PC-HELP.CZ

Ahoj, mám problém s psaním do kolonek - problém je podrobněji popsán zde: http://www.pc-help.cz/viewtopic.php?f=46&t=64653

Zde je log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:36:52, on 28.2.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17091)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
C:\PROGRA~1\SQUEEZ~1\server\SqueezeSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Freecorder\FLVSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Relmtech\Unified Remote\UnifiedRemoteServer.exe
C:\Program Files\Squeezebox\SqueezeTray.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ondřej\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://open-articles.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFree.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFree.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFree.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Freecorder FLV Service] "C:\Program Files\Freecorder\FLVSrvc.exe" /run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UnifiedRemoteServer] C:\Program Files\Relmtech\Unified Remote\UnifiedRemoteServer.exe
O4 - HKUS\S-1-5-21-57989841-1532298954-725345543-1008\..\Run: [TVCenter.exe] C:\Program Files\PCTV Systems\TVCenter\TVCenter.exe -server (User 'Petr')
O4 - HKUS\S-1-5-21-57989841-1532298954-725345543-1008\..\Run: [UnifiedRemoteServer] C:\Program Files\Relmtech\Unified Remote\UnifiedRemoteServer.exe (User 'Petr')
O4 - S-1-5-21-57989841-1532298954-725345543-1008 Startup: OpenOffice.org 3.2.lnk.disabled (User 'Petr')
O4 - S-1-5-21-57989841-1532298954-725345543-1008 User Startup: OpenOffice.org 3.2.lnk.disabled (User 'Petr')
O4 - Startup: OpenOffice.org 3.2.lnk.disabled
O4 - Global Startup: Nástroj schránky Squeezebox Server.lnk = C:\Program Files\Squeezebox\SqueezeTray.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... ab_nvd.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8028785453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Crypkey License (l0faou1ayhia6) - Unknown owner - C:\Documents and Settings\Ondřej\Data aplikací\Microsoft\dacykimiw.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SqueezeMySQL - Unknown owner - C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
O23 - Service: Squeezebox Server (squeezesvc) - SlimDevices - A Logitech Company - C:/PROGRA~1/SQUEEZ~1/server/SqueezeSvr.exe

--
End of file - 9358 bytes

Něco podezřelého tam vidím.

Odinstaluj:
Freecorder Toolbar
Conduit

V HJT fixni:
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Tady je výpis z logu Anti Malwarů.... Našlo mi to 6 infikovaných souborů!... Měli jste pravdu že NOD32 není všemocný...

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5916

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1.3.2011 17:54:34
mbam-log-2011-03-01 (17-54-30).txt

Typ kontroly: Rychlý test
Testované objekty: 188020
Uplynulý čas: 6 minut, 21 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 2
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xfqhduxc (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Worm.Palevo) -> Value: Shell -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> No action taken.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\system32\drivers\xfqhduxc.sys (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\secupdat.dat (Backdoor.Bot) -> No action taken.
c:\documents and settings\Petr\secupdat.dat (Worm.Autorun) -> No action taken.

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5916

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1.3.2011 17:54:34
mbam-log-2011-03-01 (17-54-30).txt

Typ kontroly: Rychlý test
Testované objekty: 188020
Uplynulý čas: 6 minut, 21 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 2
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xfqhduxc (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Worm.Palevo) -> Value: Shell -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> No action taken.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\system32\drivers\xfqhduxc.sys (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\secupdat.dat (Backdoor.Bot) -> No action taken.
c:\documents and settings\Petr\secupdat.dat (Worm.Autorun) -> No action taken.

Tady je ten Malware a teď jdu na ten Combo fix

Čti ty návody pořádně!
"ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected"
Tys neodstranil nic

Postupoval jsem podle návodu, odstranil jsem je... Nevím co to napsalo, ale udělal jsem tak, jak jste mi napsali... Tady je Log z Combo Fixu:


