PC-HELP.CZ

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:01:14, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\QIP\qip.exe
H:\Program Files\QIP\qip.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - H:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - H:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPIEAddOn.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - H:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - H:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Uživatel Marie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - H:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - H:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe

--
End of file - 10355 bytes

Odinstaluj:
pdfforge Toolbar
ICQTOOLBAR
Crawler\Toolbar
Internet Saving Optimizer


Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Díky za radu! Všechno mi šlo, až na odinstalování ICQ Toolbar...nenašla jsem žádný soubor pro odinstalování, není ani v "Přidat nebo odebrat programy". V Program Files jsem měla složku ICQ Toolbar, tu jsem nadobro smazala...také tam nebyl soubor na odinstalaci.

Tady je záznam z Malwarebytes...

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3126
Windows 5.1.2600 Service Pack 2

8.11.2009 17:42:50
mbam-log-2009-11-08 (17-42-44).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 106150
Uplynulý čas: 6 minute(s), 20 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 2
Infikované klíče registru: 20
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované adresáře: 15
Infikované soubory: 32

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.

Infikované klíče registru:
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> No action taken.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
H:\Program Files\DoubleD (Adware.DoubleD) -> No action taken.
H:\Program Files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900 (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\Data (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960 (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF (Adware.DoubleD) -> No action taken.

Infikované soubory:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\hppx.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\MAHelper.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.dat (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\Data\config.md (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\install.rdf (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.dat (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.exe (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\eacore.mx (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx (Adware.DoubleD) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Update.exe (Trojan.Dropper) -> No action taken.
H:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> No action taken.
H:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4-1.doc (Trojan.Agent) -> No action taken.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4.doc (Trojan.Agent) -> No action taken.

Jinak teď jsem zkusila pustit internet přes Firefox - můj používaný prohlížeč a okna pořád vyskakují. Jedná se o různé reklamní nesmysly. Např. http://www.eazywin.net/cz/competitions/ ... vydC000000 ...atd. Zatím je to pořád stené...

Ještě se taky nic nesmazalo.

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochranu u Avastu.

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Posílám log z MbAM:

Malwarebytes' Anti-Malware 1.41
Verze databáze: 3126
Windows 5.1.2600 Service Pack 2

8.11.2009 18:17:30
mbam-log-2009-11-08 (18-17-30).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 106188
Uplynulý čas: 2 minute(s), 15 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 2
Infikované klíče registru: 20
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované adresáře: 15
Infikované soubory: 32

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.

Infikované klíče registru:
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
H:\Program Files\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900 (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\System Search Dispatcher (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960 (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované soubory:
H:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\hppx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\MAHelper.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\eacore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLDynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLStatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Update.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
H:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
H:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4-1.doc (Trojan.Agent) -> Quarantined and deleted successfully.
H:\Documents and Settings\Uživatel Marie\Local Settings\Temp\oprava cenik 4.doc (Trojan.Agent) -> Quarantined and deleted successfully.


Tady je Combo log:

