PC-HELP.CZ

Zdravím, mám problém s notebookem a internetem. Nějakým způsobem se mi do notebooku dostalo pár trojanů ... nějaké jsem smazal, ale od té doby blbe net a celkově operační systém. Prosím o kontrolu ...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:09:50, on 24.1.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Toshiba Online Product Information\TOPI.exe
C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\ESET\nod32kui.exe
C:\Windows\System32\WTMKM.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Miranda IM\miranda32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [HDMICtrlMan] C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Notebook Performance Tuning Service (TempoMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WTService - Unknown owner - C:\Windows\system32\atwtusb.exe

--
End of file - 7676 bytes

Odinstaluj si Ask.com (Ask Toolbar).

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2348
Windows 6.0.6001 Service Pack 1

24.1.2010 16:35:12
mbam-log-2010-01-24 (16-35-12).txt

Typ skenu: Rychlý sken
Objektu skenováno: 82942
Uplynulý cas: 4 minute(s), 6 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Stáhnul jsem, spustil, proběhlo to, začalo to mazat, pak to skončilo na nový řádek (v tom modrém okně), pak se obrazovka rozmazala a nic nefungovalo, musel jsem notebook vypnout. Zkusil to znovu, každá fáze v pohodě, nakonci to skočilo (nestihnul jsem to přečíst), že nemám zapínat nové aplikace nebo co a zase se to rozmazalo a musel jsem to vypnout. Teď jak byla složka na C:/ComboFix a v ní další složky, změnila se celá složka, nějakým způsobem a když na to kliknu dostanu se na Tento Počítač. Takže vůbec nvm co s tím ?!? Asi udělám komplet reinstal

Podívej, jestli není v log C:\ComboFix.txt . Složka "Tento počítač" od ComboFixu půjde normálně otevřít, znamená to, že neprovedl kompletní sken.

Log není, vůbec ... zkoušel jsem to už 2x ten sken a vždy tak samo, rozmaže se to a konec ...

Restaruj PC a vypni kompletně AV (i všechny jeho služby), podle toho jak to popisuješ, tak asi ESET brání práci Combofixu.

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Pokud ti nepůjde tak najdi a smaž:
C:\327882R2FWJFW
C:\ComboFix
C:\Qoobox
C:\Combofix.txt
a Combofix.exe
Pak si stáhni OTCleanIt.
- Připoj se k internetu a dvojklikem spusť program
- Klikni na tlačítko CleanUp
- Po dokončení povol restart PC
- Po restartu tento nástroj smaž - není určen pro běžné používání

Stáhni si T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG, Aviru.)

Pak si podle návodu stáhni Nový ComBofix a udělej log.

ComboFix 10-01-23.06 - RedFish 24.01.2010 19:32:06.8.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.3069.1938 [GMT 1:00]
Spuštěný z: c:\users\RedFish\Desktop\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-24 do 2010-01-24 )))))))))))))))))))))))))))))))
.