ComboFix 11-02-28.07 - Ondřej 01.03.2011 19:17:16.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2678 [GMT 1:00]
Spuštěný z: c:\documents and settings\Ondřej\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\20252d6e001ae3774b425e81ba09b666\Fcntl.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\2076671ee5d0a5323570c92c74abac6f\Process.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\23ae7fb85999872530b5a5d4d67a4f44\Registry.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\23fe5d76b9491fa255db2281ac7687d5\Service.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\2d2847f7dd2a1fddd0fdb79d9d64ba93\List.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\6a834a555edd63cb8706466e7c1666f2\Hostname.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\7020d50af327e3fc94b98242c307fc81\Cwd.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\7dd16cc839f33995d1a58e2773aa29b8\WinError.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\855297e7b4b860331fdbdd53426f5e15\Dumper.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\86351894c58e4804ca004825fea78bbb\Encode.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\a7c0cce4e1ac2c1f6d3e71bbe3c9bdd3\Socket.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\b7b4505cb0a127c242f14d779e410e03\POSIX.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\c3da4aa4c02db51c7f94d5eaf2438023\OLE.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\f48694173221cfa9bad4275e2389b498\Win32.dll
c:\docume~1\ONDEJ~1\LOCALS~1\Temp\pdk-Ond[159]ej-3616\perl510.dll
c:\documents and settings\Ondřej\Data aplikací\PriceGong
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\1.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\a.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\b.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\c.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\d.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\e.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\f.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\g.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\h.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\i.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\J.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\k.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\l.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\m.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\n.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\o.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\p.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\q.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\r.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\s.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\t.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\u.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\v.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\w.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\x.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\y.xml
c:\documents and settings\Ondřej\Data aplikací\PriceGong\Data\z.xml
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\20252d6e001ae3774b425e81ba09b666\Fcntl.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\2076671ee5d0a5323570c92c74abac6f\Process.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\23ae7fb85999872530b5a5d4d67a4f44\Registry.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\23fe5d76b9491fa255db2281ac7687d5\Service.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\2d2847f7dd2a1fddd0fdb79d9d64ba93\List.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\6a834a555edd63cb8706466e7c1666f2\Hostname.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\7020d50af327e3fc94b98242c307fc81\Cwd.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\7dd16cc839f33995d1a58e2773aa29b8\WinError.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\855297e7b4b860331fdbdd53426f5e15\Dumper.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\86351894c58e4804ca004825fea78bbb\Encode.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\a7c0cce4e1ac2c1f6d3e71bbe3c9bdd3\Socket.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\b7b4505cb0a127c242f14d779e410e03\POSIX.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\c3da4aa4c02db51c7f94d5eaf2438023\OLE.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\f48694173221cfa9bad4275e2389b498\Win32.dll
