PC-HELP.CZ

Chcel by som poprosiť o pomoc s logom z Hijacku.V poslednej dobe mi často prehliadač nahodí web stránku Iamwi3ed.net a takisto citim znizeny vykon PC.Ďakujem

Tak spusť HiJackThis pro tentokrát vyber Do a system scan only!
Zatrhni položky, které jsou níže uvedené a stiskni Fix checked.

A počkej až dokončí svůj proces, poté program vypni.

Stáhni si ATF Cleaner
Spust a stiskni na select all found
Jestli jedeš přes Mozilu Firefox klikni na Firefox nahoře a vyber: Select All, potom klikni na Empty Selected.
Jestli jedeš přes Operu klikni nahoře na Operu a vyber: Select All, potom klikni na Empty Selected.
Až se to vyčistí klikni na exit pro ukončení.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Veľmi pekne ďakujem, tu je ten Log.

Jen poznámka: Nedávej prosím tě logy do "Code" ani do citací (Quote). Není to pak přehledné.

Ospravedlňujem sa.

Malwarebytes' Anti-Malware 1.44
Verzia databázy: 3806
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28. 2. 2010 16:56:25
mbam-log-2010-02-28 (16-56-21).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 115653
Uplynutý cas: 3 minute(s), 49 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 3
Infikovaných registracných hodnôt: 0
Infikovaných registracných údajov položiek: 1
Infikovaných priecinkov: 0
Infikovaných súborov: 1

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
HKEY_CLASSES_ROOT\CLSID\{fe5b2d9d-91b0-b04b-ac20-14a260769687} (Adware.ColorSoft) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\i03eof-lj_ (Adware.AdRotator) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> No action taken.

Infikovaných registracných hodnôt:
(Žiadne škodlivé položky)

Infikovaných registracných údajov položiek:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (http://www3.iamwired.net/) Good: (http://www.Google.com) -> No action taken.

Infikovaných priecinkov:
(Žiadne škodlivé položky)

Infikovaných súborov:
C:\Windows\System32\I03EOF-Lj_.exe (Adware.AdRotator) -> No action taken.

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

MbAM:

Malwarebytes' Anti-Malware 1.44
Verzia databázy: 3806
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2. 3. 2010 16:25:30
mbam-log-2010-03-02 (16-25-30).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 116735
Uplynutý cas: 4 minute(s), 8 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 0
Infikovaných registracných hodnôt: 0
Infikovaných registracných údajov položiek: 0
Infikovaných priecinkov: 0
Infikovaných súborov: 0

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
(Žiadne škodlivé položky)

Infikovaných registracných hodnôt:
(Žiadne škodlivé položky)

Infikovaných registracných údajov položiek:
(Žiadne škodlivé položky)

Infikovaných priecinkov:
(Žiadne škodlivé položky)

Infikovaných súborov:
(Žiadne škodlivé položky)

ComboFix:

ComboFix 10-03-01.03 - Admin . 03. 2010 16:11:33.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3326.2374 [GMT 1:00]
Running from: c:\users\Admin\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\temp