2010-01-24 18:37 . 2010-01-24 18:37 -------- d-----w- c:\users\RedFish\AppData\Local\temp
2010-01-24 18:37 . 2010-01-24 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-23 13:03 . 2010-01-23 14:13 -------- d-----w- c:\users\RedFish\AppData\Local\Adobe
2010-01-23 12:32 . 2010-01-23 12:32 -------- d-----w- c:\users\RedFish\AppData\Local\ATI
2010-01-23 11:02 . 2010-01-23 11:02 -------- d-----w- c:\users\RedFish\AppData\Roaming\GlarySoft
2010-01-23 10:57 . 2010-01-23 10:57 -------- d-----w- c:\program files\Glary Utilities
2010-01-20 13:16 . 2010-01-20 15:34 -------- d-----w- c:\programdata\NexonEU
2010-01-20 13:16 . 2010-01-20 13:16 98304 ----a-w- c:\programdata\NexonEU\NGM\nxgameeu.dll
2010-01-20 13:16 . 2010-01-20 13:16 81920 ----a-w- c:\programdata\NexonEU\NGM\npNxGameeu.dll
2010-01-20 13:16 . 2010-01-20 13:16 532480 ----a-w- c:\programdata\NexonEU\NGM\NGMDll.dll
2010-01-20 13:16 . 2010-01-20 13:16 331776 ----a-w- c:\programdata\NexonEU\NGM\NGMResource.dll
2010-01-20 13:16 . 2010-01-20 13:16 258352 ----a-w- c:\programdata\NexonEU\NGM\unicows.dll
2010-01-20 13:16 . 2010-01-20 13:16 155648 ----a-w- c:\programdata\NexonEU\NGM\NGM.exe
2010-01-20 11:14 . 2010-01-20 11:14 90112 ----a-w- c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-01-20 11:14 . 2010-01-20 11:14 561152 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
2010-01-20 11:14 . 2010-01-20 11:14 393216 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
2010-01-20 11:14 . 2010-01-20 11:14 258352 ----a-w- c:\programdata\NexonUS\NGM\unicows.dll
2010-01-20 11:14 . 2010-01-20 11:14 167936 ----a-w- c:\programdata\NexonUS\NGM\NGM.exe
2010-01-20 11:14 . 2010-01-20 11:14 118784 ----a-w- c:\programdata\NexonUS\NGM\nxgameus.dll
2010-01-20 11:14 . 2010-01-20 11:14 -------- d-----w- c:\programdata\NexonUS
2010-01-20 10:30 . 2010-01-24 18:37 -------- d-----w- c:\users\RedFish\AppData\Local\PMB Files
2010-01-20 10:30 . 2010-01-20 10:31 -------- d-----w- c:\programdata\PMB Files
2010-01-20 10:30 . 2010-01-20 10:30 -------- d-----w- c:\program files\Pando Networks
2010-01-19 13:45 . 2010-01-19 13:45 78227613 ----a-w- C:\ZEL.zip
2010-01-18 12:44 . 2010-01-18 12:44 -------- d-----w- c:\programdata\Solidshield
2010-01-18 12:28 . 2010-01-18 12:28 -------- d-----w- c:\program files\Ubisoft
2010-01-18 09:11 . 2009-10-08 09:31 3204096 ----a-w- c:\users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll
2010-01-18 09:11 . 2009-10-07 17:06 106496 ----a-w- c:\users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll
2010-01-18 09:11 . 2009-09-23 20:29 28672 ----a-w- c:\users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
2010-01-18 09:11 . 2009-03-19 22:57 40960 ----a-w- c:\users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe
2010-01-17 19:08 . 2010-01-17 19:08 -------- d-----w- c:\users\RedFish\temp
2010-01-13 09:07 . 2009-10-19 14:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 09:07 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-01-05 13:17 . 2010-01-05 13:17 -------- d-----w- c:\program files\Free Notes & Office Ink
2010-01-05 10:05 . 2010-01-05 10:05 -------- d-----w- c:\users\RedFish\AppData\Roaming\Ulead Systems
2010-01-05 10:04 . 2010-01-05 10:04 -------- d-----w- c:\programdata\InstallShield
2010-01-05 09:59 . 2006-07-22 18:37 49152 ------w- c:\windows\system32\INETWH32.dll
2010-01-05 09:59 . 1999-10-15 11:50 1056768 ------w- c:\windows\system32\ROBOEX32.DLL
2010-01-05 09:25 . 2009-03-08 11:15 6144 ----a-w- c:\windows\system32\drivers\moufiltr.sys
2009-12-30 18:20 . 2009-12-30 18:20 -------- d-----w- c:\users\RedFish\AppData\Roaming\Smart PDF Converter Pro
2009-12-30 17:52 . 2009-12-30 17:54 -------- d-----w- c:\program files\ABC Amber PDF Converter
2009-12-30 17:49 . 2009-12-30 17:52 -------- d-----w- c:\program files\Free PDF to Word Converter
2009-12-30 17:41 . 2009-12-30 17:41 -------- d-----w- c:\users\RedFish\AppData\Roaming\Smart PDF Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-24 18:23 . 2008-08-11 13:16 116456 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-24 18:08 . 2009-06-09 22:09 -------- d-----w- c:\users\RedFish\AppData\Roaming\Skype
2010-01-24 17:44 . 2009-10-23 10:34 -------- d-----w- c:\program files\Garena
2010-01-24 17:23 . 2009-06-09 22:12 -------- d-----w- c:\users\RedFish\AppData\Roaming\skypePM
2010-01-23 12:55 . 2009-12-10 12:47 -------- d-----w- c:\users\RedFish\AppData\Roaming\vlc
2010-01-23 12:34 . 2009-12-11 14:06 -------- d-----w- c:\users\RedFish\AppData\Roaming\dvdcss
2010-01-23 08:59 . 2009-11-08 10:06 -------- dc-h--w- c:\programdata\{67C33A62-5B1D-43D1-9600-16006F36EB2B}