c:\documents and settings\Ondřej\Local Settings\Temp\pdk-Ond[159]ej-3616\perl510.dll
c:\program files\Internet Explorer\SET225.tmp
c:\program files\Internet Explorer\SET22A.tmp
c:\program files\Internet Explorer\SET2E4.tmp
c:\windows\system32\drivers\lgtlvew.sys
c:\windows\TEMP\pdk-SYSTEM-1420\14d02158d1dc4c498d1acd9638684120\Name.dll
c:\windows\TEMP\pdk-SYSTEM-1420\1760917c94a6dfc5d7404399c61fafee\mysql.dll
c:\windows\TEMP\pdk-SYSTEM-1420\20252d6e001ae3774b425e81ba09b666\Fcntl.dll
c:\windows\TEMP\pdk-SYSTEM-1420\2076671ee5d0a5323570c92c74abac6f\Process.dll
c:\windows\TEMP\pdk-SYSTEM-1420\23ae7fb85999872530b5a5d4d67a4f44\Registry.dll
c:\windows\TEMP\pdk-SYSTEM-1420\23fe5d76b9491fa255db2281ac7687d5\Service.dll
c:\windows\TEMP\pdk-SYSTEM-1420\2d2847f7dd2a1fddd0fdb79d9d64ba93\List.dll
c:\windows\TEMP\pdk-SYSTEM-1420\2f0807b0946b0fe6a4923ffadf1218fc\vxs.dll
c:\windows\TEMP\pdk-SYSTEM-1420\3b30fde3722480c5032acad13a155721\Scan.dll
c:\windows\TEMP\pdk-SYSTEM-1420\461090bfc26706cc26ffa02662c1592c\Syck.dll
c:\windows\TEMP\pdk-SYSTEM-1420\48a4e6ef370984d8d9ce53660d66a7a5\Unicode.dll
c:\windows\TEMP\pdk-SYSTEM-1420\4e3813a1edb6903dcc223941e51f7e18\Parser.dll
c:\windows\TEMP\pdk-SYSTEM-1420\52831fecbfbbfee1a05b91977e499808\File.dll
c:\windows\TEMP\pdk-SYSTEM-1420\52ade7602469b51858072e874c345e37\ReadKey.dll
c:\windows\TEMP\pdk-SYSTEM-1420\5f6960e0234e0b14396e4c82a1f56c8f\HiRes.dll
c:\windows\TEMP\pdk-SYSTEM-1420\5ff67c77560df778223e3ec495b98f1e\Hebrew.dll
c:\windows\TEMP\pdk-SYSTEM-1420\62aa3b09ac39e34fd76505142c94e975\Storable.dll
c:\windows\TEMP\pdk-SYSTEM-1420\6a834a555edd63cb8706466e7c1666f2\Hostname.dll
c:\windows\TEMP\pdk-SYSTEM-1420\6c1da131f436ce35edb0690f338bdad8\File.dll
c:\windows\TEMP\pdk-SYSTEM-1420\6c25de79371a4db1d7e8eff0d11d5337\Base64.dll
c:\windows\TEMP\pdk-SYSTEM-1420\6eca2cf2961ac400050de852a1cbef9b\Byte.dll
c:\windows\TEMP\pdk-SYSTEM-1420\7020d50af327e3fc94b98242c307fc81\Cwd.dll
c:\windows\TEMP\pdk-SYSTEM-1420\76c0175b78e6f49c7544e19221d4457d\IO.dll
c:\windows\TEMP\pdk-SYSTEM-1420\7dd16cc839f33995d1a58e2773aa29b8\WinError.dll
c:\windows\TEMP\pdk-SYSTEM-1420\81368e51ca54d10b955b02b2e5382e48\Peek.dll
c:\windows\TEMP\pdk-SYSTEM-1420\855297e7b4b860331fdbdd53426f5e15\Dumper.dll
c:\windows\TEMP\pdk-SYSTEM-1420\86351894c58e4804ca004825fea78bbb\Encode.dll
c:\windows\TEMP\pdk-SYSTEM-1420\880556fb31088a703b58d0705c4f2b53\DBI.dll
c:\windows\TEMP\pdk-SYSTEM-1420\89c552b9aa641030773cbce7545c6143\XS.dll
c:\windows\TEMP\pdk-SYSTEM-1420\90198bd2c008178752393a8740fa6369\XS.dll
c:\windows\TEMP\pdk-SYSTEM-1420\9076f6dacaea506ecfb169822b132706\MD5.dll
c:\windows\TEMP\pdk-SYSTEM-1420\952d7675581ad6751c38c1bc1610a553\EV.dll
c:\windows\TEMP\pdk-SYSTEM-1420\a7c0cce4e1ac2c1f6d3e71bbe3c9bdd3\Socket.dll
c:\windows\TEMP\pdk-SYSTEM-1420\b7b4505cb0a127c242f14d779e410e03\POSIX.dll
c:\windows\TEMP\pdk-SYSTEM-1420\bb8ac2d2050e30577927a7ac95d99cd9\GD.dll
c:\windows\TEMP\pdk-SYSTEM-1420\c06adade199b7f380d57181669fb22c1\Util.dll
c:\windows\TEMP\pdk-SYSTEM-1420\c3da4aa4c02db51c7f94d5eaf2438023\OLE.dll
c:\windows\TEMP\pdk-SYSTEM-1420\c8b0e39733c3e73e232a64a5c305ca76\API.dll
c:\windows\TEMP\pdk-SYSTEM-1420\e1ea0dbaf8a3ac5d1f0be83f219f8571\FastCalc.dll
c:\windows\TEMP\pdk-SYSTEM-1420\e775fca35641b4340ecf5cdba1fc6f62\Expat.dll
c:\windows\TEMP\pdk-SYSTEM-1420\ea4a4f99088551dd603ccfbabfaf3932\XSAccessor.dll
c:\windows\TEMP\pdk-SYSTEM-1420\f48694173221cfa9bad4275e2389b498\Win32.dll
c:\windows\TEMP\pdk-SYSTEM-1420\fc665959964b1312aee9d476290accdc\SHA1.dll
c:\windows\TEMP\pdk-SYSTEM-1420\fc8b9fd242032de837413f14e26ce21c\Zlib.dll
c:\windows\TEMP\pdk-SYSTEM-1420\perl510.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hwkh


