Prosím o kontrolu log - nechtěné vyskakování oken

Norah · Příspěvekod **Norah** » 08 lis 2009 15:08

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:01:14, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\QIP\qip.exe
H:\Program Files\QIP\qip.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - H:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - H:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPIEAddOn.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Uživatel Marie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - H:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe

--
End of file - 10355 bytes

Reklama

Příspěvekod **jaro3** » 08 lis 2009 16:37

Odinstaluj:
pdfforge Toolbar
ICQTOOLBAR
Crawler\Toolbar
Internet Saving Optimizer

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - H:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - H:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPIEAddOn.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Norah · Příspěvekod **Norah** » 08 lis 2009 17:47

Díky za radu! Všechno mi šlo, až na odinstalování ICQ Toolbar...nenašla jsem žádný soubor pro odinstalování, není ani v "Přidat nebo odebrat programy". V Program Files jsem měla složku ICQ Toolbar, tu jsem nadobro smazala...také tam nebyl soubor na odinstalaci.

Tady je záznam z Malwarebytes...

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3126
Windows 5.1.2600 Service Pack 2

8.11.2009 17:42:50
mbam-log-2009-11-08 (17-42-44).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 106150
Uplynulý čas: 6 minute(s), 20 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 2
Infikované klíče registru: 20
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované adresáře: 15
Infikované soubory: 32

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.

Infikované klíče registru:
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> No action taken.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
H:\Program Files\DoubleD (Adware.DoubleD) -> No action taken.
H:\Program Files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900 (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\Data (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960 (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF (Adware.DoubleD) -> No action taken.

Infikované soubory:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\hppx.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\MAHelper.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.dat (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\Data\config.md (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\install.rdf (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.dat (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\eacore.mx (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Update.exe (Trojan.Dropper) -> No action taken.
H:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> No action taken.
H:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4-1.doc (Trojan.Agent) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4.doc (Trojan.Agent) -> No action taken.

Norah · Příspěvekod **Norah** » 08 lis 2009 17:51

Jinak teď jsem zkusila pustit internet přes Firefox - můj používaný prohlížeč a okna pořád vyskakují. Jedná se o různé reklamní nesmysly. Např. http://www.eazywin.net/cz/competitions/ ... vydC000000 ...atd. :-(

Zatím je to pořád stené...

Příspěvekod **jaro3** » 08 lis 2009 18:05

Ještě se taky nic nesmazalo.

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochranu u Avastu.

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Norah · Příspěvekod **Norah** » 08 lis 2009 18:47

Posílám log z MbAM:

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3126
Windows 5.1.2600 Service Pack 2

8.11.2009 18:17:30
mbam-log-2009-11-08 (18-17-30).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 106188
Uplynulý čas: 2 minute(s), 15 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 2
Infikované klíče registru: 20
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované adresáře: 15
Infikované soubory: 32

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.

Infikované klíče registru:
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
H:\Program Files\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900 (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\System Search Dispatcher (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960 (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované soubory:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\hppx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\MAHelper.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\eacore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLDynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLStatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Update.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
H:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
H:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4-1.doc (Trojan.Agent) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4.doc (Trojan.Agent) -> Quarantined and deleted successfully.

Tady je Combo log:

