Kontrola logu HJT DoubleD Vyřešeno

[jandas]

/odděleno od jiného tématu.memphisto
pls stejny problem ....

Malwarebytes' Anti-Malware 1.39
Verze databáze: 2482
Windows 5.1.2600 Service Pack 3

22.7.2009 22:47:00
mbam-log-2009-07-22 (22-46-53).txt

Typ skenu: Rychlý sken
Objektu skenováno: 107254
Uplynulý cas: 8 minute(s), 53 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 5
Infikované klíce registru: 36
Infikované hodnoty registru: 3
Infikované položky dat registru: 0
Infikované složky: 31
Infikované soubory: 154

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
C:\Program Files\DoubleD\GamingHarbor Toolbar\4.1.2.19770\FFToolbar\components\SmileyCore.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.5.0.850\HPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.5.0.850\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> No action taken.

Infikované klíce registru:
HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{5297e905-1dfb-4a9c-9871-a4f95fd58945} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{95b92d92-8b7d-4a19-a3f1-43113b4dbcaf} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{c28a0312-c403-417b-a425-a915bc0519cd} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{d335d84d-61d8-4b5f-9c4e-067dc8b27ed5} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{42c23154-00fa-4a93-9de9-3eb523cffff6} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2e8e2100-98cb-4aac-9480-63a281acaff5} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{22c12739-c111-44c6-9bb7-f335c2a9be2a} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{edb1a56e-2224-4c79-a4bd-42a39c6e4608} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{27ff1ee8-8ccc-49e1-b801-f212e3744e80} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0514c9b0-e4c6-4d6b-a3a6-b38bc280b115} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3fb17508-0bf4-4fde-845a-323a1052957c} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{803e73fe-cb73-4d49-8aff-653fd6f44171} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3fb17508-0bf4-4fde-845a-323a1052957c} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{51b67a88-02d0-43cb-8d12-5ca3e2d4cf49} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d44cc2fb-77b8-48a5-a5dc-f961f2d258fb} (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smileyapp (Adware.DoubleD) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
c:\documents and settings\Aklain\nabídka start\Antivirus 2009 (Rogue.AntiVirus2008) -> No action taken.
C:\Program Files\DoubleD (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770 (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\FFToolbar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome\locale (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome\locale\en-US (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\searchplugins (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850 (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\Data (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome\content (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\components (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340 (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\Data (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome\content (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750 (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data (Adware.DoubleD) -> No action taken.

Infikované soubory:
C:\Program Files\Media Access Startup\1.5.0.850\HPIEAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\ssd.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\DoubleD\GamingHarbor Toolbar\4.1.2.19770\stb0.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll (Adware.DoubleD) -> No action taken.
c:\documents and settings\Aklain\nabídka start\antivirus 2009\Antivirus 2009.lnk (Rogue.AntiVirus2008) -> No action taken.
c:\documents and settings\Aklain\nabídka start\antivirus 2009\Uninstall Antivirus 2009.lnk (Rogue.AntiVirus2008) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\AIMActiveXDLL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\AxGifAnimator.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\gdiplus.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\HookAPINT.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\mfc80.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Microsoft.VC80.CRT.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Microsoft.VC80.MFC.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\msvcr80.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\MyDll.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\OEActiveXDLL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Riched20Smiley.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\SkinCrafterDll.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbAol.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbapp.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbapp.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbappHelper.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbasst.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbdl.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbIE.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbMsn.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbOL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbOLEX.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbsvc.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbYahoo8.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\stbYahoo9.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\248d6576afce4ee94af42d7350131106.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\24a70fb875fab686b6b3c217612bc07c.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\2afcf6f3f2e19cc42d7f72f3b18b26ef.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\50bffa6936b3e661971a58e3c8bdf4cb.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\default1.dat (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\loading.dat (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache\loading.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Cursor.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_DailyVideo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Game.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Glitter.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Logo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Option.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Recipe.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Ringtone.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Screensaver.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Search.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Smiley.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Smiley_Config.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Smiley_TellAFriend.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Wallpaper.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\Module_Web.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\pixel.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\ProductInfo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\profile.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\SearchEngineList.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\tbcore.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\ToolbarLayout.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\UpdateCentre.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\UpdateCentreBk.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome\GamingHarborToolbar.jar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome\locale\en-US\global.dtd (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\DDAutoComplete.js (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\ISmileyCore.xpt (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\SmileyCore.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\TBFFHelper.js (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\TBFFHelper.xpt (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\searchplugins\gamingharborsearchplugins.xml (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\About.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Component_ComboBox.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Cursor.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Cursor.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_DailyVideo.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Game.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Glitter.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Glitter.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Logo.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Option.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Recipe.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Ringtone.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Screensaver.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Search.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Smiley.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Smiley.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Wallpaper.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\Module_Web.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnDefault.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnDisplay.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnDisplay.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnDisplay18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnDisplay20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnGlitters.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnGlitters.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnGlitters18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnGlitters20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnOption.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnSmiley.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnSmiley.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnSmiley18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnSmiley20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnTellFd.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnTellFd.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnTellFd18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnTellFd20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnWink.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnWink.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnWink18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons\TBBtnWink20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\myskin1.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\myskin2.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\myskin3.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\myskin4.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\TellafriendSkin.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\TellafriendSkin_s.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins\ToastSkin.skf (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\HPCommon.dll (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\hppx.exe (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\MAHelper.exe (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\Data\config.md (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.5.0.850\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\adwpx.exe (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\NPCommon.dll (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\Data\config.md (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome\NPAddOn.jar (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.js (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.xul (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components\NPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components\NPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\eacore.mx (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
c:\documents and settings\Aklain\data aplikací\microsoft\internet explorer\quick launch\Antivirus 2009.lnk (Rogue.AntiVirus2009) -> No action taken.
c:\documents and settings\administrator\local settings\temporary internet files\ISOSetup.exe (Trojan.Agent) -> No action taken.