.
((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-03-02 15:15 . 2010-03-02 15:16 -------- d-----w- c:\users\Admin\AppData\Local\temp
2010-03-02 15:15 . 2010-03-02 15:15 -------- d-----w- c:\users\iKubinQoO\AppData\Local\temp
2010-03-02 15:15 . 2010-03-02 15:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-02 15:08 . 2010-03-02 15:09 -------- d-----w- C:\32788R22FWJFW
2010-02-28 19:23 . 2010-02-28 19:23 -------- d-----w- c:\windows\Sun
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes
2010-02-28 15:51 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\programdata\Malwarebytes
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 15:51 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-28 09:58 . 2010-02-28 10:01 -------- d-----w- C:\dragon oath
2010-02-25 15:57 . 2010-03-02 00:33 -------- d-----w- c:\users\Admin\AppData\Roaming\Mumble
2010-02-25 15:56 . 2010-02-25 15:56 -------- d-----w- c:\program files\Mumble
2010-02-24 11:36 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-02-24 11:36 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-02-24 11:36 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
2010-02-24 11:36 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 11:35 . 2010-02-24 11:35 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-02-24 11:35 . 2010-02-24 11:35 458048 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-02-23 15:49 . 2010-02-23 15:50 -------- d-----w- c:\users\Admin\AppData\Local\WinZip
2010-02-23 15:49 . 2010-02-23 15:49 -------- d-----w- c:\programdata\WinZip
2010-02-22 20:56 . 2010-02-22 20:56 -------- d-----w- c:\users\Admin\AppData\Local\AliensVsPredator
2010-02-21 18:43 . 2010-02-21 18:43 -------- d-----w- c:\users\Admin\AppData\Local\SEGA
2010-02-21 18:42 . 2010-02-21 18:43 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-21 18:42 . 2010-02-21 18:42 -------- d-----w- c:\windows\system32\xlive
2010-02-18 22:57 . 2010-02-18 22:57 93 ----a-w- c:\users\Admin\AppData\Local\fusioncache.dat
2010-02-18 22:57 . 2010-02-18 22:57 -------- d-----w- c:\users\Admin\AppData\Local\ApplicationHistory
2010-02-18 22:42 . 2010-02-18 22:42 -------- d-----w- c:\windows\system32\URTTEMP
2010-02-16 00:02 . 2010-02-16 00:02 388096 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-16 00:02 . 2010-02-16 00:02 -------- d-----w- c:\program files\TrendMicro
2010-02-13 12:26 . 2010-02-13 12:26 -------- d-----w- c:\program files\Common Files\Java
2010-02-13 12:25 . 2010-02-13 12:25 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-13 12:25 . 2010-02-13 12:25 -------- d-----w- c:\program files\Java
2010-02-05 15:02 . 2010-02-05 15:02 -------- d-----w- c:\program files\QuickTime
2010-02-05 15:02 . 2010-02-05 15:02 -------- d-----w- c:\programdata\Apple Computer
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\program files\Common Files\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\users\Admin\AppData\Local\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\programdata\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\program files\Apple Software Update
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\users\Admin\AppData\Roaming\TSRWorkshop
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\users\Admin\AppData\Local\Ibibi_HB
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\program files\The Sims Resource
2010-02-04 16:38 . 2010-02-04 16:38 -------- d-----w- c:\program files\TSR
2010-02-03 19:12 . 2010-02-03 19:12 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information
2010-02-03 19:12 . 2010-02-03 19:03 331776 ----a-w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information\{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}\SetupUT3.exe
2010-02-03 19:12 . 2007-10-24 11:47 4147031 ----a-w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information\{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}\ISSetup.dll
2010-02-03 19:06 . 2010-02-03 19:06 -------- d-----w- c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-02 15:09 . 2009-11-05 14:14 -------- d-----w- c:\users\Admin\AppData\Roaming\uTorrent
2010-03-02 13:56 . 2009-11-05 14:07 -------- d-----w- c:\users\Admin\AppData\Roaming\Skype
2010-03-02 10:42 . 2009-11-05 14:21 -------- d-----w- c:\users\Admin\AppData\Roaming\skypePM
2010-02-28 15:59 . 2010-01-15 22:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-26 01:08 . 2009-11-05 11:26 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\Skype
2010-02-26 01:08 . 2009-11-13 15:25 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\ICQ
2010-02-26 00:59 . 2009-11-16 01:26 -------- d-----w- c:\users\Admin\AppData\Roaming\U3
