PC-HELP.CZ

prosím o kontrolo logu z HJT


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:19:46, on 4.8.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RadioBar Toolbar - {5B291E6C-9A74-4034-971B-A4B007A0B315} - C:\Program Files\RadioBar\toolbar.ni.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: RadioBar Toolbar - {5B291E6C-9A74-4034-971B-A4B007A0B315} - C:\Program Files\RadioBar\toolbar.ni.dll
O3 - Toolbar: Centrum.cz Toolbar - {D5D47440-0750-463D-BAEF-A47D02414806} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Sonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O18 - Protocol: toolbarchrome - {718733BC-AD64-4E5F-AC18-A85FBD75D54D} - C:\Program Files\RadioBar\toolbar.ni.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate1cafa94f1732b24) (gupdate1cafa94f1732b24) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 8843 bytes

Odinstaluj:
CentrumczToolbar
Crawler Toolbar, Toolbar: &Crawler Toolbar
RadioBar Toolbar
Ask Toolbar, Ask.com
ICQToolBar
DAEMON Tools Toolbar
SPYBOT , nebo u něj vypni trvale rez. Ochranu (AVG9 antispyware má)

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod



Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4388

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

4.8.2010 15:25:33
mbam-log-2010-08-04 (15-25-33).txt

Typ skenu: Rychlý sken
Skenované objekty: 143803
Uplynulý čas: 5 minuta(y), 10 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.
C:\Users\Sonny\AppData\Local\Temp\utt879.tmp.exe (Trojan.Pakes) -> No action taken.
C:\Windows\services.exe (Trojan.Agent) -> No action taken.

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujisti se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit nový log z MbAM.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

ComboFix 10-08-04.05 - user 06.08.2010 21:21:55.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2815.1428 [GMT 2:00]
Spuštěný z: c:\users\user\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%appdata%
c:\windows\system32\vbzlib1.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-06 do 2010-08-06 )))))))))))))))))))))))))))))))
.

