PC-HELP.CZ

Pokračování odsud.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:19:04, on 18.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFSE.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ICQ7.6\ICQ.exe
C:\Program Files\Start Menu 7\StartMenu7.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\Speedead\Data aplikací\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\Common Files\ArcSoft\esinter\Bin\eservutil.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\AVG\AVG2012\avgfws.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Speedead\Dokumenty\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [Adobe ARM] "c:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [EPSON PX710W Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFSE.EXE /FU "C:\WINDOWS\TEMP\E_S6A3.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] ~"C:\Program Files\ICQ7.6\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [StartMenu7] "C:\Program Files\Start Menu 7\StartMenu7.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1614895754-1979792683-725345543-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Search the Web - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... ab_nvd.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: ArcSoft Exchange Service (ADExchange) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\esinter\Bin\eservutil.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: CardBusService - Unknown owner - C:\Program Files\Common Files\AVerMedia\Service\CardBusService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

--
End of file - 13643 bytes

Odinstaluj:
CENZURA Toolbar
Spigot
SweetIMToolbars
facemoods Toolbar

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
R3 - URLSearchHook: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O4 - HKLM\..\Run: [facemoods] "C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Speedead\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
************************************************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti: Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko Konec.
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje a poté kliknutím na OK spusť program
- nech vybranou možnost Rychlá kontrola a klikni na tlačítko Prohledat

Bude-li nalezen problém:
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost Uložit protokol a ulož si log na Plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
- výsledný log mi sem zkopíruj
(zatím nic nemaž!).

Nebude-li nalezen problém:
- Klikni na tlačítko "OK" a sděl mi to

SweetIMToolbars jsem odinstaloval, ale ač se považuju za celkem znalého uživatele Win, tak nevím, jak mám odinslalovat zbytek. Nikde jsem sekvenci na odinstalování nenašel.

Tak pokračuj dál..

Malwarebytes' Anti-Malware nic nenašlo.

Vetřelce se ale podařilo zlikvidovat jen částečně. Po pokusu přejít na http://www.srazcyklistu.cz to napíše toto:

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Počítač přežil čištění v pohodě. Ale potvora stále přežívá (viz můj příspěvek výše), asi se zahryzla hodně hluboko.