2010-02-24 08:16 . 2009-11-05 09:37 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-23 15:48 . 2009-11-05 11:29 -------- d-----w- c:\program files\Google
2010-02-22 06:09 . 2009-11-05 14:15 -------- d-----w- c:\program files\uTorrent
2010-02-21 18:37 . 2009-11-04 10:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-18 21:56 . 2009-12-19 20:11 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield
2010-02-14 10:52 . 2009-11-05 21:49 -------- d-----w- c:\program files\Garena
2010-02-03 19:06 . 2009-11-07 11:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 14:33 . 2010-01-31 14:33 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-01-31 14:33 . 2010-01-31 14:33 458048 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-29 17:15 . 2009-11-05 11:27 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\skypePM
2010-01-29 15:43 . 2010-01-10 18:16 -------- d-----w- c:\programdata\Norton
2010-01-29 15:07 . 2010-01-29 15:07 -------- d-----w- c:\users\Admin\AppData\Roaming\Activision
2010-01-29 15:07 . 2010-01-29 15:07 -------- d-----w- c:\programdata\Activision
2010-01-27 22:54 . 2009-11-09 21:56 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-26 20:51 . 2010-01-26 20:51 -------- d-----w- c:\users\Admin\AppData\Roaming\Touchstone
2010-01-24 21:56 . 2009-12-26 17:50 278728 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-01-24 21:48 . 2009-12-17 15:27 -------- d-----w- c:\programdata\Media Center Programs
2010-01-24 11:28 . 2010-01-29 17:20 52224 ----a-w- c:\users\iKubinQoO\AppData\Roaming\Mozilla\Firefox\Profiles\8uuur6yd.default\extensions\{80f6f9bf-9fd1-4f41-9ddf-6dd070f4f62f}\components\FFExternalAlert.dll
2010-01-24 11:28 . 2010-01-29 17:20 101376 ----a-w- c:\users\iKubinQoO\AppData\Roaming\Mozilla\Firefox\Profiles\8uuur6yd.default\extensions\{80f6f9bf-9fd1-4f41-9ddf-6dd070f4f62f}\components\RadioWMPCore.dll
2010-01-23 23:00 . 2010-01-23 23:00 10134 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2010-01-23 19:09 . 2010-01-23 19:09 -------- d-----w- c:\programdata\PMB Files
2010-01-23 19:09 . 2010-01-06 19:35 -------- d-----w- c:\program files\Pando Networks
2010-01-23 19:05 . 2009-11-13 15:25 -------- d-----w- c:\program files\ICQ6.5
2010-01-23 19:05 . 2009-11-05 09:36 108824 ----a-w- c:\users\iKubinQoO\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-21 14:17 . 2009-11-27 15:20 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-21 14:15 . 2010-01-21 14:15 -------- dc-h--w- c:\programdata\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2010-01-21 14:09 . 2010-01-21 14:09 3070 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-19 19:59 . 2010-01-19 19:59 -------- d-----w- c:\programdata\Nero
2010-01-19 19:59 . 2010-01-19 19:59 -------- d-----w- c:\program files\Nero
2010-01-19 19:58 . 2010-01-19 19:58 -------- d-----w- c:\program files\Common Files\Nero
2010-01-19 19:54 . 2009-11-09 15:08 -------- d-----w- c:\users\Admin\AppData\Roaming\Nero
2010-01-18 23:29 . 2010-02-10 11:41 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-18 23:29 . 2010-02-10 11:41 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-18 23:29 . 2010-02-10 11:41 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-18 23:29 . 2010-02-10 11:41 369152 ----a-w- c:\windows\system32\secproc.dll
2010-01-18 23:28 . 2010-02-10 11:41 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-18 23:28 . 2010-02-10 11:41 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-18 23:28 . 2010-02-10 11:41 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-18 23:28 . 2010-02-10 11:41 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-17 00:22 . 2010-01-14 23:56 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-17 00:22 . 2010-01-14 23:56 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-15 22:31 . 2010-01-15 22:31 -------- d-----w- c:\programdata\Solidshield
2010-01-15 22:04 . 2010-01-15 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-15 12:04 . 2009-11-04 11:11 108824 ----a-w- c:\users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-14 23:56 . 2010-01-14 23:56 -------- d-----w- c:\program files\OpenAL
2010-01-14 23:48 . 2010-01-14 23:47 -------- d-----w- c:\program files\Seznam DVD 2008
2010-01-14 22:13 . 2009-11-05 14:32 -------- d-----w- c:\programdata\Microsoft Help
2010-01-14 22:12 . 2010-01-14 22:12 -------- d-----w- c:\program files\Microsoft Works
2010-01-14 22:11 . 2010-01-14 22:11 -------- d-----w- c:\program files\Microsoft.NET
2010-01-14 21:12 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2010-01-13 20:53 . 2009-11-25 18:31 -------- d-----w- c:\users\Admin\AppData\Roaming\Atari
2010-01-13 11:57 . 2009-11-25 12:11 -------- d-----w- c:\programdata\TmForever