ComboFix 09-11-07.04 - Uživatel Marie 08.11.2009 18:36.1.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.3071.2524 [GMT 1:00]
Spuštěný z: h:\documents and settings\Uživatel Marie\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091108-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
h:\windows\system32\ieuinit.inf
h:\windows\system32\nsprs.dll
h:\windows\system32\ssprs.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-10-08 do 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-08 16:32 . 2009-09-10 13:54 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 16:32 . 2009-11-08 16:32 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2009-11-08 16:32 . 2009-09-10 13:53 19160 ----a-w- h:\windows\system32\drivers\mbam.sys
2009-11-08 14:00 . 2009-11-08 14:00 -------- d-----w- h:\program files\Trend Micro
2009-11-02 14:31 . 2009-11-02 14:31 -------- d-----w- h:\program files\Common Files\BioWare
2009-11-02 14:28 . 2009-11-02 14:29 -------- d-----w- h:\program files\Dragon Age Origins Character Creator
2009-10-29 10:39 . 2009-10-29 10:39 -------- d-----w- h:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 10:51 . 2009-09-05 21:04 -------- d-----w- h:\program files\Bejeweled 2 Deluxe
2009-11-01 21:56 . 2008-11-29 18:46 411368 ----a-w- h:\windows\system32\deploytk.dll
2009-11-01 21:56 . 2007-10-13 08:24 -------- d-----w- h:\program files\Java
2009-10-25 10:04 . 2006-03-02 12:00 82206 ----a-w- h:\windows\system32\perfc005.dat
2009-10-25 10:04 . 2006-03-02 12:00 436144 ----a-w- h:\windows\system32\perfh005.dat
2009-10-12 07:00 . 2009-08-23 09:01 -------- d-----w- h:\program files\Sukoku
2009-09-15 10:59 . 2009-08-26 12:12 1279968 ----a-w- h:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2009-08-26 12:12 93424 ----a-w- h:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2009-08-26 12:12 94160 ----a-w- h:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2009-08-26 12:12 114768 ----a-w- h:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-08-26 12:12 20560 ----a-w- h:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2009-08-26 12:12 52368 ----a-w- h:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-08-26 12:12 23152 ----a-w- h:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-08-26 12:12 27408 ----a-w- h:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2009-08-26 12:12 97480 ----a-w- h:\windows\system32\AvastSS.scr
2009-09-05 21:39 . 2009-09-05 21:39 16 ----a-w- h:\windows\popcinfo.dat
2009-09-05 21:04 . 2009-09-05 21:04 720896 ----a-w- h:\windows\iun6002ev.exe
2009-09-05 19:34 . 2009-09-05 19:28 24 ----a-w- h:\windows\popcinfot.dat
2009-06-10 20:40 . 2009-06-10 20:40 80 --sh--r- h:\windows\system32\0E495E2732.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="h:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"DAEMON Tools"="h:\program files\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"Registry Cleaner"="h:\program files\Registry Cleaner Trial\Regclean.exe" [2006-05-25 4710400]
"Google Update"="h:\documents and settings\Uživatel Marie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-05-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"avast!"="h:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"SpywareTerminator"="h:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-10-02 1783808]
"SunJavaUpdateSched"="h:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 149280]
"Malwarebytes Anti-Malware (reboot)"="h:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

h:\documents and settings\U§ivatel Marie\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
MagicDisc.lnk - h:\program files\MagicDisc\MagicDisc.exe [2008-10-24 575488]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - h:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - h:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\ubi.com\\Core\\GS4.exe"=
"h:\\Program Files\\BitComet\\BitComet.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\CS\\Valve\\hl.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\FlatOut\\FlatOut2.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\fl2\\FlatOut2.exe"=
"h:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"h:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"h:\\Program Files\\FlightGear\\bin\\Win32\\fgfs.exe"=
"h:\\Program Files\\MultiProxy\\MProxy.exe"=
"h:\\Program Files\\Codemasters\\Overlord II\\Overlord2.exe"=
"h:\\Program Files\\Aquadelic GT\\Run.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\bin_ship\\DAOCharacterCreator.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\DAOriginsLauncher.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztracení\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztraceni´\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=

R1 aswSP;avast! Self Protection;h:\windows\system32\drivers\aswSP.sys [26.8.2009 13:12 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;h:\windows\system32\drivers\sp_rsdrv2.sys [30.9.2007 18:23 141312]
R2 aswFsBlk;aswFsBlk;h:\windows\system32\drivers\aswFsBlk.sys [26.8.2009 13:12 20560]
R3 3xHybrid;3xHybrid service;h:\windows\system32\drivers\3xHybrid.sys [22.3.2006 16:33 826752]
S2 RCService;RCService;h:\program files\gigabyte\RCService\RCService.exe [26.4.2006 7:47 538624]
S2 Sukoku Service;Sukoku Service;h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe [29.9.2009 9:23 54760]
S3 npggsvc;nProtect GameGuard Service;h:\windows\system32\GameMon.des -service --> h:\windows\system32\GameMon.des -service [?]
S3 tap0901_2gm;VPN Anonymizer Adapter;h:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Office Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddAllLink.htm
FF - ProfilePath - h:\documents and settings\Uživatel Marie\Data aplikací\Mozilla\Firefox\Profiles\l1htehqe.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|ht ... seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: h:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npCortona.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: h:\program files\Opera\program\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Bridge Building Game - h:\program files\Bridge Building Game\uninstall.exe
AddRemove-com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 - h:\program files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 18:41
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys >>UNKNOWN [0x8A4BF1E8]<<
kernel: MBR read successfully
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="h:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1343024091-2049760794-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:0e,68,c2,1d,fa,d0,7c,0e,b9,e3,f0,70,2c,b6,37,77,df,32,a6,46,97,
16,be,b8,7d,91,9e,a7,5e,0d,3b,0f,4d,78,c9,a8,19,00,54,a1,d7,b2,68,75,91,23,\
"rkeysecu"=hex:74,3f,65,d3,9d,f0,12,cd,ec,8f,d0,fb,60,6f,ba,e2
.
Celkový čas: 2009-11-08 18:42
ComboFix-quarantined-files.txt 2009-11-08 17:42