2010-01-21 18:01 . 2009-08-01 09:28 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-19 13:41 . 2008-01-21 06:46 648794 ----a-w- c:\windows\system32\perfh005.dat
2010-01-19 13:41 . 2008-01-21 06:46 133824 ----a-w- c:\windows\system32\perfc005.dat
2010-01-18 12:28 . 2008-07-16 16:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-17 15:02 . 2009-07-13 14:36 -------- d-----w- c:\users\RedFish\AppData\Roaming\HLSW
2010-01-14 20:35 . 2009-08-20 08:28 -------- d-----w- c:\program files\ICQ6.5
2010-01-14 17:50 . 2009-06-24 18:51 -------- d-----w- c:\program files\PowerArchiver
2010-01-14 12:06 . 2009-06-10 08:29 -------- d-----w- c:\users\RedFish\AppData\Roaming\uTorrent
2010-01-14 10:12 . 2009-10-03 07:58 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-14 09:05 . 2008-07-16 17:22 -------- d-----w- c:\programdata\Microsoft Help
2010-01-14 09:05 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-05 09:59 . 2008-07-16 17:07 -------- d-----w- c:\programdata\Ulead Systems
2010-01-05 09:59 . 2008-07-16 17:07 -------- d-----w- c:\program files\Ulead Systems
2010-01-05 09:59 . 2008-07-16 17:07 -------- d-----w- c:\program files\Common Files\Ulead Systems
2010-01-05 09:59 . 2008-07-16 16:44 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-05 09:39 . 2010-01-05 09:23 -------- d-----w- c:\programdata\Tablet
2010-01-02 06:38 . 2010-01-22 08:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 08:49 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 08:49 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 08:49 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-01-01 20:18 . 2009-06-10 08:34 -------- d-----w- c:\users\RedFish\AppData\Roaming\Hamachi
2009-12-31 17:12 . 2009-07-02 18:05 -------- d-----w- c:\program files\Activision
2009-12-27 12:24 . 2009-06-10 08:28 -------- d-----w- c:\users\RedFish\AppData\Roaming\XnView
2009-12-26 11:56 . 2009-11-22 11:42 -------- d-----w- c:\program files\Lineage
2009-12-10 12:46 . 2009-12-10 12:46 -------- d-----w- c:\program files\VideoLAN
2009-12-08 18:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2009-12-07 16:32 . 2009-11-22 19:27 -------- d-----w- c:\users\RedFish\AppData\Roaming\Nero
2009-12-04 19:02 . 2009-12-04 19:02 -------- d-----w- c:\program files\Common Files\Skype
2009-12-04 19:02 . 2009-06-09 22:09 -------- d-----r- c:\program files\Skype
2009-12-04 19:02 . 2009-06-09 22:09 -------- d-----w- c:\programdata\Skype
2009-12-04 10:25 . 2009-07-25 22:35 -------- d-----w- c:\programdata\Media Center Programs
2009-11-30 17:02 . 2009-11-30 17:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 17:02 . 2009-11-30 17:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-29 13:58 . 2009-11-29 13:58 -------- d-----w- c:\programdata\Adobe Systems
2009-11-29 13:57 . 2009-11-29 13:52 -------- d-----w- c:\program files\Adobe Photoshop CS2
2009-11-29 13:56 . 2008-07-16 17:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-29 13:55 . 2009-11-29 13:55 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared
2009-11-26 11:10 . 2009-11-26 11:10 -------- d-----w- c:\users\RedFish\AppData\Roaming\SmartDraw
2009-11-26 11:10 . 2009-11-26 11:08 -------- d-----w- c:\program files\SmartDraw 2010
2009-11-26 11:04 . 2009-11-26 11:04 -------- d-----w- c:\program files\MeeSoft
2009-11-20 13:22 . 2009-06-10 08:54 737280 ----a-w- c:\windows\iun6002.exe
2009-11-09 13:22 . 2009-12-10 07:55 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 13:20 . 2009-12-10 07:55 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 11:04 . 2009-12-10 07:55 411136 ----a-w- c:\windows\system32\drivers\http.sys
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-10-31 08:50 . 2009-06-09 17:42 8224 ----a-w- c:\users\RedFish\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-30 07:24 . 2009-10-28 15:47 1680064 ----a-w- c:\programdata\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll
2009-10-30 07:18 . 2009-10-28 15:47 18368 ----a-w- c:\programdata\Microsoft\VSA\9.0\1033\ResourceCache.dll
2009-10-29 09:41 . 2009-11-26 07:35 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-28 15:33 . 2009-10-28 15:33 416 ----a-w- c:\programdata\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-01-20 2937528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
"NDSTray.exe"="NDSTray.exe" [BU]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-09-26 417792]
"HDMICtrlMan"="c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-06-19 949376]
"MacrokeyManager"="WTMKM.exe" [2009-04-22 3161760]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2006-11-29 90112]