2010-01-12 15:53 . 2010-01-10 18:16 -------- d-----w- c:\programdata\Symantec
2010-01-12 14:36 . 2010-01-12 14:36 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-10 18:16 . 2010-01-10 18:16 -------- d-----w- c:\programdata\NortonInstaller
2010-01-08 03:18 . 2010-02-10 11:41 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 11:41 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-01-04 20:30 . 2010-01-02 13:26 -------- d-----w- c:\users\Admin\AppData\Roaming\Bioshock
2010-01-02 19:23 . 2010-01-02 19:16 -------- d-----w- c:\program files\Avidemux 2.5
2010-01-02 19:16 . 2010-01-02 19:16 -------- d-----w- c:\users\Admin\AppData\Roaming\avidemux
2010-01-02 14:11 . 2009-12-31 10:14 -------- d-----w- c:\program files\BearShare Applications
2009-12-26 18:06 . 2009-12-26 18:06 10134 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{A2D08D5A-74E8-7509-452A-E40E63D8FFC2}\ARPPRODUCTICON.exe
2009-12-26 17:50 . 2009-12-26 17:50 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2009-12-22 10:42 . 2009-11-04 10:43 16608 ----a-w- c:\windows\gdrv.sys
2009-12-22 00:48 . 2009-12-22 00:49 93512 ----a-w- c:\windows\dxsdkuninst.exe
2009-12-19 09:02 . 2010-01-22 11:39 977920 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 09:02 . 2010-02-10 11:41 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 11:41 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 11:41 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 11:41 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 11:41 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 11:41 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 11:41 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 11:41 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-12-12 11:55 . 2009-12-12 11:55 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-12-08 11:40 . 2010-02-10 11:41 3955288 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 11:40 . 2010-02-10 11:41 3899464 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 11:32 . 2010-02-10 11:41 292864 ----a-w- c:\windows\system32\apphelp.dll
2009-12-08 08:05 . 2010-02-10 11:41 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-08 08:05 . 2010-02-10 11:41 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-21 319280]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-20 6711840]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-11-24 81000]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-24 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2009-06-14 307200]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [5. 11. 2009 15:19 114768]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [25. 11. 2009 4:17 172032]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [5. 11. 2009 15:19 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [5. 11. 2009 15:19 53328]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\System32\drivers\Rt86win7.sys [1. 3. 2009 23:05 139776]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [6. 11. 2009 14:03 691696]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [23. 2. 2010 16:48 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 15:48]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 15:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z15iedo3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - component: c:\program files\Mozilla Firefox\extensions\{ec77b0da-98da-9637-7970-851a2ef686af}\components\r5XHrDOMCu.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z15iedo3.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}\plugins\npsoe.dll
FF - plugin: c:\users\iKubinQoO\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\npsoe.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-{1BC3AF44-D80E-4744-A8E1-9BC540424AC9} - c:\program files\InstallShield Installation Information\{1BC3AF44-D80E-4744-A8E1-9BC540424AC9}\setup.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GarenaPEngine]
"ImagePath"="\??\c:\users\Admin\AppData\Local\Temp\DLL8854.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3220634387-4243098348-3371110873-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1b,e8,0f,fa,66,93,b7,70,22,b5,77,55,9e,85,43,f2,72,42,44,d3,74,3d,b8,
eb,88,0c,4c,a4,94,af,7a,85,ee,4d,06,d5,03,f5,d7,21,5d,24,0d,5c,e7,85,9d,04,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-3220634387-4243098348-3371110873-1000\Software\SecuROM\License information*]
"datasecu"=hex:4c,f0,e4,73,23,4d,ff,ad,3a,77,ea,c6,31,a0,95,88,14,1f,a7,55,ac,
2d,a3,ef,c5,f8,a6,bf,1f,77,55,62,4e,52,23,6d,9b,be,68,e1,20,20,fd,29,92,2a,\
"rkeysecu"=hex:8e,20,d5,69,c8,c8,25,e6,48,a2,c0,d4,82,29,cc,10