ComboFix 11-11-23.02 - Speedead 24.11.2011 0:33.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2637 [GMT 1:00]
Spuštěný z: c:\documents and settings\Speedead\Dokumenty\Downloads\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\prefs.js
c:\windows\COM+.log
c:\windows\IsUn0405.exe
c:\windows\regopt.log
c:\windows\system32\sysav3gppro.dll
c:\windows\system32\TZLog.log
c:\windows\ydi.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-24 do 2011-11-24 )))))))))))))))))))))))))))))))
.
.
2011-11-18 02:37 . 2011-11-23 22:49 -------- d-----w- C:\Basicom
2011-11-06 11:02 . 2011-11-06 11:02 -------- d-----w- C:\found.000
2011-11-05 13:09 . 2011-11-19 08:44 -------- d-----w- C:\Games
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\54026D5CAFBFC8633DA64B1072
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\A2EB552CFD6D8A85A0EC1F
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\54C232E9BE812525C478E73F8D
2011-11-04 15:50 . 2011-11-04 15:51 -------- d-----w- C:\204dcc7dba4f45050d
2011-11-03 04:48 . 2011-11-03 04:48 -------- d-----w- C:\ProgramData
2011-11-02 20:10 . 2011-11-02 20:10 -------- d-----w- C:\$AVG
2011-10-31 15:46 . 2011-10-31 15:46 -------- d-----r- C:\MSOCache
2011-10-30 18:41 . 2008-05-16 04:51 -------- d-----w- C:\FR90PE_VOL
2011-10-30 12:10 . 2011-10-30 12:10 -------- d-----w- C:\8afeae635181aa51bfb4c9
2011-10-30 12:06 . 2011-11-23 16:13 -------- d-----r- C:\Program Files
2011-10-30 12:05 . 2011-10-30 11:54 -------- d-----w- C:\Documents and Settings
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-07 05:23 . 2011-07-11 00:13 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 05:21 . 2011-07-11 00:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-09-28 16:03 . 2011-09-28 16:03 61312 ----a-w- c:\windows\system32\drivers\silabser.sys
2011-09-28 07:06 . 2006-03-02 12:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2006-03-02 12:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2006-03-02 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-13 05:30 . 2011-07-11 00:13 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 14:10 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-02 06:31 . 2011-09-02 06:31 55064 ----a-w- c:\windows\system32\LMouFiltCoInst.dll
2011-09-02 06:31 . 2011-09-02 06:31 39192 ----a-w- c:\windows\system32\drivers\LMouFilt.Sys
2011-09-02 06:31 . 2011-09-02 06:31 30360 ----a-w- c:\windows\system32\drivers\LUsbFilt.sys
2011-09-02 06:31 . 2011-09-02 06:31 41240 ----a-w- c:\windows\system32\drivers\LHidFilt.Sys
2011-09-02 06:31 . 2011-09-02 06:31 1583896 ----a-w- c:\windows\system32\LkmdfCoInst.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartMenu7"="c:\program files\Start Menu 7\StartMenu7.exe" [2011-05-24 2750872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-24 2415456]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-01-12 669520]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Speedead\Nabídka Start\Programy\Po spuštění\
Dropbox.lnk - c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\Dropbox.exe [2011-9-2 24183152]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-10-30 113664]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-31 618496]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Documents and Settings\\Speedead\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11.7.2011 1:14 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11.7.2011 1:13 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11.7.2011 1:13 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11.7.2011 1:14 295248]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [31.10.2011 17:06 232512]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [6.12.2007 21:03 660768]
R2 ADExchange;ArcSoft Exchange Service;c:\program files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [26.10.2011 10:32 37280]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [27.9.2011 20:08 745880]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [24.10.2011 20:29 2398512]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2.8.2011 6:09 192776]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [31.10.2011 16:34 12184]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [30.10.2011 12:54 2253120]
R3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner;c:\windows\system32\drivers\AVerFx2hbtv.sys [31.10.2011 16:36 220672]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11.7.2011 1:14 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11.7.2011 1:14 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11.7.2011 1:14 16720]
R3 itchfltr;iTouch Keyboard Filter;c:\windows\system32\drivers\itchfltr.sys [18.11.2011 20:46 12953]
S2 CardBusService;CardBusService;c:\program files\Common Files\AVerMedia\Service\CardBusService.exe [31.10.2011 16:35 188416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
S3 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12.10.2011 6:25 4433248]
S3 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.SYS [16.11.2011 23:01 3584]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [10.6.2010 20:11 47176]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [28.9.2011 17:03 61312]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-23 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23 14:03]
.
2011-11-23 c:\windows\Tasks\User_Feed_Synchronization-{6B46EA05-0D6F-448F-A601-CDCE9ED259EF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://home.sweetim.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 192.169.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-ICQ - ~c:\program files\ICQ7.6\ICQ.exe
HKLM-Run-NWEReboot - (no file)

.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-24 01:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1524)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Celkový čas: 2011-11-24 01:02:50
ComboFix-quarantined-files.txt 2011-11-24 00:02
.
Před spuštěním: Volných bajtů: 594 577 534 976
Po spuštění: Volných bajtů: 595 816 611 840
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - BBEE8A50FE7A5A2B1EF08C33E1FE6BCB

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu



V poznámkovém bloku otevři soubor C:\Windows\system32\drivers\etc\hosts a vlož sem jeho obsah