c:\users\RedFish\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R1 nod32drv;nod32drv;c:\windows\System32\drivers\nod32drv.sys [19.6.2009 14:31 15424]
R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [16.4.2008 23:19 40960]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [24.4.2008 9:21 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [3.12.2007 16:03 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [16.7.2008 18:03 7168]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17.11.2008 14:40 3668480]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [25.8.2008 8:58 77824]
S2 WTService;WTService;c:\windows\system32\atwtusb.exe -s --> c:\windows\system32\atwtusb.exe -s [?]
S3 GarenaPEngine;GarenaPEngine;c:\users\RedFish\AppData\Local\temp\INW47AA.tmp [24.1.2010 18:44 25616]
S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [10.6.2009 9:39 721904]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-23 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-23 22:01]

2009-11-27 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-11-26 16:21]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain ... bmod=TSEA;
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-24 19:37
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\RedFish\AppData\Local\Temp\INW47AA.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1311360706-466973743-1341764523-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:21,f5,b3,74,22,28,47,5c,bb,5c,95,40,4d,1a,dd,29,fc,f8,d9,99,b3,54,9a,
d9,f3,ed,5c,a8,a7,f4,79,a3,45,3c,58,cf,31,35,54,89,41,e8,d2,78,b7,da,dc,dd,\
"??"=hex:43,f2,5d,65,60,69,d7,a0,f9,06,04,47,bb,d5,98,cc

[HKEY_USERS\S-1-5-21-1311360706-466973743-1341764523-1000\Software\SecuROM\License information*]
"datasecu"=hex:1c,e5,a2,07,e2,1a,89,b1,e1,60,cf,6f,57,01,3c,94,49,3c,29,a5,15,
ac,c0,68,9c,ff,46,99,c5,8c,78,cf,02,87,e0,f6,e2,07,82,69,0a,84,09,82,8f,5a,\
"rkeysecu"=hex:85,a1,a4,85,58,ed,b0,d1,63,3c,ba,14,b8,23,8d,3d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Celkový čas: 2010-01-24 19:39:28
ComboFix-quarantined-files.txt 2010-01-24 18:39

Před spuštěním: Volných bajtů: 39 933 992 960
Po spuštění: Volných bajtů: 39 916 363 776

- - End Of File - - FB9A99677B987359350AEA321017166B

No vidíš, Defender se také vypíná.
Sobor C:\ZEL.zip znáš?

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\users\RedFish\AppData\Local\temp\INW47AA.tmp

Folder::
C:\Program Files\Ask.com

Driver::
GarenaPEngine;GarenaPEngine
GarenaPEngine

Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\GarenaPEngine]



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu a popiš chování PC.

Sobor C:\ZEL.zip znáš?