ComboFix 09-11-07.04 - Uživatel Marie 08.11.2009 18:36.1.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.3071.2524 [GMT 1:00]
Spuštěný z: h:\documents and settings\Uživatel Marie\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091108-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
h:\windows\system32\ieuinit.inf
h:\windows\system32\nsprs.dll
h:\windows\system32\ssprs.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-10-08 do 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-08 16:32 . 2009-09-10 13:54 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 16:32 . 2009-11-08 16:32 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2009-11-08 16:32 . 2009-09-10 13:53 19160 ----a-w- h:\windows\system32\drivers\mbam.sys
2009-11-08 14:00 . 2009-11-08 14:00 -------- d-----w- h:\program files\Trend Micro
2009-11-02 14:31 . 2009-11-02 14:31 -------- d-----w- h:\program files\Common Files\BioWare
2009-11-02 14:28 . 2009-11-02 14:29 -------- d-----w- h:\program files\Dragon Age Origins Character Creator
2009-10-29 10:39 . 2009-10-29 10:39 -------- d-----w- h:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 10:51 . 2009-09-05 21:04 -------- d-----w- h:\program files\Bejeweled 2 Deluxe
2009-11-01 21:56 . 2008-11-29 18:46 411368 ----a-w- h:\windows\system32\deploytk.dll
2009-11-01 21:56 . 2007-10-13 08:24 -------- d-----w- h:\program files\Java
2009-10-25 10:04 . 2006-03-02 12:00 82206 ----a-w- h:\windows\system32\perfc005.dat
2009-10-25 10:04 . 2006-03-02 12:00 436144 ----a-w- h:\windows\system32\perfh005.dat
2009-10-12 07:00 . 2009-08-23 09:01 -------- d-----w- h:\program files\Sukoku
2009-09-15 10:59 . 2009-08-26 12:12 1279968 ----a-w- h:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2009-08-26 12:12 93424 ----a-w- h:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2009-08-26 12:12 94160 ----a-w- h:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2009-08-26 12:12 114768 ----a-w- h:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-08-26 12:12 20560 ----a-w- h:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2009-08-26 12:12 52368 ----a-w- h:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-08-26 12:12 23152 ----a-w- h:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-08-26 12:12 27408 ----a-w- h:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2009-08-26 12:12 97480 ----a-w- h:\windows\system32\AvastSS.scr
2009-09-05 21:39 . 2009-09-05 21:39 16 ----a-w- h:\windows\popcinfo.dat
2009-09-05 21:04 . 2009-09-05 21:04 720896 ----a-w- h:\windows\iun6002ev.exe
2009-09-05 19:34 . 2009-09-05 19:28 24 ----a-w- h:\windows\popcinfot.dat
2009-06-10 20:40 . 2009-06-10 20:40 80 --sh--r- h:\windows\system32\0E495E2732.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="h:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"DAEMON Tools"="h:\program files\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"Registry Cleaner"="h:\program files\Registry Cleaner Trial\Regclean.exe" [2006-05-25 4710400]
"Google Update"="h:\documents and settings\Uživatel Marie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-05-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"avast!"="h:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"SpywareTerminator"="h:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-10-02 1783808]
"SunJavaUpdateSched"="h:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 149280]
"Malwarebytes Anti-Malware (reboot)"="h:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

h:\documents and settings\U§ivatel Marie\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
MagicDisc.lnk - h:\program files\MagicDisc\MagicDisc.exe [2008-10-24 575488]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - h:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - h:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\ubi.com\\Core\\GS4.exe"=
"h:\\Program Files\\BitComet\\BitComet.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\CS\\Valve\\hl.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\FlatOut\\FlatOut2.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\fl2\\FlatOut2.exe"=
"h:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"h:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"h:\\Program Files\\FlightGear\\bin\\Win32\\fgfs.exe"=
"h:\\Program Files\\MultiProxy\\MProxy.exe"=
"h:\\Program Files\\Codemasters\\Overlord II\\Overlord2.exe"=
"h:\\Program Files\\Aquadelic GT\\Run.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\bin_ship\\DAOCharacterCreator.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\DAOriginsLauncher.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztracení\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztraceni´\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=

R1 aswSP;avast! Self Protection;h:\windows\system32\drivers\aswSP.sys [26.8.2009 13:12 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;h:\windows\system32\drivers\sp_rsdrv2.sys [30.9.2007 18:23 141312]
R2 aswFsBlk;aswFsBlk;h:\windows\system32\drivers\aswFsBlk.sys [26.8.2009 13:12 20560]
R3 3xHybrid;3xHybrid service;h:\windows\system32\drivers\3xHybrid.sys [22.3.2006 16:33 826752]
S2 RCService;RCService;h:\program files\gigabyte\RCService\RCService.exe [26.4.2006 7:47 538624]
S2 Sukoku Service;Sukoku Service;h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe [29.9.2009 9:23 54760]
S3 npggsvc;nProtect GameGuard Service;h:\windows\system32\GameMon.des -service --> h:\windows\system32\GameMon.des -service [?]
S3 tap0901_2gm;VPN Anonymizer Adapter;h:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Office Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddAllLink.htm
FF - ProfilePath - h:\documents and settings\Uživatel Marie\Data aplikací\Mozilla\Firefox\Profiles\l1htehqe.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|ht ... seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: h:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npCortona.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: h:\program files\Opera\program\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Bridge Building Game - h:\program files\Bridge Building Game\uninstall.exe
AddRemove-com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 - h:\program files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 18:41
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys >>UNKNOWN [0x8A4BF1E8]<<
kernel: MBR read successfully
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="h:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1343024091-2049760794-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:0e,68,c2,1d,fa,d0,7c,0e,b9,e3,f0,70,2c,b6,37,77,df,32,a6,46,97,
16,be,b8,7d,91,9e,a7,5e,0d,3b,0f,4d,78,c9,a8,19,00,54,a1,d7,b2,68,75,91,23,\
"rkeysecu"=hex:74,3f,65,d3,9d,f0,12,cd,ec,8f,d0,fb,60,6f,ba,e2
.
Celkový čas: 2009-11-08 18:42
ComboFix-quarantined-files.txt 2009-11-08 17:42