((((((((((((((((((((((((( Soubory vytvořené od 2011-02-01 do 2011-03-01 )))))))))))))))))))))))))))))))
.

2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\Malwarebytes
2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-01 16:47 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-01 16:47 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-28 22:01 . 2007-08-18 07:54 380928 ----a-w- c:\windows\system32\ac3filter.acm
2011-02-28 22:01 . 2011-02-28 22:01 -------- d-----w- c:\program files\AC3Filter
2011-02-28 19:36 . 2011-02-28 19:36 388096 ----a-r- c:\documents and settings\Ondřej\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-28 19:36 . 2011-02-28 19:36 -------- d-----w- c:\program files\Trend Micro
2011-02-27 18:42 . 2011-02-27 18:42 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\ESET
2011-02-27 16:34 . 2011-02-27 16:34 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\Relmtech
2011-02-27 16:26 . 2011-02-27 16:26 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\Relmtech
2011-02-27 16:22 . 2011-02-27 16:22 -------- d-----w- c:\program files\Relmtech
2011-02-27 16:21 . 2011-02-27 16:21 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\Downloaded Installations
2011-02-24 13:12 . 2011-02-24 13:12 -------- d-----w- c:\documents and settings\Dita\Local Settings\Data aplikací\FLVService
2011-02-22 22:00 . 2011-02-22 22:00 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\ConduitEngine
2011-02-22 22:00 . 2011-02-22 22:00 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\Freecorder
2011-02-21 21:53 . 2011-03-01 16:12 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\FLVService
2011-02-21 17:13 . 2011-03-01 14:02 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\FLVService
2011-02-21 06:41 . 2011-02-21 06:41 -------- d-----w- c:\program files\Conduit
2011-02-21 06:41 . 2011-02-21 06:41 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\Conduit
2011-02-21 06:41 . 2011-02-21 06:41 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\Freecorder
2011-02-21 06:40 . 2011-02-28 18:14 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\FLVService
2011-02-21 06:40 . 2011-03-01 16:45 -------- d-----w- c:\program files\Freecorder
2011-02-21 06:40 . 2011-02-21 06:40 -------- d-----w- c:\windows\Freecorder
2011-02-20 23:08 . 2011-02-20 23:19 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Squeezebox
2011-02-19 19:45 . 2011-02-19 19:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2011-02-11 19:59 . 2011-02-11 19:59 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2011-02-10 16:51 . 2011-02-10 16:51 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\ESET
2011-02-10 15:33 . 2011-02-10 15:33 -------- d-----w- c:\program files\ESET
2011-02-10 15:33 . 2011-02-10 15:33 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2011-02-10 09:36 . 2011-02-26 22:06 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-02-08 21:49 . 2011-02-08 21:51 -------- d-----w- c:\documents and settings\Matěj\Data aplikací\Mp3tag
2011-02-08 21:48 . 2011-02-08 21:48 -------- d-----w- c:\program files\Mp3tag
2011-02-04 17:23 . 2011-02-04 17:45 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\WMTools Downloaded Files
2011-02-04 13:37 . 2011-02-04 13:37 -------- d-----w- c:\program files\BitTorrent
2011-02-04 13:37 . 2011-02-27 19:57 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\BitTorrent
2011-02-03 16:18 . 2011-02-03 16:18 -------- d-----w- c:\documents and settings\Matěj\Data aplikací\TeamViewer
2011-02-02 19:41 . 2011-02-02 19:50 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\TeamViewer
2011-02-02 19:41 . 2011-02-02 19:41 -------- d-----w- c:\program files\TeamViewer
2011-01-30 22:59 . 2011-01-30 22:59 -------- d-----w- c:\documents and settings\Petr\Data aplikací\OfficeRecovery
2011-01-30 21:03 . 2011-01-30 21:03 -------- d-----w- c:\documents and settings\Ondřej\Programs
2011-01-30 21:01 . 2011-01-30 21:01 -------- d-----w- c:\program files\Smart PC Solutions
2011-01-30 20:35 . 2011-03-01 17:25 -------- d-----w- c:\program files\Stellar Phoenix Photo Recovery
2011-01-30 20:28 . 2011-02-09 10:41 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-01-30 20:13 . 2010-07-01 02:32 65776 ----a-w- c:\windows\UnDeploy.exe
2011-01-30 19:54 . 2011-01-30 19:54 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\OfficeRecovery
2011-01-30 19:53 . 2011-01-30 19:53 -------- d-----w- c:\program files\OfficeRecovery

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-01 18:00 . 2010-10-30 17:32 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-03-01 18:00 . 2010-10-30 17:32 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-03-01 18:00 . 2010-10-30 17:32 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-21 14:44 . 2006-03-02 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2006-03-02 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2006-03-02 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-30 21:35 . 2010-12-30 21:33 3452 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2010-12-30 21:33 . 2010-12-30 21:33 8 --sh--r- c:\documents and settings\All Users\Data aplikací\082B25D1EB.sys
2010-12-22 12:34 . 2006-03-02 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-21 14:04 . 2010-12-21 14:04 141264 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-12-21 14:04 . 2010-12-21 14:04 115008 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-12-21 12:47 . 2010-12-21 12:47 94872 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-12-20 17:25 . 2006-03-02 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-09 15:15 . 2006-03-02 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2004-08-17 15:45 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2006-03-02 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnifiedRemoteServer"="c:\program files\Relmtech\Unified Remote\UnifiedRemoteServer.exe" [2010-07-25 109568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2010-06-26 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