Ano, Základy Elektrotechniky (obsahuje naskenované obrázky) ... hned sem hodim ten log

ComboFix 10-01-23.06 - RedFish 24.01.2010 20:26:29.9.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.3069.1877 [GMT 1:00]
Spuštěný z: C:\Users\RedFish\Desktop\ComboFix.exe
Použité ovládací přepínače :: C:\Users\RedFish\Desktop\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\RedFish\AppData\Local\temp\INW47AA.tmp"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GARENAPENGINE


((((((((((((((((((((((((( Soubory vytvořené od 2009-12-24 do 2010-01-24 )))))))))))))))))))))))))))))))
.

2010-01-24 19:31:29 . 2010-01-24 19:35:01 -------- d-----w- C:\Users\RedFish\AppData\Local\temp
2010-01-24 19:31:29 . 2010-01-24 19:31:29 -------- d-----w- C:\Users\Public\AppData\Local\temp
2010-01-23 13:03:20 . 2010-01-23 14:13:27 -------- d-----w- C:\Users\RedFish\AppData\Local\Adobe
2010-01-23 12:32:44 . 2010-01-23 12:32:44 -------- d-----w- C:\Users\RedFish\AppData\Local\ATI
2010-01-23 11:02:43 . 2010-01-23 11:02:43 -------- d-----w- C:\Users\RedFish\AppData\Roaming\GlarySoft
2010-01-23 10:57:21 . 2010-01-23 10:57:43 -------- d-----w- C:\Program Files\Glary Utilities
2010-01-20 13:16:24 . 2010-01-20 15:34:04 -------- d-----w- C:\ProgramData\NexonEU
2010-01-20 11:14:49 . 2010-01-20 11:14:49 -------- d-----w- C:\ProgramData\NexonUS
2010-01-20 10:30:54 . 2010-01-24 18:53:44 -------- d-----w- C:\Users\RedFish\AppData\Local\PMB Files
2010-01-20 10:30:53 . 2010-01-20 10:31:20 -------- d-----w- C:\ProgramData\PMB Files
2010-01-20 10:30:34 . 2010-01-20 10:30:34 -------- d-----w- C:\Program Files\Pando Networks
2010-01-19 13:45:34 . 2010-01-19 13:45:42 78227613 ----a-w- C:\ZEL.zip
2010-01-18 12:44:47 . 2010-01-18 12:44:47 -------- d-----w- C:\ProgramData\Solidshield
2010-01-18 12:28:44 . 2010-01-18 12:28:44 -------- d-----w- C:\Program Files\Ubisoft
2010-01-17 19:08:12 . 2010-01-17 19:08:12 -------- d-----w- C:\Users\RedFish\temp
2010-01-13 09:07:04 . 2009-10-19 14:27:37 156672 ----a-w- C:\Windows\system32\t2embed.dll
2010-01-13 09:07:04 . 2009-10-19 14:24:00 72704 ----a-w- C:\Windows\system32\fontsub.dll
2010-01-05 13:17:20 . 2010-01-05 13:17:27 -------- d-----w- C:\Program Files\Free Notes & Office Ink
2010-01-05 10:05:00 . 2010-01-05 10:05:00 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Ulead Systems
2010-01-05 10:04:33 . 2010-01-05 10:04:33 -------- d-----w- C:\ProgramData\InstallShield
2010-01-05 09:59:36 . 2006-07-22 18:37:54 49152 ------w- C:\Windows\system32\INETWH32.dll
2010-01-05 09:59:36 . 1999-10-15 11:50:10 1056768 ------w- C:\Windows\system32\ROBOEX32.DLL
2010-01-05 09:25:02 . 2009-03-08 11:15:14 6144 ----a-w- C:\Windows\system32\drivers\moufiltr.sys
2009-12-30 18:20:26 . 2009-12-30 18:20:27 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Smart PDF Converter Pro
2009-12-30 17:52:00 . 2009-12-30 17:54:19 -------- d-----w- C:\Program Files\ABC Amber PDF Converter
2009-12-30 17:49:39 . 2009-12-30 17:52:38 -------- d-----w- C:\Program Files\Free PDF to Word Converter
2009-12-30 17:41:17 . 2009-12-30 17:41:19 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Smart PDF Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-24 18:23:13 . 2008-08-11 13:16:35 116456 ----a-w- C:\Windows\system32\GDIPFONTCACHEV1.DAT
2010-01-24 18:08:12 . 2009-06-09 22:09:33 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Skype
2010-01-24 17:44:29 . 2009-10-23 10:34:36 -------- d-----w- C:\Program Files\Garena
2010-01-24 17:23:38 . 2009-06-09 22:12:28 -------- d-----w- C:\Users\RedFish\AppData\Roaming\skypePM
2010-01-23 12:55:39 . 2009-12-10 12:47:00 -------- d-----w- C:\Users\RedFish\AppData\Roaming\vlc
2010-01-23 12:34:16 . 2009-12-11 14:06:22 -------- d-----w- C:\Users\RedFish\AppData\Roaming\dvdcss
2010-01-23 08:59:55 . 2009-11-08 10:06:30 -------- dc-h--w- C:\ProgramData\{67C33A62-5B1D-43D1-9600-16006F36EB2B}
2010-01-21 18:01:33 . 2009-08-01 09:28:44 -------- d-----w- C:\Program Files\Microsoft Silverlight