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-03-02 16:17:16
ComboFix-quarantined-files.txt 2010-03-02 15:17

Pre-Run: 60 768 301 056 bytes free
Post-Run: 60 702 035 968 bytes free

- - End Of File - - 3C49EA9A807F23C5D7BFBFA74F848843

Co tam máš od Nortona/Symantecu?

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
c:\users\Admin\AppData\Local\Temp\DLL8854.tmp

Folder::
c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP

Firefox::
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=

Driver::
NBService
Nero BackItUp Scheduler 4.0

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GarenaPEngine]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu

Takže som všetko spravil podľa inštrukcií.
Avšak pri tom ako pracoval,čo tam vypisuje tie Completed Stage tak mi naskočilo okno že missing registry Boot/BCD.Opýtalo sa či ho chcem spraviť tak som potvrdil,reštartoval sa PC a dokončilo to proces.

Tu je LOG:

ComboFix 10-03-01.03 - Admin . 03. 2010 19:21:16.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3326.2585 [GMT 1:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
Command switches used :: c:\users\Admin\Desktop\CFScript.txt

FILE ::
"c:\users\Admin\AppData\Local\Temp\DLL8854.tmp"
"c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP\WiseCustomCalla.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Nero BackItUp Scheduler 4.0


((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-03-02 18:25 . 2010-03-02 18:25 -------- d-----w- C:\Device
2010-03-02 18:25 . 2010-03-02 18:27 -------- d-----w- c:\users\Admin\AppData\Local\temp
2010-03-02 18:25 . 2010-03-02 18:25 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-02 18:25 . 2010-03-02 18:25 -------- d-----w- c:\users\iKubinQoO\AppData\Local\temp
2010-03-02 18:25 . 2010-03-02 18:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-02 18:17 . 2010-03-02 18:17 -------- d-----w- C:\32788R22FWJFW
2010-02-28 19:23 . 2010-02-28 19:23 -------- d-----w- c:\windows\Sun
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes
2010-02-28 15:51 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\programdata\Malwarebytes
2010-02-28 15:51 . 2010-02-28 15:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 15:51 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-28 09:58 . 2010-02-28 10:01 -------- d-----w- C:\dragon oath
2010-02-25 15:57 . 2010-03-02 00:33 -------- d-----w- c:\users\Admin\AppData\Roaming\Mumble
2010-02-25 15:56 . 2010-02-25 15:56 -------- d-----w- c:\program files\Mumble
2010-02-24 11:36 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-02-24 11:36 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-02-24 11:36 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
2010-02-24 11:36 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 11:35 . 2010-02-24 11:35 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-02-24 11:35 . 2010-02-24 11:35 458048 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-02-23 15:49 . 2010-02-23 15:50 -------- d-----w- c:\users\Admin\AppData\Local\WinZip
2010-02-23 15:49 . 2010-02-23 15:49 -------- d-----w- c:\programdata\WinZip
2010-02-22 20:56 . 2010-02-22 20:56 -------- d-----w- c:\users\Admin\AppData\Local\AliensVsPredator
2010-02-21 18:43 . 2010-02-21 18:43 -------- d-----w- c:\users\Admin\AppData\Local\SEGA
2010-02-21 18:42 . 2010-02-21 18:43 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-21 18:42 . 2010-02-21 18:42 -------- d-----w- c:\windows\system32\xlive
2010-02-18 22:57 . 2010-02-18 22:57 93 ----a-w- c:\users\Admin\AppData\Local\fusioncache.dat
2010-02-18 22:57 . 2010-02-18 22:57 -------- d-----w- c:\users\Admin\AppData\Local\ApplicationHistory
2010-02-18 22:42 . 2010-02-18 22:42 -------- d-----w- c:\windows\system32\URTTEMP
2010-02-16 00:02 . 2010-02-16 00:02 388096 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-16 00:02 . 2010-02-16 00:02 -------- d-----w- c:\program files\TrendMicro
2010-02-13 12:26 . 2010-02-13 12:26 -------- d-----w- c:\program files\Common Files\Java
2010-02-13 12:25 . 2010-02-13 12:25 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-13 12:25 . 2010-02-13 12:25 -------- d-----w- c:\program files\Java