Před spuštěním: 7 147 896 832
Po spuštění: Volných bajtů: 11 016 818 688

- - End Of File - - F29E5089A6E016F62332E3D01BF326A1

Jinak nevyžádaná okna pořád vyskakují...

Příspěvekod **jaro3** » 08 lis 2009 19:36

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
h:\windows\iun6002ev.exe
h:\windows\popcinfot.dat
h:\windows\system32\0E495E2732.dll
h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe
h:\windows\system32\GameMon.des 

Folder::
h:\program files\Sukoku

Driver::
npggsvc
GameMon.des

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

Firefox::
FF - ProfilePath - h:\documents and settings\Uživatel Marie\Data aplikací\Mozilla\Firefox\Profiles\l1htehqe.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Norah · Příspěvekod **Norah** » 08 lis 2009 20:25

Tak jsem vše provedla a jak jsem přetáhla požadovaný soubor na ComboFix, tak se to spustilo a během operace nastaly dva restarty PC, během toho jsem spozorovala, jak naskočila na dvě sekundy modrá obrazovka s nějakými nápisy o Windows atd. Nakonec nevyjel žádný nový log...nic. Tak Vám posílám alespoň výpis z HJT... P.S. Okna furt vyskakují (a ještě poznámka, co jsem nenapsala hned na začátku...ta okna vyskakují jen v prohlížeči Firefox)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25:10, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\WINDOWS\system32\wscntfy.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Uzˇivatel Marie\Local Settings\Data aplikaci´\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe (file missing)

--
End of file - 8075 bytes

Příspěvekod **jaro3** » 08 lis 2009 20:31

Ten log by měl být zde:
H:\ComboFix.txt

a příslušné číslo

Na firefox:
Stáhni si GooredFix

a ulož si ho na plochu.Poklepej na něj .
Objeví se hláška ,dej YES
Otevře se log , zkopíruj sem celý jeho obsah ( jinak ho najdeš na své ploše pod názvem Goored.txt).

Stáhni si :Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit, smazat, přesunout nebo přejmenovat

Zkus potom normálně spustit ještě jednou Combofix (bez scriptu),a vlož sem z něho opět log.

Norah · Příspěvekod **Norah** » 08 lis 2009 21:36

Zasílám výpis z GooredFix:

GooredFix by jpshortstuff (24.09.09.1)
Log created at 20:53 on 08/11/2009 (Uživatel Marie)
Firefox version 3.5.5 (cs)

========== GooredScan ==========

========== GooredLog ==========

H:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [20:57 01/11/2009]
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [08:24 13/10/2007]
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [04:46 29/04/2008]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [21:56 01/11/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"jqs@sun.com"="H:\Program Files\Java\jre6\lib\deploy\jqs\ff" [21:56 01/11/2009]

-=E.O.F=-

Výpis z ComboFix:

ComboFix 09-11-07.04 - Uživatel Marie 08.11.2009 21:20.3.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.3071.2222 [GMT 1:00]
Spuštěný z: h:\documents and settings\Uživatel Marie\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091108-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
.
---- Předchozí spuštění -------
.
h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
h:\program files\Sukoku\sukoku.exe
h:\program files\Sukoku\uninstall.exe
h:\windows\iun6002ev.exe
h:\windows\popcinfot.dat
h:\windows\system32\0E495E2732.dll
h:\windows\system32\GameMon.des