2010-08-06 19:28 . 2010-08-06 19:29 -------- d-----w- c:\users\user\AppData\Local\temp
2010-08-06 19:28 . 2010-08-06 19:28 -------- d-----w- c:\users\Sonny\AppData\Local\temp
2010-08-06 19:28 . 2010-08-06 19:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-06 17:15 . 2010-08-06 17:16 -------- d-----w- c:\users\Sonny\AppData\Local\Diagnostics
2010-08-06 10:49 . 2010-08-06 10:49 -------- d-----w- c:\users\Sonny\AppData\Local\AVG Security Toolbar
2010-08-06 10:49 . 2010-08-06 10:49 -------- d-----w- c:\users\Sonny\AppData\Local\Mozilla
2010-08-06 10:23 . 2010-08-06 10:23 -------- d-----w- c:\users\Sonny\AppData\Local\Google
2010-08-06 10:06 . 2010-08-06 10:07 -------- d-----w- c:\users\Sonny\AppData\Roaming\Winamp
2010-08-04 16:14 . 2010-08-06 19:14 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-04 13:34 . 2010-08-04 13:34 -------- d-----w- c:\users\user\AppData\Local\AVG Security Toolbar
2010-08-04 13:19 . 2010-08-04 13:19 -------- d-----w- c:\users\user\AppData\Roaming\Malwarebytes
2010-08-04 13:19 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-04 13:19 . 2010-08-04 13:19 -------- d-----w- c:\programdata\Malwarebytes
2010-08-04 13:19 . 2010-08-04 13:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-04 13:19 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-04 08:19 . 2010-08-04 08:19 388096 ----a-r- c:\users\user\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-04 08:19 . 2010-08-04 08:19 -------- d-----w- c:\program files\Trend Micro
2010-08-04 08:05 . 2010-08-04 08:05 -------- d-----w- c:\program files\CCleaner
2010-08-03 20:55 . 2010-08-03 20:59 -------- d-----w- c:\program files\Mafia
2010-08-03 20:55 . 2010-08-03 20:55 -------- d-----w- c:\users\user\AppData\Roaming\DAEMON Tools Lite
2010-08-02 17:24 . 2010-04-19 08:25 2117704 ----a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll
2010-07-29 13:53 . 2010-07-29 13:53 -------- d-----w- c:\program files\Bonjour
2010-07-27 14:04 . 2010-07-27 14:04 -------- d-----w- C:\MoTemp
2010-07-27 09:56 . 2010-08-01 15:09 -------- d-----w- c:\programdata\FLEXnet
2010-07-27 09:40 . 2010-07-27 09:40 -------- d-----w- c:\program files\Adobe Media Player
2010-07-27 09:38 . 2010-07-27 09:38 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-27 09:36 . 2010-07-27 09:36 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-07-27 09:18 . 2010-07-27 09:18 -------- d-----w- c:\program files\7-Zip
2010-07-27 07:56 . 2010-07-27 07:56 -------- d-----w- c:\users\user\AppData\Local\Google
2010-07-23 10:32 . 2010-07-23 10:32 -------- d-----w- C:\$AVG
2010-07-23 09:18 . 2010-07-23 09:18 29512 ----a-w- c:\programdata\avg9\update\backup\avgmfx86.sys
2010-07-23 09:18 . 2010-07-23 09:18 242896 ----a-w- c:\programdata\avg9\update\backup\avgtdix.sys
2010-07-23 09:18 . 2010-07-23 09:18 216200 ----a-w- c:\programdata\avg9\update\backup\avgldx86.sys
2010-07-23 09:18 . 2010-07-23 09:18 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-23 09:16 . 2010-07-23 09:16 813336 ----a-w- c:\programdata\avg9\update\backup\avginet.dll
2010-07-23 09:16 . 2010-07-23 09:16 624920 ----a-w- c:\programdata\avg9\update\backup\avgiproxy.exe
2010-07-23 09:16 . 2010-07-23 09:16 1690464 ----a-w- c:\programdata\avg9\update\backup\avgupd.dll
2010-07-23 09:16 . 2010-07-23 09:16 1038688 ----a-w- c:\programdata\avg9\update\backup\avgupd.exe
2010-07-23 09:15 . 2010-07-23 09:18 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-23 09:15 . 2010-07-23 09:17 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-23 09:15 . 2010-08-06 17:23 -------- d-----w- c:\windows\system32\drivers\Avg
2010-07-23 09:15 . 2010-07-23 09:18 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-07-23 09:15 . 2010-08-02 17:24 -------- d-----w- c:\programdata\AVG Security Toolbar
2010-07-23 09:15 . 2010-07-23 09:15 -------- d-----w- c:\program files\AVG
2010-07-23 09:15 . 2010-07-23 09:15 -------- d-----w- c:\programdata\avg9
2010-07-23 09:12 . 1995-10-21 09:37 35328 ----a-w- c:\windows\system32\INETWH32.DLL
2010-07-23 09:12 . 1995-10-16 15:55 9136 ----a-w- c:\windows\system32\INETWH16.DLL
2010-07-23 09:12 . 1995-10-13 15:28 4528 ----a-w- c:\windows\system32\SETBROWS.EXE
2010-07-23 09:12 . 2010-08-02 16:46 -------- d-----w- c:\program files\Common Files\soft602
2010-07-23 09:12 . 2010-07-23 09:12 -------- d-----w- c:\program files\Software602
2010-07-16 22:38 . 2010-07-16 22:38 -------- d-----w- c:\program files\WinPcap
2010-07-16 22:32 . 2010-08-02 11:31 -------- d-----w- c:\program files\VirtualDJ
2010-07-16 09:26 . 2009-12-08 11:32 292864 ----a-w- c:\windows\system32\apphelp.dll
2010-07-09 08:09 . 2010-07-16 09:17 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-07-08 18:47 . 2010-07-08 18:47 -------- d-----w- c:\programdata\Blizzard
2010-07-08 18:43 . 2010-07-08 18:43 -------- d-----w- c:\program files\GRETECH