2010-02-05 15:02 . 2010-02-05 15:02 -------- d-----w- c:\program files\QuickTime
2010-02-05 15:02 . 2010-02-05 15:02 -------- d-----w- c:\programdata\Apple Computer
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\program files\Common Files\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\users\Admin\AppData\Local\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\programdata\Apple
2010-02-05 15:01 . 2010-02-05 15:01 -------- d-----w- c:\program files\Apple Software Update
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\users\Admin\AppData\Roaming\TSRWorkshop
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\users\Admin\AppData\Local\Ibibi_HB
2010-02-04 16:40 . 2010-02-04 16:40 -------- d-----w- c:\program files\The Sims Resource
2010-02-04 16:38 . 2010-02-04 16:38 -------- d-----w- c:\program files\TSR
2010-02-03 19:12 . 2010-02-03 19:12 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information
2010-02-03 19:12 . 2010-02-03 19:03 331776 ----a-w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information\{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}\SetupUT3.exe
2010-02-03 19:12 . 2007-10-24 11:47 4147031 ----a-w- c:\users\Admin\AppData\Roaming\InstallShield Installation Information\{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}\ISSetup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-02 18:28 . 2009-11-05 14:07 -------- d-----w- c:\users\Admin\AppData\Roaming\Skype
2010-03-02 18:28 . 2009-11-05 14:14 -------- d-----w- c:\users\Admin\AppData\Roaming\uTorrent
2010-03-02 17:07 . 2009-11-05 14:21 -------- d-----w- c:\users\Admin\AppData\Roaming\skypePM
2010-02-28 15:59 . 2010-01-15 22:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-26 01:08 . 2009-11-05 11:26 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\Skype
2010-02-26 01:08 . 2009-11-13 15:25 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\ICQ
2010-02-26 00:59 . 2009-11-16 01:26 -------- d-----w- c:\users\Admin\AppData\Roaming\U3
2010-02-24 08:16 . 2009-11-05 09:37 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-23 15:48 . 2009-11-05 11:29 -------- d-----w- c:\program files\Google
2010-02-22 06:09 . 2009-11-05 14:15 -------- d-----w- c:\program files\uTorrent
2010-02-21 18:37 . 2009-11-04 10:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-18 21:56 . 2009-12-19 20:11 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield
2010-02-14 10:52 . 2009-11-05 21:49 -------- d-----w- c:\program files\Garena
2010-02-03 19:06 . 2009-11-07 11:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 14:33 . 2010-01-31 14:33 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-01-31 14:33 . 2010-01-31 14:33 458048 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-29 17:15 . 2009-11-05 11:27 -------- d-----w- c:\users\iKubinQoO\AppData\Roaming\skypePM
2010-01-29 15:43 . 2010-01-10 18:16 -------- d-----w- c:\programdata\Norton
2010-01-29 15:07 . 2010-01-29 15:07 -------- d-----w- c:\users\Admin\AppData\Roaming\Activision
2010-01-29 15:07 . 2010-01-29 15:07 -------- d-----w- c:\programdata\Activision
2010-01-27 22:54 . 2009-11-09 21:56 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-26 20:51 . 2010-01-26 20:51 -------- d-----w- c:\users\Admin\AppData\Roaming\Touchstone
2010-01-24 21:56 . 2009-12-26 17:50 278728 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-01-24 21:48 . 2009-12-17 15:27 -------- d-----w- c:\programdata\Media Center Programs
2010-01-24 11:28 . 2010-01-29 17:20 52224 ----a-w- c:\users\iKubinQoO\AppData\Roaming\Mozilla\Firefox\Profiles\8uuur6yd.default\extensions\{80f6f9bf-9fd1-4f41-9ddf-6dd070f4f62f}\components\FFExternalAlert.dll
2010-01-24 11:28 . 2010-01-29 17:20 101376 ----a-w- c:\users\iKubinQoO\AppData\Roaming\Mozilla\Firefox\Profiles\8uuur6yd.default\extensions\{80f6f9bf-9fd1-4f41-9ddf-6dd070f4f62f}\components\RadioWMPCore.dll
2010-01-23 23:00 . 2010-01-23 23:00 10134 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2010-01-23 19:09 . 2010-01-23 19:09 -------- d-----w- c:\programdata\PMB Files
2010-01-23 19:09 . 2010-01-06 19:35 -------- d-----w- c:\program files\Pando Networks