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-10-08 do 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-08 16:32 . 2009-09-10 13:54 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 16:32 . 2009-11-08 16:32 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2009-11-08 16:32 . 2009-09-10 13:53 19160 ----a-w- h:\windows\system32\drivers\mbam.sys
2009-11-08 14:00 . 2009-11-08 14:00 -------- d-----w- h:\program files\Trend Micro
2009-11-02 14:31 . 2009-11-02 14:31 -------- d-----w- h:\program files\Common Files\BioWare
2009-11-02 14:28 . 2009-11-02 14:29 -------- d-----w- h:\program files\Dragon Age Origins Character Creator
2009-10-29 10:39 . 2009-10-29 10:39 -------- d-----w- h:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 10:51 . 2009-09-05 21:04 -------- d-----w- h:\program files\Bejeweled 2 Deluxe
2009-11-01 21:56 . 2008-11-29 18:46 411368 ----a-w- h:\windows\system32\deploytk.dll
2009-11-01 21:56 . 2007-10-13 08:24 -------- d-----w- h:\program files\Java
2009-10-25 10:04 . 2006-03-02 12:00 82206 ----a-w- h:\windows\system32\perfc005.dat
2009-10-25 10:04 . 2006-03-02 12:00 436144 ----a-w- h:\windows\system32\perfh005.dat
2009-09-15 10:59 . 2009-08-26 12:12 1279968 ----a-w- h:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2009-08-26 12:12 93424 ----a-w- h:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2009-08-26 12:12 94160 ----a-w- h:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2009-08-26 12:12 114768 ----a-w- h:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-08-26 12:12 20560 ----a-w- h:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2009-08-26 12:12 52368 ----a-w- h:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-08-26 12:12 23152 ----a-w- h:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-08-26 12:12 27408 ----a-w- h:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2009-08-26 12:12 97480 ----a-w- h:\windows\system32\AvastSS.scr
2009-09-05 21:39 . 2009-09-05 21:39 16 ----a-w- h:\windows\popcinfo.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-11-08_17.41.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-08 19:16 . 2009-11-08 19:16 16384 h:\windows\Temp\Perflib_Perfdata_7a4.dat
+ 2009-11-08 19:16 . 2009-11-08 19:16 16384 h:\windows\Temp\Perflib_Perfdata_48c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="h:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"DAEMON Tools"="h:\program files\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"Registry Cleaner"="h:\program files\Registry Cleaner Trial\Regclean.exe" [2006-05-25 4710400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"avast!"="h:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"SpywareTerminator"="h:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-10-02 1783808]
"SunJavaUpdateSched"="h:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 149280]
"Malwarebytes Anti-Malware (reboot)"="h:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

h:\documents and settings\U§ivatel Marie\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
MagicDisc.lnk - h:\program files\MagicDisc\MagicDisc.exe [2008-10-24 575488]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - h:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - h:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\ubi.com\\Core\\GS4.exe"=
"h:\\Program Files\\BitComet\\BitComet.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\CS\\Valve\\hl.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\FlatOut\\FlatOut2.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\fl2\\FlatOut2.exe"=
"h:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"h:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"h:\\Program Files\\FlightGear\\bin\\Win32\\fgfs.exe"=
"h:\\Program Files\\MultiProxy\\MProxy.exe"=
"h:\\Program Files\\Codemasters\\Overlord II\\Overlord2.exe"=
"h:\\Program Files\\Aquadelic GT\\Run.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\bin_ship\\DAOCharacterCreator.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\DAOriginsLauncher.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztracení\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztraceni´\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=