Před spuštěním: 7 147 896 832
Po spuštění: Volných bajtů: 11 016 818 688

- - End Of File - - F29E5089A6E016F62332E3D01BF326A1

Jinak nevyžádaná okna pořád vyskakují...

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Tak jsem vše provedla a jak jsem přetáhla požadovaný soubor na ComboFix, tak se to spustilo a během operace nastaly dva restarty PC, během toho jsem spozorovala, jak naskočila na dvě sekundy modrá obrazovka s nějakými nápisy o Windows atd. Nakonec nevyjel žádný nový log...nic. Tak Vám posílám alespoň výpis z HJT... P.S. Okna furt vyskakují (a ještě poznámka, co jsem nenapsala hned na začátku...ta okna vyskakují jen v prohlížeči Firefox)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25:10, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\WINDOWS\system32\wscntfy.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Uzˇivatel Marie\Local Settings\Data aplikaci´\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://H:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - H:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe (file missing)

--
End of file - 8075 bytes

Ten log by měl být zde:
H:\ComboFix.txt

a příslušné číslo


Na firefox:
Stáhni si GooredFix

a ulož si ho na plochu.Poklepej na něj .
Objeví se hláška ,dej YES
Otevře se log , zkopíruj sem celý jeho obsah ( jinak ho najdeš na své ploše pod názvem Goored.txt).

Stáhni si :Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit, smazat, přesunout nebo přejmenovat


Zkus potom normálně spustit ještě jednou Combofix (bez scriptu),a vlož sem z něho opět log.

Zasílám výpis z GooredFix:


GooredFix by jpshortstuff (24.09.09.1)
Log created at 20:53 on 08/11/2009 (Uživatel Marie)
Firefox version 3.5.5 (cs)

========== GooredScan ==========


========== GooredLog ==========

H:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [20:57 01/11/2009]
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [08:24 13/10/2007]
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [04:46 29/04/2008]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [21:56 01/11/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"jqs@sun.com"="H:\Program Files\Java\jre6\lib\deploy\jqs\ff" [21:56 01/11/2009]

-=E.O.F=-




Výpis z ComboFix:


ComboFix 09-11-07.04 - Uživatel Marie 08.11.2009 21:20.3.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.3071.2222 [GMT 1:00]
Spuštěný z: h:\documents and settings\Uživatel Marie\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091108-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
.
---- Předchozí spuštění -------
.
h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080404_2139.reg
h:\documents and settings\U§ivatel Marie\Dokumenty\cc_20080915_093409.reg
h:\program files\Sukoku\sukoku.exe
h:\program files\Sukoku\uninstall.exe
h:\windows\iun6002ev.exe
h:\windows\popcinfot.dat
h:\windows\system32\0E495E2732.dll
h:\windows\system32\GameMon.des