c:\documents and settings\Dita\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-11-2 864]

c:\documents and settings\Petr\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-10-28 864]

c:\documents and settings\Ondýej\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-10-28 864]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
N stroj schr nky Squeezebox Server.lnk - c:\program files\Squeezebox\SqueezeTray.exe [2011-1-7 2351191]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk.disabled
backup=c:\windows\pss\Adobe Gamma Loader.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Vyhledat aktualizace.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Vyhledat aktualizace.lnk.disabled
backup=c:\windows\pss\Vyhledat aktualizace.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk.disabled
backup=c:\windows\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matěj^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.2.lnk.disabled]
path=c:\documents and settings\Matěj\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.2.lnk.disabled
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.disabledStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\Ondřej\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"Alcmtr"=ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PCTV Systems\\TVCenter\\TVCenter.exe"=
"c:\\Program Files\\Common Files\\PCTV Systems\\PVR\\VideoControl.exe"=
"c:\\Program Files\\Common Files\\PCTV Systems\\StreamingServer\\StrmServer.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"f:\\záloha c\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Petr\\Plocha\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"c:\\Program Files\\D-Link\\AP Manager for DWL-2100AP\\APMGR7XXX.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"f:\\Ondrovo\\Call of Duty - Black Ops\\BlackOpsMP.exe"=
"f:\\Ondrovo\\Games\\Empire Earth\\Empire Earth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\Ondrovo\\Call of Duty - Black Ops\\BlackOps.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Relmtech\\Unified Remote\\UnifiedRemoteServer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
"9000:TCP"= 9000:TCP:Squeezebox Server 9000 tcp (UI)
"9001:TCP"= 9001:TCP:Squeezebox Server 9001 tcp (UI)
"9002:TCP"= 9002:TCP:Squeezebox Server 9002 tcp (UI)
"9003:TCP"= 9003:TCP:Squeezebox Server 9003 tcp (UI)
"9004:TCP"= 9004:TCP:Squeezebox Server 9004 tcp (UI)
"9005:TCP"= 9005:TCP:Squeezebox Server 9005 tcp (UI)
"9006:TCP"= 9006:TCP:Squeezebox Server 9006 tcp (UI)
"9007:TCP"= 9007:TCP:Squeezebox Server 9007 tcp (UI)
"9008:TCP"= 9008:TCP:Squeezebox Server 9008 tcp (UI)
"9009:TCP"= 9009:TCP:Squeezebox Server 9009 tcp (UI)
"9010:TCP"= 9010:TCP:Squeezebox Server 9010 tcp (UI)
"9100:TCP"= 9100:TCP:Squeezebox Server 9100 tcp (UI)
"8000:TCP"= 8000:TCP:Squeezebox Server 8000 tcp (UI)
"10000:TCP"= 10000:TCP:Squeezebox Server 10000 tcp (UI)
"9090:TCP"= 9090:TCP:Squeezebox Server 9090 tcp (UI)
"3483:UDP"= 3483:UDP:Squeezebox Server 3483 udp
"3483:TCP"= 3483:TCP:Squeezebox Server 3483 tcp

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 SqueezeMySQL;SqueezeMySQL;c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe --defaults-file=c:\docume~1\ALLUSE~1\DATAAP~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL --> c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe --defaults-file=c:\docume~1\ALLUSE~1\DATAAP~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL [?]
R2 squeezesvc;Squeezebox Server;c:\progra~1\SQUEEZ~1\server\SqueezeSvr.exe [21.2.2011 0:08 10494037]
R3 azvusb;Virtual USB Hub;c:\windows\system32\drivers\azvusb.sys [24.8.2009 9:14 44544]
R3 PinnacleRoyalTS;Pinnacle Systems RoyalTS Device;c:\windows\system32\drivers\RoyalTS.sys [23.10.2010 18:54 123520]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.2.2011 20:40 136176]
S2 l0faou1ayhia6;Crypkey License;c:\documents and settings\Ondřej\Data aplikací\Microsoft\dacykimiw.exe --> c:\documents and settings\Ondřej\Data aplikací\Microsoft\dacykimiw.exe [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26.10.2010 16:04 30192]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\g:\ntglm7x.sys --> g:\NTGLM7X.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2011-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-19 14:46]

2011-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-19 14:46]

2011-03-01 c:\windows\Tasks\PCTV.TV.TaskManager.job
- c:\program files\PCTV Systems\TVCenter\TVCenter.exe [2010-09-27 06:32]

2011-03-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-02-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-02-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2011-03-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file)
SafeBoot-xfqhduxc.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-01 19:21
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3250410AS rev.3.AAA -> Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-10

