e:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [20.1.2009 15:07 352256]
R2 AVerScheduleService;AVerScheduleService;e:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [20.1.2009 15:07 409600]
R2 WinDefend;Windows Defender;e:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 AVerAF15DMBTH;AVerMedia A850 USB;e:\windows\system32\drivers\AVerAF15DMBTH.sys [20.1.2009 15:08 293120]
R3 CAM1210;SM0121 USB 2.0 Video Camera;e:\windows\system32\drivers\cam1210.sys [24.7.2006 17:49 89856]
S1 srdd852;srdd852;e:\windows\system32\drivers\srdd852.sys --> e:\windows\system32\drivers\srdd852.sys [?]
S3 CrystalSysInfo;CrystalSysInfo;e:\program files\MediaCoder\SysInfo.sys [25.9.2007 16:59 15152]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - RSVP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"e:\windows\system32\rundll32.exe" "e:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-07-11 e:\windows\Tasks\MP Scheduled Scan.job
- e:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-07-11 e:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- e:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-07-11 13:31]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-WEBTRAN - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - e:\documents and settings\Ja\Data aplikací\Mozilla\Firefox\Profiles\ljfm9882.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Java Console: No Registry Reference - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

---- NASTAVENÍ FIREFOXU ----
e:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-11 20:09
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


e:\windows\TEMP\TMP000000A492D1FD46D22F4B63 524288 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-1757981266-725345543-1005\Software\SecuROM\License information*]
"datasecu"=hex:df,53,93,fa,a2,c4,29,0f,15,f4,78,37,87,bd,db,cc,3e,89,47,bf,a8,
d2,86,08,1d,0e,78,79,65,2e,90,cc,2d,ca,15,d8,78,24,27,2d,38,5c,08,06,16,2a,\
"rkeysecu"=hex:14,5a,a8,cf,d5,44,a2,f4,6b,ae,1a,a8,3c,bd,b3,d2
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(728)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(784)
e:\windows\system32\imon.dll
e:\program files\Eset\pr_imon.dll
.
Celkový čas: 2009-07-11 20:13
ComboFix-quarantined-files.txt 2009-07-11 18:12

Před spuštěním: 5 405 974 528
Po spuštění: 5 420 212 224

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
e:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

177 --- E O F --- 2009-07-11 11:01

[Damned]

Vypni ještě Rezidenta antiviru. Rezident antiviru může bránit v lepší práci ComboFixu.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
e:\windows\system32\drivers\srdd852.sys
e:\windows\TEMP\TMP000000A492D1FD46D22F4B63

Driver::
srdd852;srdd852
srdd852




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[aturk]

ComboFix 09-07-09.08 - Ja 11.07.2009 20:54.2.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1340 [GMT 2:00]
Spuštěný z: e:\documents and settings\Ja\Plocha\ComboFix.exe
Použité ovládací přepínače :: e:\documents and settings\Ja\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"e:\windows\system32\drivers\srdd852.sys"
"e:\windows\TEMP\TMP000000A492D1FD46D22F4B63"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_srdd852


((((((((((((((((((((((((( Soubory vytvořené od 2009-06-11 do 2009-07-11 )))))))))))))))))))))))))))))))
.

2009-07-11 13:19 . 2009-07-11 13:19 512096 ----a-w- e:\windows\system32\drivers\amon.sys
2009-07-11 13:19 . 2009-07-11 13:19 298104 ----a-w- e:\windows\system32\imon.dll
2009-07-11 13:19 . 2009-07-11 13:19 15424 ----a-w- e:\windows\system32\drivers\nod32drv.sys
2009-07-11 12:42 . 2009-07-11 12:42 -------- d-sh--w- e:\documents and settings\LocalService\IETldCache
2009-07-11 12:31 . 2009-06-17 09:27 38160 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 12:31 . 2009-07-11 12:31 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2009-07-11 12:31 . 2009-06-17 09:27 19096 ----a-w- e:\windows\system32\drivers\mbam.sys
2009-07-11 12:02 . 2009-07-11 12:19 -------- d-----w- e:\program files\Spybot - Search & Destroy
2009-06-22 15:04 . 2009-06-22 15:04 -------- d-----w- e:\program files\Atari