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-10-08 do 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-08 16:32 . 2009-09-10 13:54 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 16:32 . 2009-11-08 16:32 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2009-11-08 16:32 . 2009-09-10 13:53 19160 ----a-w- h:\windows\system32\drivers\mbam.sys
2009-11-08 14:00 . 2009-11-08 14:00 -------- d-----w- h:\program files\Trend Micro
2009-11-02 14:31 . 2009-11-02 14:31 -------- d-----w- h:\program files\Common Files\BioWare
2009-11-02 14:28 . 2009-11-02 14:29 -------- d-----w- h:\program files\Dragon Age Origins Character Creator
2009-10-29 10:39 . 2009-10-29 10:39 -------- d-----w- h:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 10:51 . 2009-09-05 21:04 -------- d-----w- h:\program files\Bejeweled 2 Deluxe
2009-11-01 21:56 . 2008-11-29 18:46 411368 ----a-w- h:\windows\system32\deploytk.dll
2009-11-01 21:56 . 2007-10-13 08:24 -------- d-----w- h:\program files\Java
2009-10-25 10:04 . 2006-03-02 12:00 82206 ----a-w- h:\windows\system32\perfc005.dat
2009-10-25 10:04 . 2006-03-02 12:00 436144 ----a-w- h:\windows\system32\perfh005.dat
2009-09-15 10:59 . 2009-08-26 12:12 1279968 ----a-w- h:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2009-08-26 12:12 93424 ----a-w- h:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2009-08-26 12:12 94160 ----a-w- h:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2009-08-26 12:12 114768 ----a-w- h:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-08-26 12:12 20560 ----a-w- h:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2009-08-26 12:12 52368 ----a-w- h:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-08-26 12:12 23152 ----a-w- h:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-08-26 12:12 27408 ----a-w- h:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2009-08-26 12:12 97480 ----a-w- h:\windows\system32\AvastSS.scr
2009-09-05 21:39 . 2009-09-05 21:39 16 ----a-w- h:\windows\popcinfo.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-11-08_17.41.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-08 19:16 . 2009-11-08 19:16 16384 h:\windows\Temp\Perflib_Perfdata_7a4.dat
+ 2009-11-08 19:16 . 2009-11-08 19:16 16384 h:\windows\Temp\Perflib_Perfdata_48c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="h:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"DAEMON Tools"="h:\program files\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"Registry Cleaner"="h:\program files\Registry Cleaner Trial\Regclean.exe" [2006-05-25 4710400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"avast!"="h:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"SpywareTerminator"="h:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-10-02 1783808]
"SunJavaUpdateSched"="h:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 149280]
"Malwarebytes Anti-Malware (reboot)"="h:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

h:\documents and settings\U§ivatel Marie\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - h:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
MagicDisc.lnk - h:\program files\MagicDisc\MagicDisc.exe [2008-10-24 575488]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - h:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - h:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"h:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\ubi.com\\Core\\GS4.exe"=
"h:\\Program Files\\BitComet\\BitComet.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\CS\\Valve\\hl.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\FlatOut\\FlatOut2.exe"=
"h:\\Documents and Settings\\Uživatel Marie\\Plocha\\fl2\\FlatOut2.exe"=
"h:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"h:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"h:\\Program Files\\FlightGear\\bin\\Win32\\fgfs.exe"=
"h:\\Program Files\\MultiProxy\\MProxy.exe"=
"h:\\Program Files\\Codemasters\\Overlord II\\Overlord2.exe"=
"h:\\Program Files\\Aquadelic GT\\Run.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\bin_ship\\DAOCharacterCreator.exe"=
"h:\\Program Files\\Dragon Age Origins Character Creator\\DAOriginsLauncher.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztracení\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=
"h:\\Program Files\\QIP\\Users\\268747965\\RcvdFiles\\249223773_Dodo\\ztraceni´\\Lost_2008--Upload--By--Standovka\\Lost 2008\\Yeti_Final_Win32.exe"=

R1 aswSP;avast! Self Protection;h:\windows\system32\drivers\aswSP.sys [26.8.2009 13:12 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;h:\windows\system32\drivers\sp_rsdrv2.sys [30.9.2007 18:23 141312]
R2 aswFsBlk;aswFsBlk;h:\windows\system32\drivers\aswFsBlk.sys [26.8.2009 13:12 20560]
R3 3xHybrid;3xHybrid service;h:\windows\system32\drivers\3xHybrid.sys [22.3.2006 16:33 826752]
S2 RCService;RCService;h:\program files\gigabyte\RCService\RCService.exe [26.4.2006 7:47 538624]
S2 Sukoku Service;Sukoku Service;"h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe" "h:\program files\Sukoku\sukoku.dll" Service --> h:\documents and settings\All Users\Data aplikací\Sukoku\sukoku119.exe [?]
S3 tap0901_2gm;VPN Anonymizer Adapter;h:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - DwShield000054D3
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Office Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - h:\program files\BitComet\BitComet.exe/AddAllLink.htm
FF - ProfilePath - h:\documents and settings\Uživatel Marie\Data aplikací\Mozilla\Firefox\Profiles\l1htehqe.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|ht ... seznam.cz/
FF - plugin: h:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npCortona.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: h:\program files\Opera\program\plugins\nppopcaploader.dll
FF - plugin: h:\program files\Opera\program\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Google Update - h:\documents and settings\Uzˇivatel Marie\Local Settings\Data aplikaci´\Google\Update\GoogleUpdate.exe
AddRemove-Sukoku - h:\program files\Sukoku\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 21:25
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys >>UNKNOWN [0x8A44E1E8]<<
kernel: MBR read successfully
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1343024091-2049760794-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:0e,68,c2,1d,fa,d0,7c,0e,b9,e3,f0,70,2c,b6,37,77,df,32,a6,46,97,
16,be,b8,7d,91,9e,a7,5e,0d,3b,0f,4d,78,c9,a8,19,00,54,a1,d7,b2,68,75,91,23,\
"rkeysecu"=hex:74,3f,65,d3,9d,f0,12,cd,ec,8f,d0,fb,60,6f,ba,e2
.
Celkový čas: 2009-11-08 21:33
ComboFix-quarantined-files.txt 2009-11-08 20:33
ComboFix2.txt 2009-11-08 17:42