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 488397164 (+0): user != kernel

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squeezesvc]
"ImagePath"="C:/PROGRA~1/SQUEEZ~1/server/SqueezeSvr.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squeezesvc]
"ImagePath"="C:/PROGRA~1/SQUEEZ~1/server/SqueezeSvr.exe"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_045e&Pid_00f9&MI_01&Col02\7&26a08e1a&0&0001\LogConf]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_045e&Pid_00f9&MI_01&Col02\7&ecee05b&0&0001\LogConf]
@DACL=(02 0000)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1388)
c:\documents and settings\Ondřej\Local Settings\Data aplikací\FLVService\lib\FLVSrvLib.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-03-01 19:24:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-03-01 18:24

Před spuštěním: Volných bajtů: 189 288 493 056
Po spuštění: Volných bajtů: 189 346 209 792

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 0B5E454C4933DE5807FD1539A9F212F0

Sorry, podíval jsem se na ten log a vidim, že to něco neodstranilo... ale to mi neukázalo...

Udělal jsem znova sken anti malwarem a tady je log:


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5916

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1.3.2011 19:30:35
mbam-log-2011-03-01 (19-30-35).txt

Typ kontroly: Rychlý test
Testované objekty: 186071
Uplynulý čas: 2 minut, 35 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Tady je: (mimochodem děkuju moc za to, že to pro mě děláte...)



ComboFix 11-02-28.07 - Ondřej 01.03.2011 21:04:20.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2607 [GMT 1:00]
Spuštěný z: c:\documents and settings\Ondřej\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Ondřej\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}

FILE ::
"c:\documents and settings\All Users\Data aplikací\082B25D1EB.sys"
"c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys"
"c:\documents and settings\Ondřej\Data aplikací\Microsoft\dacykimiw.exe"
"c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1004.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1005.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1006.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1007.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1008.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1004.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1005.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1006.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1007.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1008.job"
"g:\NTGLM7X.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Configuration.ini
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\Bots.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\Cookies.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\FileExt.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\Links.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\Single.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\SystemInternals.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Excludes\WaitFor.sbe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Immunization.ini
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityCenterAntiVirusOverride.zip
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Recovery\WinAutoRuntmp.zip
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Snapshots\System startup.csv
c:\documents and settings\Matěj\Local Settings\Data aplikací\ConduitEngine
c:\documents and settings\Ondřej\Local Settings\Data aplikací\Conduit
c:\documents and settings\Ondřej\Local Settings\Data aplikací\Conduit\Community Alerts\LanguagePacks\en.xml
c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert.dll
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1004.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1005.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1006.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1007.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-57989841-1532298954-725345543-1008.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1004.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1005.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1006.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1007.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-57989841-1532298954-725345543-1008.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_L0FAOU1AYHIA6
-------\Legacy_SETUPNTGLM7X
-------\Legacy_SQUEEZEMYSQL
-------\Service_l0faou1ayhia6
-------\Service_SetupNTGLM7X
-------\Service_SqueezeMySQL


((((((((((((((((((((((((( Soubory vytvořené od 2011-02-01 do 2011-03-01 )))))))))))))))))))))))))))))))
.