ComboFix 11-11-26.04 - Speedead 26.11.2011 21:08:46.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2602 [GMT 1:00]
Spuštěný z: c:\documents and settings\Speedead\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Speedead\Plocha\CFScript.txt
AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\CF32566.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-26 do 2011-11-26 )))))))))))))))))))))))))))))))
.
.
2011-11-06 11:02 . 2011-11-06 11:02 -------- d-----w- C:\found.000
2011-11-05 13:09 . 2011-11-19 08:44 -------- d-----w- C:\Games
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\54026D5CAFBFC8633DA64B1072
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\A2EB552CFD6D8A85A0EC1F
2011-11-04 17:36 . 2011-11-04 17:36 -------- d-----w- C:\54C232E9BE812525C478E73F8D
2011-11-04 15:50 . 2011-11-04 15:51 -------- d-----w- C:\204dcc7dba4f45050d
2011-11-03 04:48 . 2011-11-03 04:48 -------- d-----w- C:\ProgramData
2011-11-02 20:10 . 2011-11-02 20:10 -------- d-----w- C:\$AVG
2011-10-31 15:46 . 2011-10-31 15:46 -------- d-----r- C:\MSOCache
2011-10-30 18:41 . 2008-05-16 04:51 -------- d-----w- C:\FR90PE_VOL
2011-10-30 12:10 . 2011-10-30 12:10 -------- d-----w- C:\8afeae635181aa51bfb4c9
2011-10-30 12:06 . 2011-11-23 16:13 -------- d-----r- C:\Program Files
2011-10-30 12:05 . 2011-10-30 11:54 -------- d-----w- C:\Documents and Settings
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-07 05:23 . 2011-07-11 00:13 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 05:21 . 2011-07-11 00:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-09-28 16:03 . 2011-09-28 16:03 61312 ----a-w- c:\windows\system32\drivers\silabser.sys
2011-09-28 07:06 . 2006-03-02 12:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2006-03-02 12:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2006-03-02 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-13 05:30 . 2011-07-11 00:13 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 14:10 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-02 06:31 . 2011-09-02 06:31 55064 ----a-w- c:\windows\system32\LMouFiltCoInst.dll
2011-09-02 06:31 . 2011-09-02 06:31 39192 ----a-w- c:\windows\system32\drivers\LMouFilt.Sys
2011-09-02 06:31 . 2011-09-02 06:31 30360 ----a-w- c:\windows\system32\drivers\LUsbFilt.sys
2011-09-02 06:31 . 2011-09-02 06:31 41240 ----a-w- c:\windows\system32\drivers\LHidFilt.Sys
2011-09-02 06:31 . 2011-09-02 06:31 1583896 ----a-w- c:\windows\system32\LkmdfCoInst.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\204dcc7dba4f45050d ----
.
2011-05-18 22:24 . 2011-05-18 22:24 37404 ----a-w- c:\204dcc7dba4f45050d\2070\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37314 ----a-w- c:\204dcc7dba4f45050d\3082\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 31108 ----a-w- c:\204dcc7dba4f45050d\1041\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 30194 ----a-w- c:\204dcc7dba4f45050d\1042\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36962 ----a-w- c:\204dcc7dba4f45050d\1043\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36514 ----a-w- c:\204dcc7dba4f45050d\1044\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37222 ----a-w- c:\204dcc7dba4f45050d\1045\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36738 ----a-w- c:\204dcc7dba4f45050d\1046\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37656 ----a-w- c:\204dcc7dba4f45050d\1049\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36020 ----a-w- c:\204dcc7dba4f45050d\1053\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36274 ----a-w- c:\204dcc7dba4f45050d\1055\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 27922 ----a-w- c:\204dcc7dba4f45050d\2052\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36822 ----a-w- c:\204dcc7dba4f45050d\1029\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36050 ----a-w- c:\204dcc7dba4f45050d\1030\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 38050 ----a-w- c:\204dcc7dba4f45050d\1031\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 38958 ----a-w- c:\204dcc7dba4f45050d\1032\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 36030 ----a-w- c:\204dcc7dba4f45050d\1035\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37832 ----a-w- c:\204dcc7dba4f45050d\1036\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 32912 ----a-w- c:\204dcc7dba4f45050d\1037\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37822 ----a-w- c:\204dcc7dba4f45050d\1038\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 37192 ----a-w- c:\204dcc7dba4f45050d\1040\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 34086 ----a-w- c:\204dcc7dba4f45050d\1025\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 27950 ----a-w- c:\204dcc7dba4f45050d\1028\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 27950 ----a-w- c:\204dcc7dba4f45050d\3076\LocalizedData.xml