Před spuštěním: Volných bajtů: 10 988 601 344
Po spuštění: Volných bajtů: 10 954 526 720

- - End Of File - - 2FC745A92D56618FC300A1147B4DA1F2



P.S. Zkusila jsem ten antivir Dr.Web a nenašlo to u mě žádný vir...

Stáhni si program OTM (by OldTimer)
http://www.edisk.cz/stahni/07995/OTMove ... .39KB.html
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE

- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast či Aviru, následně T-Cleaner smaž a zapni si AVG , Avast, Aviru.


Vlož ještě nový log z HJT.

Pokud budou ještě problémy s FF, zazálohuj si záložky FF a odinstaluj FF.
Najdi a smaž:
C:\Program Files\Mozilla Firefox
C:\Documents and Settings\Jméno\Data aplikací\Mozilla
C:\Documents and Settings\Jméno\Local Settings\Data aplikací\Mozilla

Stáhni si znovu FF , nainstaluj znovu. Pak by již problémy neměli být.

Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích...tady to je:


All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
h:\windows\popcinfo.dat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65536 bytes
File delete failed. H:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. H:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: Uživatel Marie

User: Uživatel Marie
->Temp folder emptied: 18353 bytes
->Temporary Internet Files folder emptied: 137852 bytes
->Java cache emptied: 33449689 bytes
->FireFox cache emptied: 51801658 bytes
->Google Chrome cache emptied: 7213136 bytes
->Opera cache emptied: 51497802 bytes

%systemdrive% .tmp files removed: 0 bytes
H:\WINDOWS\msdownld.tmp folder deleted successfully.
H:\WINDOWS\NV22242184.TMP folder deleted successfully.
H:\WINDOWS\NV29202080.TMP folder deleted successfully.
H:\WINDOWS\NV32123216.TMP folder deleted successfully.
%systemroot% .tmp files removed: 45333359 bytes
%systemroot%\System32 .tmp files removed: 4393472 bytes
File delete failed. H:\WINDOWS\temp\Perflib_Perfdata_7a4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 185,01 mb


OTM by OldTimer - Version 3.0.0.6 log created on 11082009_221400

Files moved on Reboot...
H:\WINDOWS\temp\Perflib_Perfdata_7a4.dat moved successfully.

Registry entries deleted on Reboot...




Log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:29, on 8.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\Program Files\MagicDisc\MagicDisc.exe
H:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\gigabyte\RCService\RCService.exe
H:\Program Files\Spyware Terminator\sp_rsser.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Registry Cleaner] "H:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = H:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Registration IL-2 Sturmovik 1946.LNK = H:\Program Files\Ubisoft\IL-2 Sturmovik 1946\RegistrationReminder.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = H:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - H:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - H:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - H:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RCService - Unknown owner - H:\Program Files\gigabyte\RCService\RCService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Sukoku Service - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Sukoku\sukoku119.exe (file missing)

--
End of file - 7007 bytes



Problém furt existuje, je to pořád stejné :( Navíc jsem ve svém PC nenašla tyhle dvě složky, tudíž jsem je ani nemohla smazat:

C:\Documents and Settings\Jméno\Data aplikací\Mozilla
C:\Documents and Settings\Jméno\Local Settings\Data aplikací\Mozilla