R1 aswSP;avast! Self Protection;h:\windows\system32\drivers\aswSP.sys [26.8.2009 13:12 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;h:\windows\system32\drivers\sp_rsdrv2.sys [30.9.2007 18:23 141312]
R2 aswFsBlk;aswFsBlk;h:\windows\system32\drivers\aswFsBlk.sys [26.8.2009 13:12 20560]
R3 3xHybrid;3xHybrid service;h:\windows\system32\drivers\3xHybrid.sys [22.3.2006 16:33 826752]
S2 RCService;RCService;h:\program files\gigabyte\RCService\RCService.exe [26.4.2006 7:47 538624]
S2 Sukoku Service;Sukoku Service;"h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe" "h:\program files\Sukoku\sukoku.dll" Service --> h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe [?]
S3 tap0901_2gm;VPN Anonymizer Adapter;h:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - DwShield000054D3
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Office Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddAllLink.htm
FF - ProfilePath - h:\documents and settings\Uživatel Marie\Data aplikací\Mozilla\Firefox\Profiles\l1htehqe.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|ht ... seznam.cz/
FF - plugin: h:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npCortona.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: h:\program files\Opera\program\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Google Update - h:\documents and settings\Uzˇivatel Marie\Local Settings\Data aplikaci´\Google\Update\GoogleUpdate.exe
AddRemove-Sukoku - h:\program files\Sukoku\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 21:25
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys >>UNKNOWN [0x8A44E1E8]<<
kernel: MBR read successfully
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1343024091-2049760794-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:0e,68,c2,1d,fa,d0,7c,0e,b9,e3,f0,70,2c,b6,37,77,df,32,a6,46,97,
16,be,b8,7d,91,9e,a7,5e,0d,3b,0f,4d,78,c9,a8,19,00,54,a1,d7,b2,68,75,91,23,\
"rkeysecu"=hex:74,3f,65,d3,9d,f0,12,cd,ec,8f,d0,fb,60,6f,ba,e2
.
Celkový čas: 2009-11-08 21:33
ComboFix-quarantined-files.txt 2009-11-08 20:33
ComboFix2.txt 2009-11-08 17:42

Před spuštěním: Volných bajtů: 10 988 601 344
Po spuštění: Volných bajtů: 10 954 526 720

- - End Of File - - 2FC745A92D56618FC300A1147B4DA1F2

P.S. Zkusila jsem ten antivir Dr.Web a nenašlo to u mě žádný vir...

Příspěvekod **jaro3** » 08 lis 2009 21:45

Stáhni si program OTM (by OldTimer)
http://www.edisk.cz/stahni/07995/OTMove ... .39KB.html
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE

Kód: Vybrat vše

:Processes
explorer.exe

:Services

:Reg

:Files
h:\windows\popcinfo.dat

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast či Aviru, následně T-Cleaner smaž a zapni si AVG , Avast, Aviru.

Vlož ještě nový log z HJT.

Pokud budou ještě problémy s FF, zazálohuj si záložky FF a odinstaluj FF.
Najdi a smaž:
C:\Program Files\Mozilla Firefox
C:\Documents and Settings\Jméno\Data aplikací\Mozilla
C:\Documents and Settings\Jméno\Local Settings\Data aplikací\Mozilla

Stáhni si znovu FF , nainstaluj znovu. Pak by již problémy neměli být.

Norah · Příspěvekod **Norah** » 08 lis 2009 23:24

Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích...tady to je:

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
h:\windows\popcinfo.dat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65536 bytes
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. H:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: Uivatel Marie

User: Uživatel Marie
->Temp folder emptied: 18353 bytes
->Temporary Internet Files folder emptied: 137852 bytes
->Java cache emptied: 33449689 bytes
->FireFox cache emptied: 51801658 bytes
->Google Chrome cache emptied: 7213136 bytes
->Opera cache emptied: 51497802 bytes

%systemdrive% .tmp files removed: 0 bytes
H:\WINDOWS\msdownld.tmp folder deleted successfully.
H:\WINDOWS\NV22242184.TMP folder deleted successfully.
H:\WINDOWS\NV29202080.TMP folder deleted successfully.
H:\WINDOWS\NV32123216.TMP folder deleted successfully.
%systemroot% .tmp files removed: 45333359 bytes
%systemroot%\System32 .tmp files removed: 4393472 bytes
File delete failed. H:\WINDOWS\temp\Perflib_Perfdata_7a4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 185,01 mb

OTM by OldTimer - Version 3.0.0.6 log created on 11082009_221400

Files moved on Reboot...
H:\WINDOWS\temp\Perflib_Perfdata_7a4.dat moved successfully.

Registry entries deleted on Reboot...

Log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:29, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe (file missing)

--
End of file - 7007 bytes

Problém furt existuje, je to pořád stejné :( Navíc jsem ve svém PC nenašla tyhle dvě složky, tudíž jsem je ani nemohla smazat:

C:\Documents and Settings\Jméno\Data aplikací\Mozilla
C:\Documents and Settings\Jméno\Local Settings\Data aplikací\Mozilla

Prosím o kontrolu log - nechtěné vyskakování oken Vyřešeno

Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Re: Prosím o kontrolu log - nechtěné vyskakování oken

Kdo je online