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-11 18:04 . 2008-10-24 22:06 -------- d-----w- e:\program files\Eset
2009-07-08 16:19 . 2001-10-25 11:00 99296 ----a-w- e:\windows\system32\perfc005.dat
2009-07-08 16:19 . 2001-10-25 11:00 484484 ----a-w- e:\windows\system32\perfh005.dat
2009-07-08 16:06 . 2008-10-25 08:58 -------- d--h--w- e:\program files\InstallShield Installation Information
2009-05-13 05:05 . 2007-12-27 10:39 915456 ----a-w- e:\windows\system32\wininet.dll
2009-05-07 15:33 . 2004-08-17 12:49 346624 ----a-w- e:\windows\system32\localspl.dll
2009-04-19 19:52 . 2004-08-17 12:44 1847168 ----a-w- e:\windows\system32\win32k.sys
2009-04-18 17:48 . 2009-04-18 17:48 410984 ----a-w- e:\windows\system32\deploytk.dll
2009-04-15 14:54 . 2004-08-17 12:49 585216 ----a-w- e:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-11_18.10.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 19:23 . 2009-07-11 19:23 16384 e:\windows\Temp\Perflib_Perfdata_17c.dat
+ 2009-01-15 13:32 . 2009-07-11 19:23 224362 e:\windows\system32\inetsrv\MetaBase.bin
- 2009-01-15 13:32 . 2009-07-11 17:27 224362 e:\windows\system32\inetsrv\MetaBase.bin
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OEXPRESS"="e:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-10-28 26624]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"EA Core"="e:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]
"DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"Skype"="e:\program files\Skype\Phone\Skype.exe" [2009-03-16 24095528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="e:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"GrooveMonitor"="e:\program files\Microsoft Office 2007\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"JMB36X IDE Setup"="e:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="e:\windows\system32\JMRaidSetup.exe" [2007-02-06 1953792]
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"StartCCC"="e:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"nod32kui"="e:\program files\Eset\nod32kui.exe" [2009-07-11 949376]
"RTHDCPL"="RTHDCPL.EXE" - e:\windows\RTHDCPL.EXE [2008-10-09 17021440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="e:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

e:\documents and settings\Ja\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - e:\program files\Microsoft Office 2007\Office12\ONENOTEM.EXE [2007-12-7 101440]

e:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
AVer HID Receiver.lnk - e:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2009-1-20 159744]
AVerQuick.lnk - e:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2009-1-20 663552]
RocketDock.lnk - e:\program files\RocketDock\RocketDock.exe [2008-10-25 495616]
VisualTaskTips.lnk - e:\program files\VisualTaskTips\VisualTaskTips.exe [2007-9-5 36352]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office 2007\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Hry\\Pro Evolution Soccer 2009\\pes2009.exe"=
"e:\\Hry\\Mass Effect\\Binaries\\MassEffect.exe"=
"e:\\Hry\\Mass Effect\\MassEffectLauncher.exe"=
"e:\\Hry\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"e:\\Hry\\FlatOut Ultimate Carnage\\Fouc.exe"=
"e:\\Hry\\Football Manager 2009\\fm.exe"=
"e:\\Program Files\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"e:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"e:\\Hry\\Pro Evolution Soccer 2009\\GCP2009.exe"=
"e:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"e:\\Hry\\Rise of the Argonauts\\Binaries\\RiseOfTheArgonauts.exe"=
"e:\\Hry\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"e:\\Hry\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"e:\\Hry\\Pro Cycling Manager 2008\\PCM.exe"=
"e:\\Hry\\Pro Cycling Manager 2008\\AutoRun\\Exe\\Autorun.exe"=
"e:\\Hry\\Prince of Persia\\Prince of Persia.exe"=
"e:\\Hry\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"e:\\Hry\\World of Warcraft\\Launcher.exe"=
"e:\\Hry\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"e:\\Hry\\EF2\\EF2.exe"=
"e:\\Hry\\Metin2_CZ\\metin2.bin"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10907:TCP"= 10907:TCP:BitComet 10907 TCP
"10907:UDP"= 10907:UDP:BitComet 10907 UDP