2010-01-20 13:16:24 . 2010-01-20 13:16:24 98304 ----a-w- C:\ProgramData\NexonEU\NGM\nxgameeu.dll
2010-01-20 13:16:24 . 2010-01-20 13:16:24 81920 ----a-w- C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
2010-01-20 13:16:24 . 2010-01-20 13:16:24 532480 ----a-w- C:\ProgramData\NexonEU\NGM\NGMDll.dll
2010-01-20 13:16:24 . 2010-01-20 13:16:24 331776 ----a-w- C:\ProgramData\NexonEU\NGM\NGMResource.dll
2010-01-20 13:16:24 . 2010-01-20 13:16:24 258352 ----a-w- C:\ProgramData\NexonEU\NGM\unicows.dll
2010-01-20 13:16:24 . 2010-01-20 13:16:24 155648 ----a-w- C:\ProgramData\NexonEU\NGM\NGM.exe
2010-01-20 11:14:49 . 2010-01-20 11:14:49 90112 ----a-w- C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
2010-01-20 11:14:49 . 2010-01-20 11:14:49 561152 ----a-w- C:\ProgramData\NexonUS\NGM\NGMDll.dll
2010-01-20 11:14:49 . 2010-01-20 11:14:49 393216 ----a-w- C:\ProgramData\NexonUS\NGM\NGMResource.dll
2010-01-20 11:14:49 . 2010-01-20 11:14:49 258352 ----a-w- C:\ProgramData\NexonUS\NGM\unicows.dll
2010-01-20 11:14:49 . 2010-01-20 11:14:49 167936 ----a-w- C:\ProgramData\NexonUS\NGM\NGM.exe
2010-01-20 11:14:49 . 2010-01-20 11:14:49 118784 ----a-w- C:\ProgramData\NexonUS\NGM\nxgameus.dll
2010-01-19 13:41:10 . 2008-01-21 06:46:38 648794 ----a-w- C:\Windows\system32\perfh005.dat
2010-01-19 13:41:10 . 2008-01-21 06:46:38 133824 ----a-w- C:\Windows\system32\perfc005.dat
2010-01-18 12:28:34 . 2008-07-16 16:45:00 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-01-17 15:02:23 . 2009-07-13 14:36:57 -------- d-----w- C:\Users\RedFish\AppData\Roaming\HLSW
2010-01-14 20:35:14 . 2009-08-20 08:28:15 -------- d-----w- C:\Program Files\ICQ6.5
2010-01-14 17:50:51 . 2009-06-24 18:51:27 -------- d-----w- C:\Program Files\PowerArchiver
2010-01-14 12:06:26 . 2009-06-10 08:29:47 -------- d-----w- C:\Users\RedFish\AppData\Roaming\uTorrent
2010-01-14 10:12:06 . 2009-10-03 07:58:33 181120 ------w- C:\Windows\system32\MpSigStub.exe
2010-01-14 09:05:46 . 2008-07-16 17:22:56 -------- d-----w- C:\ProgramData\Microsoft Help
2010-01-14 09:05:14 . 2006-11-02 11:18:33 -------- d-----w- C:\Program Files\Windows Mail
2010-01-05 09:59:33 . 2008-07-16 17:07:36 -------- d-----w- C:\ProgramData\Ulead Systems
2010-01-05 09:59:33 . 2008-07-16 17:07:36 -------- d-----w- C:\Program Files\Ulead Systems
2010-01-05 09:59:33 . 2008-07-16 17:07:36 -------- d-----w- C:\Program Files\Common Files\Ulead Systems
2010-01-05 09:59:31 . 2008-07-16 16:44:34 -------- d-----w- C:\Program Files\Common Files\InstallShield
2010-01-05 09:39:16 . 2010-01-05 09:23:10 -------- d-----w- C:\ProgramData\Tablet
2010-01-02 06:38:20 . 2010-01-22 08:49:52 916480 ----a-w- C:\Windows\system32\wininet.dll
2010-01-02 06:32:33 . 2010-01-22 08:49:50 71680 ----a-w- C:\Windows\system32\iesetup.dll
2010-01-02 06:32:33 . 2010-01-22 08:49:50 109056 ----a-w- C:\Windows\system32\iesysprep.dll
2010-01-02 04:57:00 . 2010-01-22 08:49:50 133632 ----a-w- C:\Windows\system32\ieUnatt.exe
2010-01-01 20:18:19 . 2009-06-10 08:34:33 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Hamachi
2009-12-31 17:12:20 . 2009-07-02 18:05:31 -------- d-----w- C:\Program Files\Activision
2009-12-27 12:24:43 . 2009-06-10 08:28:41 -------- d-----w- C:\Users\RedFish\AppData\Roaming\XnView
2009-12-26 11:56:55 . 2009-11-22 11:42:14 -------- d-----w- C:\Program Files\Lineage
2009-12-10 12:46:22 . 2009-12-10 12:46:22 -------- d-----w- C:\Program Files\VideoLAN
2009-12-08 18:40:27 . 2006-11-02 12:37:34 -------- d-----w- C:\Program Files\Microsoft Games
2009-12-07 16:32:17 . 2009-11-22 19:27:38 -------- d-----w- C:\Users\RedFish\AppData\Roaming\Nero
2009-12-04 19:02:32 . 2009-12-04 19:02:32 -------- d-----w- C:\Program Files\Common Files\Skype
2009-12-04 19:02:32 . 2009-06-09 22:09:18 -------- d-----r- C:\Program Files\Skype
2009-12-04 19:02:28 . 2009-06-09 22:09:16 -------- d-----w- C:\ProgramData\Skype