mam taky udelat stejny druhy krok a smazat ty vybrane soubory?

[Reklama]

[jandas]

tady je ten druhy krok .....


Malwarebytes' Anti-Malware 1.39
Verze databáze: 2482
Windows 5.1.2600 Service Pack 3

22.7.2009 23:11:12
mbam-log-2009-07-22 (23-11-12).txt

Typ skenu: Rychlý sken
Objektu skenováno: 107268
Uplynulý cas: 8 minute(s), 49 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 5
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 20
Infikované soubory: 8

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
C:\Program Files\DoubleD\GamingHarbor Toolbar\4.1.2.19770\FFToolbar\components\SmileyCore.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.0.850\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.0.850\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
C:\Program Files\DoubleD (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770 (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Cache (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Data (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\FFToolbar (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Icons (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\Skins (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850 (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\FF (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\FF\chrome (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\FF\components (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340 (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\FF (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components (Adware.DoubleD) -> Delete on reboot.

Infikované soubory:
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\chrome\GamingHarborToolbar.jar (Adware.DoubleD) -> Delete on reboot.
c:\program files\DoubleD\gamingharbor toolbar\4.1.2.19770\fftoolbar\components\SmileyCore.dll (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> Delete on reboot.
c:\program files\media access startup\1.5.0.850\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\NPCommon.dll (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\FF\chrome\NPAddOn.jar (Adware.DoubleD) -> Delete on reboot.
c:\program files\internet saving optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.


a ted jdu na ten combofix, takze musim vypnout vsechny okna jestli sem to dobre pochopil ..

[jandas]

tady je ten log z comba, je toho teda ale hodne


ComboFix 09-07-22.01 - Administrator 22.07.2009 23:18.1.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.447.225 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm10B4.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm1356.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm148D.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm1E.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm36.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tm5A.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tmB79.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\_tmE6C.tmp
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\stb06759.tmp
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.4.0.4340\NPCommon.dll
c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.5.0.850\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.5.0.850\HPCommon.dll
c:\recycler\S-1-5-21-1004336348-1614895754-839522115-1003
c:\windows\system32\Drivers\bshejbr.sys
c:\windows\system32\Drivers\nztuy.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_fvsnxskk
-------\Service_twnqzjls


((((((((((((((((((((((((( Soubory vytvořené od 2009-06-22 do 2009-07-22 )))))))))))))))))))))))))))))))
.