2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\Malwarebytes
2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-01 16:47 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-01 16:47 . 2011-03-01 16:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-01 16:47 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-28 22:01 . 2007-08-18 07:54 380928 ----a-w- c:\windows\system32\ac3filter.acm
2011-02-28 22:01 . 2011-02-28 22:01 -------- d-----w- c:\program files\AC3Filter
2011-02-28 19:36 . 2011-02-28 19:36 388096 ----a-r- c:\documents and settings\Ondřej\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-28 19:36 . 2011-02-28 19:36 -------- d-----w- c:\program files\Trend Micro
2011-02-27 18:42 . 2011-02-27 18:42 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\ESET
2011-02-27 16:34 . 2011-02-27 16:34 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\Relmtech
2011-02-27 16:26 . 2011-02-27 16:26 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\Relmtech
2011-02-27 16:22 . 2011-02-27 16:22 -------- d-----w- c:\program files\Relmtech
2011-02-27 16:21 . 2011-02-27 16:21 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\Downloaded Installations
2011-02-24 13:12 . 2011-02-24 13:12 -------- d-----w- c:\documents and settings\Dita\Local Settings\Data aplikací\FLVService
2011-02-22 22:00 . 2011-02-22 22:00 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\Freecorder
2011-02-21 21:53 . 2011-03-01 16:12 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\FLVService
2011-02-21 17:13 . 2011-03-01 14:02 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\FLVService
2011-02-21 06:41 . 2011-02-21 06:41 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\Freecorder
2011-02-21 06:41 . 2011-03-01 16:38 -------- d-----w- c:\program files\ConduitEngine
2011-02-21 06:41 . 2011-02-21 06:41 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\ConduitEngine
2011-02-21 06:40 . 2011-03-01 19:55 -------- d-----w- c:\documents and settings\Ondřej\Local Settings\Data aplikací\FLVService
2011-02-21 06:40 . 2011-03-01 16:45 -------- d-----w- c:\program files\Freecorder
2011-02-21 06:40 . 2011-02-21 06:40 -------- d-----w- c:\windows\Freecorder
2011-02-20 23:08 . 2011-02-20 23:19 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Squeezebox
2011-02-19 19:45 . 2011-02-19 19:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2011-02-11 19:59 . 2011-02-11 19:59 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2011-02-10 16:51 . 2011-02-10 16:51 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\ESET
2011-02-10 15:33 . 2011-02-10 15:33 -------- d-----w- c:\program files\ESET
2011-02-10 15:33 . 2011-02-10 15:33 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2011-02-08 21:49 . 2011-02-08 21:51 -------- d-----w- c:\documents and settings\Matěj\Data aplikací\Mp3tag
2011-02-08 21:48 . 2011-02-08 21:48 -------- d-----w- c:\program files\Mp3tag
2011-02-04 17:23 . 2011-02-04 17:45 -------- d-----w- c:\documents and settings\Matěj\Local Settings\Data aplikací\WMTools Downloaded Files
2011-02-04 13:37 . 2011-02-04 13:37 -------- d-----w- c:\program files\BitTorrent
2011-02-04 13:37 . 2011-02-27 19:57 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\BitTorrent
2011-02-03 16:18 . 2011-02-03 16:18 -------- d-----w- c:\documents and settings\Matěj\Data aplikací\TeamViewer
2011-02-02 19:41 . 2011-02-02 19:50 -------- d-----w- c:\documents and settings\Ondřej\Data aplikací\TeamViewer
2011-02-02 19:41 . 2011-02-02 19:41 -------- d-----w- c:\program files\TeamViewer
2011-01-30 22:59 . 2011-01-30 22:59 -------- d-----w- c:\documents and settings\Petr\Data aplikací\OfficeRecovery
2011-01-30 21:03 . 2011-01-30 21:03 -------- d-----w- c:\documents and settings\Ondřej\Programs
2011-01-30 21:01 . 2011-01-30 21:01 -------- d-----w- c:\program files\Smart PC Solutions
2011-01-30 20:35 . 2011-03-01 17:25 -------- d-----w- c:\program files\Stellar Phoenix Photo Recovery
2011-01-30 20:28 . 2011-02-09 10:41 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-01-30 20:13 . 2010-07-01 02:32 65776 ----a-w- c:\windows\UnDeploy.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-01 18:47 . 2010-10-30 17:32 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-03-01 18:47 . 2010-10-30 17:32 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-03-01 18:47 . 2010-10-30 17:32 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-21 14:44 . 2006-03-02 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2006-03-02 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2006-03-02 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-30 21:35 . 2010-12-30 21:33 3452 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2010-12-30 21:33 . 2010-12-30 21:33 8 --sh--r- c:\documents and settings\All Users\Data aplikací\082B25D1EB.sys
2010-12-22 12:34 . 2006-03-02 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-21 14:04 . 2010-12-21 14:04 141264 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-12-21 14:04 . 2010-12-21 14:04 115008 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-12-21 12:47 . 2010-12-21 12:47 94872 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-12-20 17:25 . 2006-03-02 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-09 15:15 . 2006-03-02 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2004-08-17 15:45 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2006-03-02 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
.

((((((((((((((((((((((((((((( SnapShot@2011-03-01_18.21.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-01 20:10 . 2011-03-01 20:10 16384 c:\windows\temp\Perflib_Perfdata_75c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnifiedRemoteServer"="c:\program files\Relmtech\Unified Remote\UnifiedRemoteServer.exe" [2010-07-25 109568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2010-06-26 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

c:\documents and settings\Dita\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-11-2 864]

c:\documents and settings\Petr\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-10-28 864]