2010-01-23 19:05 . 2009-11-13 15:25 -------- d-----w- c:\program files\ICQ6.5
2010-01-23 19:05 . 2009-11-05 09:36 108824 ----a-w- c:\users\iKubinQoO\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-21 14:17 . 2009-11-27 15:20 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-21 14:15 . 2010-01-21 14:15 -------- dc-h--w- c:\programdata\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2010-01-21 14:09 . 2010-01-21 14:09 3070 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-19 19:59 . 2010-01-19 19:59 -------- d-----w- c:\programdata\Nero
2010-01-19 19:59 . 2010-01-19 19:59 -------- d-----w- c:\program files\Nero
2010-01-19 19:58 . 2010-01-19 19:58 -------- d-----w- c:\program files\Common Files\Nero
2010-01-19 19:54 . 2009-11-09 15:08 -------- d-----w- c:\users\Admin\AppData\Roaming\Nero
2010-01-18 23:29 . 2010-02-10 11:41 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-18 23:29 . 2010-02-10 11:41 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-18 23:29 . 2010-02-10 11:41 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-18 23:29 . 2010-02-10 11:41 369152 ----a-w- c:\windows\system32\secproc.dll
2010-01-18 23:28 . 2010-02-10 11:41 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-18 23:28 . 2010-02-10 11:41 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-18 23:28 . 2010-02-10 11:41 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-18 23:28 . 2010-02-10 11:41 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-17 00:22 . 2010-01-14 23:56 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-17 00:22 . 2010-01-14 23:56 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-15 22:31 . 2010-01-15 22:31 -------- d-----w- c:\programdata\Solidshield
2010-01-15 22:04 . 2010-01-15 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-15 12:04 . 2009-11-04 11:11 108824 ----a-w- c:\users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-14 23:56 . 2010-01-14 23:56 -------- d-----w- c:\program files\OpenAL
2010-01-14 23:48 . 2010-01-14 23:47 -------- d-----w- c:\program files\Seznam DVD 2008
2010-01-14 22:13 . 2009-11-05 14:32 -------- d-----w- c:\programdata\Microsoft Help
2010-01-14 22:12 . 2010-01-14 22:12 -------- d-----w- c:\program files\Microsoft Works
2010-01-14 22:11 . 2010-01-14 22:11 -------- d-----w- c:\program files\Microsoft.NET
2010-01-14 21:12 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2010-01-13 20:53 . 2009-11-25 18:31 -------- d-----w- c:\users\Admin\AppData\Roaming\Atari
2010-01-13 11:57 . 2009-11-25 12:11 -------- d-----w- c:\programdata\TmForever
2010-01-12 15:53 . 2010-01-10 18:16 -------- d-----w- c:\programdata\Symantec
2010-01-12 14:36 . 2010-01-12 14:36 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-10 18:16 . 2010-01-10 18:16 -------- d-----w- c:\programdata\NortonInstaller
2010-01-08 03:18 . 2010-02-10 11:41 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 11:41 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-01-04 20:30 . 2010-01-02 13:26 -------- d-----w- c:\users\Admin\AppData\Roaming\Bioshock
2010-01-02 19:23 . 2010-01-02 19:16 -------- d-----w- c:\program files\Avidemux 2.5
2010-01-02 19:16 . 2010-01-02 19:16 -------- d-----w- c:\users\Admin\AppData\Roaming\avidemux
2010-01-02 14:11 . 2009-12-31 10:14 -------- d-----w- c:\program files\BearShare Applications
2009-12-26 18:06 . 2009-12-26 18:06 10134 ----a-r- c:\users\Admin\AppData\Roaming\Microsoft\Installer\{A2D08D5A-74E8-7509-452A-E40E63D8FFC2}\ARPPRODUCTICON.exe
2009-12-26 17:50 . 2009-12-26 17:50 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2009-12-22 10:42 . 2009-11-04 10:43 16608 ----a-w- c:\windows\gdrv.sys
2009-12-22 00:48 . 2009-12-22 00:49 93512 ----a-w- c:\windows\dxsdkuninst.exe