R1 nod32drv;nod32drv;e:\windows\system32\drivers\nod32drv.sys [11.7.2009 15:19 15424]
R2 acedrv11;acedrv11;e:\windows\system32\drivers\acedrv11.sys [30.7.2008 7:51 277736]
R2 AVerRemote;AVerRemote;e:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [20.1.2009 15:07 352256]
R2 AVerScheduleService;AVerScheduleService;e:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [20.1.2009 15:07 409600]
R2 WinDefend;Windows Defender;e:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 AVerAF15DMBTH;AVerMedia A850 USB;e:\windows\system32\drivers\AVerAF15DMBTH.sys [20.1.2009 15:08 293120]
R3 CAM1210;SM0121 USB 2.0 Video Camera;e:\windows\system32\drivers\cam1210.sys [24.7.2006 17:49 89856]
S3 CrystalSysInfo;CrystalSysInfo;e:\program files\MediaCoder\SysInfo.sys [25.9.2007 16:59 15152]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"e:\windows\system32\rundll32.exe" "e:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-07-11 e:\windows\Tasks\MP Scheduled Scan.job
- e:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-07-11 e:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- e:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-07-11 13:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - e:\documents and settings\Ja\Data aplikací\Mozilla\Firefox\Profiles\ljfm9882.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Java Console: No Registry Reference - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

---- NASTAVENÍ FIREFOXU ----
e:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-11 21:23
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-1757981266-725345543-1005\Software\SecuROM\License information*]
"datasecu"=hex:df,53,93,fa,a2,c4,29,0f,15,f4,78,37,87,bd,db,cc,3e,89,47,bf,a8,
d2,86,08,1d,0e,78,79,65,2e,90,cc,2d,ca,15,d8,78,24,27,2d,38,5c,08,06,16,2a,\
"rkeysecu"=hex:14,5a,a8,cf,d5,44,a2,f4,6b,ae,1a,a8,3c,bd,b3,d2
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(736)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2140)
e:\program files\RocketDock\RocketDock.dll
e:\program files\VisualTaskTips\VttHooks.dll
e:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\wpdshserviceobj.dll
e:\windows\system32\portabledevicetypes.dll
e:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\windows\system32\ati2evxx.exe
e:\windows\system32\ati2evxx.exe
e:\windows\system32\inetsrv\inetinfo.exe
e:\program files\Java\jre6\bin\jqs.exe
e:\program files\Eset\nod32krn.exe
e:\windows\system32\PnkBstrA.exe
e:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
e:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
e:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
e:\windows\system32\wscntfy.exe
e:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
e:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2009-07-11 21:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-07-11 19:28
ComboFix2.txt 2009-07-11 18:13

Před spuštěním: 5 426 634 752
Po spuštění: 5 314 420 736

196 --- E O F --- 2009-07-11 11:01



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:47, on 11.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
E:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\Eset\nod32krn.exe
E:\WINDOWS\system32\PnkBstrA.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
E:\Program Files\Eset\nod32kui.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
E:\Program Files\Electronic Arts\EADM\Core.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\WINDOWS\system32\wscntfy.exe
E:\Program Files\Skype\Phone\Skype.exe
E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
E:\Program Files\RocketDock\RocketDock.exe
E:\Program Files\VisualTaskTips\VisualTaskTips.exe
E:\Program Files\Skype\Plugin Manager\skypePM.exe
E:\WINDOWS\explorer.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Documents and Settings\Ja\Plocha\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office 2007\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] E:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] E:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OEXPRESS] E:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EA Core] "E:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "E:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = E:\Program Files\Microsoft Office 2007\Office12\ONENOTEM.EXE
O4 - Global Startup: AVer HID Receiver.lnk = E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = E:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office 2007\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVerRemote - AVerMedia - E:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - E:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9562 bytes

[Damned]

Žádnýho parazita tam už nevidím.

Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž
a zapni si AVG.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Označ topic za vyřešený (zelená fajfka) a měj se.

[aturk]

Diky moc