2011-05-18 22:24 . 2011-05-18 22:24 3628 ----a-w- c:\204dcc7dba4f45050d\header.bmp
2011-05-18 22:24 . 2011-05-18 22:24 196662 ----a-w- c:\204dcc7dba4f45050d\SplashScreen.bmp
2011-05-18 22:24 . 2011-05-18 22:24 13606 ----a-w- c:\204dcc7dba4f45050d\Strings.xml
2011-05-18 22:24 . 2011-05-18 22:24 36180 ----a-w- c:\204dcc7dba4f45050d\UiInfo.xml
2011-05-18 22:24 . 2011-05-18 22:24 123035 ----a-w- c:\204dcc7dba4f45050d\1025\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 128333 ----a-w- c:\204dcc7dba4f45050d\1028\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 101146 ----a-w- c:\204dcc7dba4f45050d\1029\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 109464 ----a-w- c:\204dcc7dba4f45050d\1030\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 91719 ----a-w- c:\204dcc7dba4f45050d\1031\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 102048 ----a-w- c:\204dcc7dba4f45050d\1032\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 138595 ----a-w- c:\204dcc7dba4f45050d\1033\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 111176 ----a-w- c:\204dcc7dba4f45050d\1035\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 133172 ----a-w- c:\204dcc7dba4f45050d\1036\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 125351 ----a-w- c:\204dcc7dba4f45050d\1037\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 110879 ----a-w- c:\204dcc7dba4f45050d\1038\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 124974 ----a-w- c:\204dcc7dba4f45050d\1040\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 111958 ----a-w- c:\204dcc7dba4f45050d\1041\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 149503 ----a-w- c:\204dcc7dba4f45050d\1042\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 35285 ----a-w- c:\204dcc7dba4f45050d\1043\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 36083 ----a-w- c:\204dcc7dba4f45050d\1044\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 126541 ----a-w- c:\204dcc7dba4f45050d\1045\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 109574 ----a-w- c:\204dcc7dba4f45050d\1046\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 49319 ----a-w- c:\204dcc7dba4f45050d\1049\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 125073 ----a-w- c:\204dcc7dba4f45050d\1053\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 112947 ----a-w- c:\204dcc7dba4f45050d\1055\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 110754 ----a-w- c:\204dcc7dba4f45050d\2052\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 125196 ----a-w- c:\204dcc7dba4f45050d\2070\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 2060 ----a-w- c:\204dcc7dba4f45050d\3076\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 108174 ----a-w- c:\204dcc7dba4f45050d\3082\eula.rtf
2011-05-18 22:24 . 2011-05-18 22:24 15742 ----a-w- c:\204dcc7dba4f45050d\ParameterInfo.xml
2011-05-18 22:24 . 2011-05-18 22:24 104072 ----a-w- c:\204dcc7dba4f45050d\watermark.bmp
2011-05-18 21:55 . 2011-05-18 21:55 19624448 ----a-w- c:\204dcc7dba4f45050d\NDP40-KB2533523.msp
2011-05-17 11:04 . 2011-05-17 11:04 35802 ----a-w- c:\204dcc7dba4f45050d\1033\LocalizedData.xml
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\3082\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\2070\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17240 ----a-w- c:\204dcc7dba4f45050d\1055\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 13656 ----a-w- c:\204dcc7dba4f45050d\2052\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\1049\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17240 ----a-w- c:\204dcc7dba4f45050d\1053\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17752 ----a-w- c:\204dcc7dba4f45050d\1046\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17240 ----a-w- c:\204dcc7dba4f45050d\1044\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17752 ----a-w- c:\204dcc7dba4f45050d\1045\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 15192 ----a-w- c:\204dcc7dba4f45050d\1041\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 14680 ----a-w- c:\204dcc7dba4f45050d\1042\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18776 ----a-w- c:\204dcc7dba4f45050d\1043\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\1038\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17752 ----a-w- c:\204dcc7dba4f45050d\1040\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 16216 ----a-w- c:\204dcc7dba4f45050d\1037\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\1036\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 16728 ----a-w- c:\204dcc7dba4f45050d\1033\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17752 ----a-w- c:\204dcc7dba4f45050d\1035\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18264 ----a-w- c:\204dcc7dba4f45050d\1031\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 18776 ----a-w- c:\204dcc7dba4f45050d\1032\SetupResources.dll
2011-05-17 07:42 . 2011-05-17 07:42 17752 ----a-w- c:\204dcc7dba4f45050d\1030\SetupResources.dll
2011-05-17 07:41 . 2011-05-17 07:41 17752 ----a-w- c:\204dcc7dba4f45050d\1029\SetupResources.dll
2011-05-17 07:41 . 2011-05-17 07:41 13656 ----a-w- c:\204dcc7dba4f45050d\1028\SetupResources.dll
2011-05-17 07:41 . 2011-05-17 07:41 13656 ----a-w- c:\204dcc7dba4f45050d\3076\SetupResources.dll
2011-05-17 07:41 . 2011-05-17 07:41 295760 ----a-w- c:\204dcc7dba4f45050d\SetupUi.dll
2011-05-17 07:41 . 2011-05-17 07:41 16728 ----a-w- c:\204dcc7dba4f45050d\1025\SetupResources.dll
2011-05-17 07:41 . 2011-05-17 07:41 809304 ----a-w- c:\204dcc7dba4f45050d\SetupEngine.dll
2011-05-17 07:41 . 2011-05-17 07:41 78152 ----a-w- c:\204dcc7dba4f45050d\Setup.exe
2011-05-17 07:27 . 2011-05-17 07:27 16118 ----a-w- c:\204dcc7dba4f45050d\DHtmlHeader.html
2011-05-17 07:27 . 2011-05-17 07:27 30120 ----a-w- c:\204dcc7dba4f45050d\SetupUi.xsd
2011-05-17 07:27 . 2011-05-17 07:27 144416 ----a-w- c:\204dcc7dba4f45050d\sqmapi.dll
2011-05-17 06:02 . 2011-05-17 06:02 1150 ----a-w- c:\204dcc7dba4f45050d\Graphics\Print.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate1.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate2.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate3.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate4.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate5.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate6.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate7.ico
2011-05-17 06:02 . 2011-05-17 06:02 894 ----a-w- c:\204dcc7dba4f45050d\Graphics\Rotate8.ico
2011-05-17 06:02 . 2011-05-17 06:02 1150 ----a-w- c:\204dcc7dba4f45050d\Graphics\Save.ico
2011-05-17 06:02 . 2011-05-17 06:02 36710 ----a-w- c:\204dcc7dba4f45050d\Graphics\Setup.ico
2011-05-17 06:02 . 2011-05-17 06:02 10134 ----a-w- c:\204dcc7dba4f45050d\Graphics\stop.ico
2011-05-17 06:02 . 2011-05-17 06:02 1150 ----a-w- c:\204dcc7dba4f45050d\Graphics\SysReqMet.ico
2011-05-17 06:02 . 2011-05-17 06:02 1150 ----a-w- c:\204dcc7dba4f45050d\Graphics\SysReqNotMet.ico
2011-05-17 06:02 . 2011-05-17 06:02 10134 ----a-w- c:\204dcc7dba4f45050d\Graphics\warn.ico
.
---- Directory of C:\54026D5CAFBFC8633DA64B1072 ----
.
.
---- Directory of C:\54C232E9BE812525C478E73F8D ----
.
.
---- Directory of C:\8afeae635181aa51bfb4c9 ----
.
2011-10-30 12:10 . 2008-06-19 05:33 2204 ------w- c:\8afeae635181aa51bfb4c9\i386\msxpsdrv.inf
2011-10-30 12:10 . 2008-06-19 10:03 73 ------w- c:\8afeae635181aa51bfb4c9\i386\msxpsinc.gpd
2011-10-30 12:10 . 2008-06-19 05:33 72 ------w- c:\8afeae635181aa51bfb4c9\i386\msxpsinc.ppd
2011-10-30 12:10 . 2008-06-19 05:33 2204 ------w- c:\8afeae635181aa51bfb4c9\amd64\msxpsdrv.inf
2011-10-30 12:10 . 2008-06-19 05:33 72 ------w- c:\8afeae635181aa51bfb4c9\amd64\msxpsinc.ppd
2011-10-30 12:10 . 2008-07-06 12:06 10929 ------w- c:\8afeae635181aa51bfb4c9\amd64\msxpsdrv.cat
2011-10-30 12:10 . 2008-07-06 12:06 10929 ------w- c:\8afeae635181aa51bfb4c9\i386\msxpsdrv.cat
2011-10-30 12:10 . 2008-07-06 12:06 147456 ------w- c:\8afeae635181aa51bfb4c9\amd64\filterpipelineprintproc.dll
2011-10-30 12:10 . 2008-07-06 12:06 89088 ------w- c:\8afeae635181aa51bfb4c9\i386\filterpipelineprintproc.dll
2011-10-30 12:10 . 2008-07-06 12:06 765440 ------w- c:\8afeae635181aa51bfb4c9\i386\mxdwdrv.dll
2011-10-30 12:10 . 2008-07-06 12:06 1676288 ------w- c:\8afeae635181aa51bfb4c9\i386\xpssvcs.dll
2011-10-30 12:10 . 2008-07-06 12:06 748032 ------w- c:\8afeae635181aa51bfb4c9\amd64\mxdwdrv.dll
2008-07-06 16:36 . 2008-07-06 16:36 2936832 ------w- c:\8afeae635181aa51bfb4c9\amd64\xpssvcs.dll
2008-06-19 10:03 . 2008-06-19 10:03 73 ------w- c:\8afeae635181aa51bfb4c9\amd64\msxpsinc.gpd
.
---- Directory of C:\A2EB552CFD6D8A85A0EC1F ----