2009-12-04 10:25:27 . 2009-07-25 22:35:32 -------- d-----w- C:\ProgramData\Media Center Programs
2009-11-30 17:02:40 . 2009-11-30 17:02:40 171144 ----a-w- C:\Windows\system32\xliveinstall.dll
2009-11-30 17:02:38 . 2009-11-30 17:02:38 72840 ----a-w- C:\Windows\system32\xliveinstallhost.exe
2009-11-29 13:58:20 . 2009-11-29 13:58:20 -------- d-----w- C:\ProgramData\Adobe Systems
2009-11-29 13:57:31 . 2009-11-29 13:52:18 -------- d-----w- C:\Program Files\Adobe Photoshop CS2
2009-11-29 13:56:16 . 2008-07-16 17:17:27 -------- d-----w- C:\Program Files\Common Files\Adobe
2009-11-29 13:55:28 . 2009-11-29 13:55:28 -------- d-----w- C:\Program Files\Common Files\Adobe Systems Shared
2009-11-26 11:10:55 . 2009-11-26 11:10:09 -------- d-----w- C:\Users\RedFish\AppData\Roaming\SmartDraw
2009-11-26 11:10:09 . 2009-11-26 11:08:35 -------- d-----w- C:\Program Files\SmartDraw 2010
2009-11-26 11:04:31 . 2009-11-26 11:04:31 -------- d-----w- C:\Program Files\MeeSoft
2009-11-20 13:22:04 . 2009-06-10 08:54:26 737280 ----a-w- C:\Windows\iun6002.exe
2009-11-09 13:22:34 . 2009-12-10 07:55:06 24064 ----a-w- C:\Windows\system32\nshhttp.dll
2009-11-09 13:20:16 . 2009-12-10 07:55:01 31232 ----a-w- C:\Windows\system32\httpapi.dll
2009-11-09 11:04:30 . 2009-12-10 07:55:02 411136 ----a-w- C:\Windows\system32\drivers\http.sys
2009-11-06 09:59:54 . 2009-11-06 09:59:54 15406728 ----a-w- C:\Windows\system32\xlive.dll
2009-11-06 09:59:54 . 2009-11-06 09:59:54 13642888 ----a-w- C:\Windows\system32\xlivefnt.dll
2009-10-31 08:50:10 . 2009-06-09 17:42:02 8224 ----a-w- C:\Users\RedFish\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-30 07:24:03 . 2009-10-28 15:47:47 1680064 ----a-w- C:\ProgramData\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll
2009-10-30 07:18:28 . 2009-10-28 15:47:50 18368 ----a-w- C:\ProgramData\Microsoft\VSA\9.0\1033\ResourceCache.dll
2009-10-29 09:41:23 . 2009-11-26 07:35:03 2048 ----a-w- C:\Windows\system32\tzres.dll
2009-10-28 15:33:31 . 2009-10-28 15:33:31 416 ----a-w- C:\ProgramData\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-05-01 21:02:48 . 2009-05-01 21:02:48 1044480 ----a-w- C:\Program Files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02:48 . 2009-05-01 21:02:48 200704 ----a-w- C:\Program Files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 02:23:39 2153472]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 11:58:52 495616]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 02:25:11 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 02:25:33 202240]
"Pando Media Booster"="C:\Program Files\Pando Networks\Media Booster\PMB.exe" [2010-01-20 10:30:50 2937528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 13:14:50 6037504]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 08:40:36 1348904]
"NDSTray.exe"="NDSTray.exe" [BU]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 20:16:00 39792]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 07:24:10 581632]
"Toshiba TEMPO"="C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 08:22:10 103824]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 10:17:18 61440]
"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2008-09-26 12:22:44 417792]
"HDMICtrlMan"="C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 13:57:06 716800]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 14:27:52 431456]
"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-10-31 20:01:12 54608]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 11:33:50 509816]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 11:35:42 716800]
"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 02:07:52 574864]
"SMail"="C:\Program Files\Seznam\Postak\Postak.exe" [2006-05-18 12:36:14 450560]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2009-06-19 13:30:30 949376]
"MacrokeyManager"="WTMKM.exe" [2009-04-22 10:34:44 3161760]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2006-11-29 10:58:14 90112]