2009-12-19 09:02 . 2010-01-22 11:39 977920 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 09:02 . 2010-02-10 11:41 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 11:41 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 11:41 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 11:41 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 11:41 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 11:41 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 11:41 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 11:41 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-12-12 11:55 . 2009-12-12 11:55 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-12-08 11:40 . 2010-02-10 11:41 3955288 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 11:40 . 2010-02-10 11:41 3899464 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 11:32 . 2010-02-10 11:41 292864 ----a-w- c:\windows\system32\apphelp.dll
2009-12-08 08:05 . 2010-02-10 11:41 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-08 08:05 . 2010-02-10 11:41 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-21 319280]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-20 6711840]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-11-24 81000]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-24 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2009-06-14 307200]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [5. 11. 2009 15:19 114768]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [25. 11. 2009 4:17 172032]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [5. 11. 2009 15:19 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [5. 11. 2009 15:19 53328]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\System32\drivers\Rt86win7.sys [1. 3. 2009 23:05 139776]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [23. 2. 2010 16:48 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 15:48]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 15:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z15iedo3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - component: c:\program files\Mozilla Firefox\extensions\{ec77b0da-98da-9637-7970-851a2ef686af}\components\r5XHrDOMCu.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z15iedo3.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}\plugins\npsoe.dll
FF - plugin: c:\users\iKubinQoO\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\npsoe.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x8553A1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x855874e0
QueryNameProcedure -> 0x85587670
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3220634387-4243098348-3371110873-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1b,e8,0f,fa,66,93,b7,70,22,b5,77,55,9e,85,43,f2,72,42,44,d3,74,3d,b8,
eb,88,0c,4c,a4,94,af,7a,85,ee,4d,06,d5,03,f5,d7,21,5d,24,0d,5c,e7,85,9d,04,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-3220634387-4243098348-3371110873-1000\Software\SecuROM\License information*]
"datasecu"=hex:4c,f0,e4,73,23,4d,ff,ad,3a,77,ea,c6,31,a0,95,88,14,1f,a7,55,ac,
2d,a3,ef,c5,f8,a6,bf,1f,77,55,62,4e,52,23,6d,9b,be,68,e1,20,20,fd,29,92,2a,\
"rkeysecu"=hex:8e,20,d5,69,c8,c8,25,e6,48,a2,c0,d4,82,29,cc,10
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Completion time: 2010-03-02 19:29:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-02 18:29
ComboFix2.txt 2010-03-02 15:17

Pre-Run: 60 823 322 624 bytes free
Post-Run: 60 474 400 768 bytes free

- - End Of File - - 8A0F29F78B2F20739F74195732372169

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Pokud ti nepůjde tak najdi a smaž:
C:\327882R2FWJFW
C:\ComboFix
C:\Qoobox
C:\Combofix.txt
a Combofix.exe
Pak si stáhni OTCleanIt.
- Připoj se k internetu a dvojklikem spusť program
- Klikni na tlačítko CleanUp
- Po dokončení povol restart PC
- Po restartu tento nástroj smaž - není určen pro běžné používání
*****************************************************************************************************************************************
Stáhni si OTL na Plochu.
Ujisti se , že máš zavřena všechna ostatní okna a poklepej na ikonu OTL.Nahoře v okně pod Output klikni na minimal Output.Pod Standard Registry změň na All. Zatrhni LOP Check a Purity Check. File age změň na 14 days. Všechny ostatní nastavení ponech jak jsou. Klikni na Run Scan. Sken může trvat dlouho, až skončí otevřou se dva logy:
OTL.Txt
Extras.Txt
Jsou uloženy ve stejném místě jako OTL. Oba logy sem prosím zkopíruj