c:\documents and settings\Ondýej\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk.disabled [2010-10-28 864]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
N stroj schr nky Squeezebox Server.lnk - c:\program files\Squeezebox\SqueezeTray.exe [2011-1-7 2351191]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk.disabled
backup=c:\windows\pss\Adobe Gamma Loader.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Vyhledat aktualizace.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Vyhledat aktualizace.lnk.disabled
backup=c:\windows\pss\Vyhledat aktualizace.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk.disabled]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk.disabled
backup=c:\windows\pss\Windows Search.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matěj^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.2.lnk.disabled]
path=c:\documents and settings\Matěj\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.2.lnk.disabled
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.disabledStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\Ondřej\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"Alcmtr"=ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PCTV Systems\\TVCenter\\TVCenter.exe"=
"c:\\Program Files\\Common Files\\PCTV Systems\\PVR\\VideoControl.exe"=
"c:\\Program Files\\Common Files\\PCTV Systems\\StreamingServer\\StrmServer.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"f:\\záloha c\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Petr\\Plocha\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"c:\\Program Files\\D-Link\\AP Manager for DWL-2100AP\\APMGR7XXX.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"f:\\Ondrovo\\Call of Duty - Black Ops\\BlackOpsMP.exe"=
"f:\\Ondrovo\\Games\\Empire Earth\\Empire Earth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\Ondrovo\\Call of Duty - Black Ops\\BlackOps.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Relmtech\\Unified Remote\\UnifiedRemoteServer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
"9000:TCP"= 9000:TCP:Squeezebox Server 9000 tcp (UI)
"9001:TCP"= 9001:TCP:Squeezebox Server 9001 tcp (UI)
"9002:TCP"= 9002:TCP:Squeezebox Server 9002 tcp (UI)
"9003:TCP"= 9003:TCP:Squeezebox Server 9003 tcp (UI)
"9004:TCP"= 9004:TCP:Squeezebox Server 9004 tcp (UI)
"9005:TCP"= 9005:TCP:Squeezebox Server 9005 tcp (UI)
"9006:TCP"= 9006:TCP:Squeezebox Server 9006 tcp (UI)
"9007:TCP"= 9007:TCP:Squeezebox Server 9007 tcp (UI)
"9008:TCP"= 9008:TCP:Squeezebox Server 9008 tcp (UI)
"9009:TCP"= 9009:TCP:Squeezebox Server 9009 tcp (UI)
"9010:TCP"= 9010:TCP:Squeezebox Server 9010 tcp (UI)
"9100:TCP"= 9100:TCP:Squeezebox Server 9100 tcp (UI)
"8000:TCP"= 8000:TCP:Squeezebox Server 8000 tcp (UI)
"10000:TCP"= 10000:TCP:Squeezebox Server 10000 tcp (UI)
"9090:TCP"= 9090:TCP:Squeezebox Server 9090 tcp (UI)
"3483:UDP"= 3483:UDP:Squeezebox Server 3483 udp
"3483:TCP"= 3483:TCP:Squeezebox Server 3483 tcp

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R3 azvusb;Virtual USB Hub;c:\windows\system32\drivers\azvusb.sys [24.8.2009 9:14 44544]
R3 PinnacleRoyalTS;Pinnacle Systems RoyalTS Device;c:\windows\system32\drivers\RoyalTS.sys [23.10.2010 18:54 123520]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.2.2011 20:40 136176]
S2 squeezesvc;Squeezebox Server;c:\progra~1\SQUEEZ~1\server\SqueezeSvr.exe [21.2.2011 0:08 10494037]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26.10.2010 16:04 30192]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2011-03-01 c:\windows\Tasks\PCTV.TV.TaskManager.job
- c:\program files\PCTV Systems\TVCenter\TVCenter.exe [2010-09-27 06:32]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-01 21:12
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3250410AS rev.3.AAA -> Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-10

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 488397164 (+0): user != kernel

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squeezesvc]
"ImagePath"="C:/PROGRA~1/SQUEEZ~1/server/SqueezeSvr.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squeezesvc]
"ImagePath"="C:/PROGRA~1/SQUEEZ~1/server/SqueezeSvr.exe"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_045e&Pid_00f9&MI_01&Col02\7&26a08e1a&0&0001\LogConf]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_045e&Pid_00f9&MI_01&Col02\7&ecee05b&0&0001\LogConf]
@DACL=(02 0000)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1336)
c:\documents and settings\Ondřej\Local Settings\Data aplikací\FLVService\lib\FLVSrvLib.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Celkový čas: 2011-03-01 21:14:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-03-01 20:14
ComboFix2.txt 2011-03-01 18:24

Před spuštěním: Volných bajtů: 188 943 548 416
Po spuštění: Volných bajtů: 188 924 252 160

- - End Of File - - 17F1F54CB9B831229D248F2A1D395484

Vidím tam firewall od AVG - máš jej nebo to je pozůstatek po odinstalaci?

Stáhni si MBR Rootkit Detektor
- ulož si ho přímo na disk C a spusť ho
- za chvíli se ti vytvoří jeho log (mbr.log) vlož sem celý jeho obsah.