C:\Users\RedFish\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R1 nod32drv;nod32drv;C:\Windows\System32\drivers\nod32drv.sys [19.6.2009 14:31:54 15424]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe [16.4.2008 23:19:48 40960]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [24.4.2008 9:21:56 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe [3.12.2007 16:03:52 126976]
R3 FwLnk;FwLnk Driver;C:\Windows\System32\drivers\FwLnk.sys [16.7.2008 18:03:28 7168]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;C:\Windows\System32\drivers\NETw5v32.sys [17.11.2008 14:40:22 3668480]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [25.8.2008 8:58:20 77824]
S2 WTService;WTService;C:\Windows\system32\atwtusb.exe -s --> C:\Windows\system32\atwtusb.exe -s [?]
S4 sptd;sptd;C:\Windows\System32\drivers\sptd.sys [10.6.2009 9:39:29 721904]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-23 C:\Windows\Tasks\GlaryInitialize.job
- C:\Program Files\Glary Utilities\initialize.exe [2010-01-23 10:57:26 . 2010-01-14 22:01:08]

2009-11-27 C:\Windows\Tasks\SDMsgUpdate (TE).job
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe [2009-11-26 11:08:38 . 2009-07-08 16:21:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain ... bmod=TSEA;
IE: E&xportovat do aplikace Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: C:\Windows\system32\imon.dll
FF - ProfilePath - C:\Users\RedFish\AppData\Roaming\Mozilla\Firefox\Profiles\n69m2b2d.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - plugin: C:\Program Files\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");


Notebook funguje už normálně, nezaznamenal jsem nějaké potíže. Takže mohu podle návodu odinstalovat combofix, smazat všechno co po něm zůstalo + označit za vyřešeno ?

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Stáhni si T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG, Aviru.)


Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění) a odstraň nalezené.
Zavři a smaž program.


Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.