2009-07-22 20:34 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-22 20:34 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-22 20:34 . 2009-07-22 20:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-22 16:43 . 2009-07-22 16:43 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-07-22 06:52 . 2009-07-22 06:55 -------- dc-h--w- c:\windows\ie8
2009-07-21 16:22 . 2009-07-21 16:22 -------- d-----w- c:\program files\ESET
2009-07-07 15:44 . 2009-07-07 15:44 -------- d-----w- c:\program files\DoubleD
2009-07-02 07:55 . 2008-04-13 22:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-07-02 07:55 . 2008-04-13 22:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-07-02 07:46 . 2007-03-18 18:00 215040 ----a-w- c:\windows\system32\CNMLM8R.DLL
2009-07-02 07:46 . 2009-07-02 07:46 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-07-02 07:46 . 2006-06-29 03:29 106496 ----a-w- c:\windows\system32\cnco140.dll
2009-07-02 07:46 . 2006-11-10 00:00 1314816 ----a-w- c:\windows\system32\CNCC140.DLL
2009-07-02 07:46 . 2006-11-09 23:59 57344 ----a-w- c:\windows\system32\CNCI140.DLL
2009-07-02 07:46 . 2006-05-25 23:54 135168 ----a-w- c:\windows\system32\CNCL140.DLL
2009-07-02 07:46 . 2009-07-02 07:46 -------- d--h--w- c:\program files\CanonBJ
2009-07-02 07:42 . 2009-07-02 07:53 -------- d-----w- c:\program files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-22 21:30 . 2008-12-24 17:13 -------- d-----w- c:\program files\DNA
2009-07-22 21:02 . 2009-07-22 21:02 53828 ----a-w- c:\program files\jiohh.txt
2009-05-30 14:15 . 2008-11-21 13:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-30 14:06 . 2009-01-07 14:13 737280 ----a-w- c:\windows\iun6002.exe
2009-05-24 11:31 . 2009-05-24 11:31 -------- d-----w- c:\program files\Enlight
2009-05-24 11:31 . 2008-10-18 19:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-11 15:24 . 2001-10-25 11:00 78694 ----a-w- c:\windows\system32\perfc005.dat
2009-05-11 15:24 . 2001-10-25 11:00 431648 ----a-w- c:\windows\system32\perfh005.dat
2009-04-23 17:44 . 2009-04-23 17:43 12781064 ----a-w- c:\program files\RealPlayer10-5GOLD.exe
2009-07-15 21:16 . 2009-07-22 06:44 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-29 16:24 325000 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-24 342848]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="c:\progra~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2006-02-17 270336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-08-03 577536]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-12-10 1519616]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Valve\\cstrike.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 8:21 468224]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [7.1.2009 13:49 222456]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-MsgCenterExe - c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\aeq4al45.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.idnes.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-22 23:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3148)
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\Apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\progra~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
c:\progra~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\Apache.exe
c:\progra~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-07-22 23:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-07-22 21:37

Před spuštěním: Volných bajtů: 121 168 035 840
Po spuštění: Volných bajtů: 121 412 587 520

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

225

[Damned]

Před smazáním MbAM jsi to měl zkusit nejdřív odinstalovat.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\program files\jiohh.txt
c:\windows\iun6002.exe

Folder::
c:\program files\DoubleD
c:\program files\AskBarDis
c:\program files\system search dispatcher
c:\program files\internet saving optimizer
c:\program files\media access startup
c:\program files\DoubleD
c:\program files\ICQ6Toolbar

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-

Driver::
ICQ Service;ICQ Service
ICQ Service




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[jandas]

tady je ten z combo ..

ComboFix 09-07-22.05 - Administrator 23.07.2009 9:16.2.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.447.167 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\program files\jiohh.txt"
"c:\windows\iun6002.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\00187AD8
c:\program files\AskBarDis\bar\Cache\00187ED0.bin
c:\program files\AskBarDis\bar\Cache\001881BE.bin
c:\program files\AskBarDis\bar\Cache\001883B2.bin
c:\program files\AskBarDis\bar\Cache\001885A6.bin
c:\program files\AskBarDis\bar\Cache\0018878A.bin
c:\program files\AskBarDis\bar\Cache\001888F1.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\bar\Settings\prevCfg2.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
c:\program files\DoubleD
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt
c:\program files\jiohh.txt
c:\windows\iun6002.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service


((((((((((((((((((((((((( Soubory vytvořené od 2009-06-23 do 2009-07-23 )))))))))))))))))))))))))))))))
.