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-06 19:20 . 2010-05-30 07:45 -------- d-----w- c:\users\user\AppData\Roaming\Skype
2010-08-06 19:19 . 2009-07-14 08:44 627590 ----a-w- c:\windows\system32\perfh005.dat
2010-08-06 19:19 . 2009-07-14 08:44 120716 ----a-w- c:\windows\system32\perfc005.dat
2010-08-06 19:14 . 2010-06-07 16:01 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-08-06 19:14 . 2010-06-07 16:00 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-08-06 17:29 . 2010-05-31 20:22 -------- d-----w- c:\users\user\AppData\Roaming\skypePM
2010-08-06 09:34 . 2010-06-05 21:17 -------- d-----w- c:\program files\Crawler
2010-08-04 12:55 . 2010-05-22 13:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-04 12:54 . 2010-05-22 13:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-08-02 16:48 . 2010-06-04 15:00 -------- d-----w- c:\program files\Native Instruments
2010-08-02 16:46 . 2010-05-22 12:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-02 11:38 . 2010-05-22 13:29 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-30 19:36 . 2010-07-05 13:36 -------- d-----w- c:\users\user\AppData\Roaming\ICQ
2010-07-28 05:24 . 2010-05-23 16:44 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-20 22:02 . 2010-06-04 08:50 -------- d-----w- c:\program files\Virtual Earth 3D
2010-07-17 17:24 . 2010-05-22 13:37 -------- d-----w- c:\program files\ESET
2010-07-16 22:38 . 2010-05-26 14:28 -------- d-----w- c:\program files\DsNET Corp
2010-07-16 14:24 . 2010-05-22 13:39 -------- d-----w- c:\programdata\Microsoft Help
2010-07-16 09:17 . 2010-06-27 19:59 -------- d-----w- c:\program files\Bluetooth Remote Control
2010-06-29 19:15 . 2010-05-29 14:50 -------- d-----w- c:\program files\Opera
2010-06-29 18:52 . 2010-06-26 17:57 -------- d-----w- c:\program files\BitPim
2010-06-29 18:52 . 2010-06-28 20:55 -------- d-----w- c:\program files\BluetoothPCDialer
2010-06-29 18:52 . 2010-06-27 18:52 -------- d-----w- c:\program files\mobilewitch
2010-06-29 18:52 . 2010-06-27 18:51 -------- d-----w- c:\program files\Mobile Witch Remote Control
2010-06-29 18:52 . 2010-06-27 17:28 -------- d-----w- c:\program files\PRTG Network Monitor
2010-06-29 16:58 . 2010-06-29 16:58 -------- d-----w- c:\program files\SAMSUNG
2010-06-27 19:48 . 2010-06-27 19:48 -------- d-----w- c:\programdata\Bluetooth
2010-06-27 18:31 . 2010-06-27 18:31 -------- d-----w- c:\program files\IVT Corporation
2010-06-27 17:29 . 2010-06-27 17:29 -------- d-----w- c:\programdata\Paessler
2010-06-20 16:06 . 2010-06-20 16:02 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-06-18 12:12 . 2010-06-06 07:34 -------- d-----w- c:\program files\uTorrent
2010-06-11 22:02 . 2010-06-07 16:26 -------- d-----w- c:\program files\Empire Interactive
2010-06-11 12:21 . 2010-06-11 12:21 -------- d-----w- c:\users\user\AppData\Roaming\Ubisoft
2010-06-10 13:05 . 2010-06-10 13:05 -------- d-----w- c:\programdata\Ubisoft
2010-06-06 17:54 . 2010-06-05 15:38 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-06-06 17:54 . 2010-06-05 15:37 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-06-06 17:54 . 2010-06-05 15:37 2250024 ----a-w- c:\windows\system32\pbsvc.exe
2010-06-05 15:43 . 2010-06-05 14:25 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-06-05 15:37 . 2010-06-05 15:37 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-06-05 09:09 . 2010-06-05 09:09 229208 ----a-w- c:\windows\system32\drivers\VMM.sys
2010-05-27 07:24 . 2010-06-11 22:27 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-11 22:27 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-22 14:25 . 2010-05-22 14:25 108824 ----a-w- c:\users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-22 14:19 . 2010-05-22 14:19 0 ----a-w- c:\windows\nsreg.dat
2010-05-22 13:29 . 2010-05-22 13:29 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-05-21 12:14 . 2010-05-22 13:55 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 05:18 . 2010-06-11 22:26 977920 ----a-w- c:\windows\system32\wininet.dll
2010-05-09 09:14 . 2010-06-23 09:31 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-05-09 09:14 . 2010-06-23 09:31 417792 ----a-w- c:\windows\system32\msdri.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-06-16 7547424]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-06 13789728]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-23 2065760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

R2 gupdate1cafa94f1732b24;Služba Google Update (gupdate1cafa94f1732b24);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-23 133104]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2010-04-19 430152]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-22 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-06 691696]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-07-23 216400]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-07-23 243024]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-23 308136]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]

.
Obsah adresáře 'Naplánované úlohy'

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-23 16:28]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-23 16:28]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Sonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\n2dyhaa7.default\
FF - prefs.js: browser.search.selectedEngine - WebHledani
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www.webhledani.cz/results.aspx?i=39&tp=ab&q=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\np32dsw.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x8557E1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x855d2e88
QueryNameProcedure -> 0x855c6270
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2755797591-1384155627-940417546-1000\Software\SecuROM\License information*]
"datasecu"=hex:10,33,ec,29,53,e7,3a,b5,5f,bc,bc,ed,a2,b2,f0,ee,18,6e,56,1b,d4,
df,ba,48,2b,82,5a,1c,96,3d,3b,1c,50,86,0f,92,04,17,6a,fd,25,1a,f0,7e,00,54,\
"rkeysecu"=hex:88,59,cf,60,bf,9c,8b,da,89,d2,68,04,06,b0,18,5d

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(2124)
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\AVG\AVG9\avgtray.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-08-06 21:33:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-06 19:33

Před spuštěním: Volných bajtů: 66 269 954 048
Po spuštění: Volných bajtů: 67 408 740 352

- - End Of File - - FE6ABE6C261D771B1862D73856F02AC8

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

To sis nastavoval sám:
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
???