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-24_00.00.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-26 20:20 . 2011-11-26 20:20 16384 c:\windows\temp\Perflib_Perfdata_e58.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartMenu7"="c:\program files\Start Menu 7\StartMenu7.exe" [2011-05-24 2750872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-24 2415456]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-01-12 669520]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Speedead\Nabídka Start\Programy\Po spuštění\
Dropbox.lnk - c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\Dropbox.exe [2011-9-2 24183152]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-10-30 113664]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-10-31 618496]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Documents and Settings\\Speedead\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11.7.2011 1:14 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11.7.2011 1:13 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11.7.2011 1:13 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11.7.2011 1:14 295248]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [31.10.2011 17:06 232512]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [6.12.2007 21:03 660768]
R2 ADExchange;ArcSoft Exchange Service;c:\program files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [26.10.2011 10:32 37280]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [27.9.2011 20:08 745880]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [24.10.2011 20:29 2398512]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2.8.2011 6:09 192776]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [31.10.2011 16:34 12184]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [30.10.2011 12:54 2253120]
R3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner;c:\windows\system32\drivers\AVerFx2hbtv.sys [31.10.2011 16:36 220672]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
R3 itchfltr;iTouch Keyboard Filter;c:\windows\system32\drivers\itchfltr.sys [18.11.2011 20:46 12953]
S2 CardBusService;CardBusService;c:\program files\Common Files\AVerMedia\Service\CardBusService.exe [31.10.2011 16:35 188416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
S3 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12.10.2011 6:25 4433248]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11.7.2011 1:14 134608]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11.7.2011 1:14 24272]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11.7.2011 1:14 16720]
S3 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.SYS [16.11.2011 23:01 3584]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [10.6.2010 20:11 47176]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [28.9.2011 17:03 61312]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-26 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23 14:03]
.
2011-11-26 c:\windows\Tasks\User_Feed_Synchronization-{6B46EA05-0D6F-448F-A601-CDCE9ED259EF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 192.169.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-26 21:21
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1568)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(928)
c:\documents and settings\Speedead\Data aplikací\Dropbox\bin\DropboxExt.14.dll
c:\program files\Logitech\iTouch\iTchHk.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
c:\program files\Start Menu 7\VistaStartMenu.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RunDLL32.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-11-26 21:27:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-26 20:27
ComboFix2.txt 2011-11-24 00:02
.
Před spuštěním: Volných bajtů: 595 548 975 104
Po spuštění: Volných bajtů: 595 526 754 304
.
- - End Of File - - 0BC6B9121E4FE0CBA306E700C2A4106D

V poznámkovém bloku otevři soubor C:\Windows\system32\drivers\etc\hosts a vlož sem jeho obsah

127.0.0.1 localhost

Smaž:
C:\54026D5CAFBFC8633DA64B1072
C:\54C232E9BE812525C478E73F8D
C:\A2EB552CFD6D8A85A0EC1F

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+ Nový log z HJT

Jak se chová PC?

Smaž:
C:\54026D5CAFBFC8633DA64B1072
C:\54C232E9BE812525C478E73F8D
C:\A2EB552CFD6D8A85A0EC1F

V rootu C, ač jsem zapnul zobrazování systémových a skrytých souborů, nic není. Opravdu to tam není a nebo je to jen rafinovaně v průzkumníku schovaný a musím na to jinak?

Pokud je nanejdeš, nic moc se neděje, jsou prázdné