2009-07-22 20:34 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-22 20:34 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-22 20:34 . 2009-07-22 20:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-22 16:43 . 2009-07-22 16:43 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-07-22 06:52 . 2009-07-22 06:55 -------- dc-h--w- c:\windows\ie8
2009-07-21 16:22 . 2009-07-21 16:22 -------- d-----w- c:\program files\ESET
2009-07-02 07:55 . 2008-04-13 22:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-07-02 07:55 . 2008-04-13 22:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-07-02 07:46 . 2007-03-18 18:00 215040 ----a-w- c:\windows\system32\CNMLM8R.DLL
2009-07-02 07:46 . 2009-07-02 07:46 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-07-02 07:46 . 2006-06-29 03:29 106496 ----a-w- c:\windows\system32\cnco140.dll
2009-07-02 07:46 . 2006-11-10 00:00 1314816 ----a-w- c:\windows\system32\CNCC140.DLL
2009-07-02 07:46 . 2006-11-09 23:59 57344 ----a-w- c:\windows\system32\CNCI140.DLL
2009-07-02 07:46 . 2006-05-25 23:54 135168 ----a-w- c:\windows\system32\CNCL140.DLL
2009-07-02 07:46 . 2009-07-02 07:46 -------- d--h--w- c:\program files\CanonBJ
2009-07-02 07:42 . 2009-07-02 07:53 -------- d-----w- c:\program files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 07:26 . 2008-12-24 17:13 -------- d-----w- c:\program files\DNA
2009-05-30 14:15 . 2008-11-21 13:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-24 11:31 . 2009-05-24 11:31 -------- d-----w- c:\program files\Enlight
2009-05-24 11:31 . 2008-10-18 19:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-11 15:24 . 2001-10-25 11:00 78694 ----a-w- c:\windows\system32\perfc005.dat
2009-05-11 15:24 . 2001-10-25 11:00 431648 ----a-w- c:\windows\system32\perfh005.dat
2009-04-23 17:44 . 2009-04-23 17:43 12781064 ----a-w- c:\program files\RealPlayer10-5GOLD.exe
2009-07-15 21:16 . 2009-07-22 06:44 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-22_21.30.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-23 07:26 . 2009-07-23 07:26 16384 c:\windows\Temp\Perflib_Perfdata_e0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-24 342848]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="c:\progra~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2006-02-17 270336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-08-03 577536]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-12-10 1519616]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Valve\\cstrike.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 8:21 468224]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\aeq4al45.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.idnes.cz/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 09:26
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3220)
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\Apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\progra~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\Apache.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\progra~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
c:\progra~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-07-23 9:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-07-23 07:33
ComboFix2.txt 2009-07-22 21:37

Před spuštěním: Volných bajtů: 121 409 552 384
Po spuštění: Volných bajtů: 121 368 096 768

224

[jandas]

pc nic zvlastniho nedelal, normalne projel combo restartovl se, vytvoril log a to bylo vse, pote jsem uz jen zapl firefox, nastavil ho jako vychozi prohlizec (nabidlo mi to) a poslal sem to sem, jo a co je ten log z hjt?

[jandas]

asi jsi mel na mysli tohle ze? ....

Malwarebytes' Anti-Malware 1.39
Verze databáze: 2482
Windows 5.1.2600 Service Pack 3

23.7.2009 9:45:56
mbam-log-2009-07-23 (09-45-56).txt

Typ skenu: Rychlý sken
Objektu skenováno: 104552
Uplynulý cas: 5 minute(s), 19 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[Damned]

Z mého podpisu si stáhni HijackThis (HJT) a udělej podle návodu log. Ten mi sem ještě vlož, ke kontrole.

[jandas]

tady to je ....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:30:51, on 23.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6184 bytes

[Damned]

Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou, zmáčknout
"Fix checked"):

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (file missing)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
*****************************************************************************************************************************************
Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž
a zapni si AVG.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
Kdyby něco, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

[jandas]

díky moc, ještě by mě zajímalo co z toho máš že tady radíš lidem, jsi nějak honorovaný (neviděl jsem na stránkách žadnou reklamu, tak mě na padá jedině přes nějaké granty?)

[Damned]

Nejen já, ale i všichni ostatní co radí, zadarmo. Prostě něco umíš, tak poradíš. Někteří kluci mají stránky a na nich možný sponzoring, já mám jen v češtinách co překládám návrh na možný příspěvek. (neboj, ještě nikdo neposlal ani halíř )