Neplatná alikace typu Win 32 Vyřešeno

[gena17]

Prosím o radu od včerejška se mě začal neustále vypínat PC, když sem potom čím to je tak V procesech CPU jede na 100% a nemám nic spuštěno.Dělá to proces taksmgr.exe Tak sem badal na NETU a našel jen to že mám přeinstalovat SP 3. jenže ouha nejde to ! Říkám si dám sem log z HijackThis taky nejde nainstalovat.A pořád nemám zdání proč
Ještě jedna věc nemohl sem se dostat do nouzáku asi aš po šesti hodinách sem do něj dostal



Pomůže mně někdo dík do předu

[Reklama]

[Marinus]

Zkus si stáhnout a spustit tento program: http://download.bleepingcomputer.com/sUBs/Beagled.exe -> program vyhledá specifický druh viru a opraví nouzový režim -> potvrď případnou výzvu k restartu počítače -> vlož sem obsah vytvořeného logu C:\Bagled.txt.

[gena17]

//téma na žádost přesunuto

Takže nenašel nic napsal jen toto
Bagle_Remover.exe
Date: so 11.10.2008
Time: 10:21:58,50
Ale konečně se mě podařilo spustit HijackThis takže prosím Moderatory aby měto přesměrovali do sekce HiJackThis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:45, on 11.10.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\WINDOWS\OETRN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
F3 - REG:win.ini: run=
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [combofix] cmd /c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\8agle.cmd"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [OEXPRESS] C:\WINDOWS\OETRN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - C:\Casino\Europa Casino\casino.exe
O9 - Extra 'Tools' menuitem: Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - C:\Casino\Europa Casino\casino.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\Software\..\Telephony: DomainName = vak-bv.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: Domain = vak-bv.cz
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Google Update Service (gupdate1c9165052630c6c) (gupdate1c9165052630c6c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9100 bytes

[Marinus]

Dobře, vlož sem ještě pro detailnější analýzu log z ComboFixu:

Klikni pravým tlačítkem myši na tento odkaz: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
▪ Vyber možnost Uložit odkaz jako a v poli Název souboru smaž název: ComboFix a zadej do něj název: VirTerminator
▪ Po změnění názvu klikni na tlačítko Uložit a ulož takto přejmenovaný ComboFix na plochu
▪ Jdi přes Start - Spustit - do volného řádku zkopíruj cestu: "%userprofile%\Plocha\VirTerminator.exe" /killall a klikni na OK
▪ Spustí se ComboFix - potvrď podmínky užití stiskem tlačítka Ano
▪ Postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
▪ Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem celý jeho obsah

[gena17]

ComboFix 08-10-10.09 - Administrator 2008-10-11 15:26:53.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.748 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Administrator\Plocha\VirTerminator.exe
Použité ovládací přepínače :: /killall

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\Dvbpws.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-09-11 do 2008-10-11 )))))))))))))))))))))))))))))))
.

2008-10-11 11:50 . 2008-10-11 11:50 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-10-11 11:49 . 2008-10-11 11:56 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-10-11 11:49 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-10-11 11:49 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-10-11 10:17 . 2008-10-11 10:18 1,393 --a------ C:\WINDOWS\imsins.BAK
2008-10-11 10:15 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\000001_.tmp
2008-10-11 10:00 . 2008-10-11 15:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-11 10:00 . 2008-10-11 12:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-11 02:06 . 2008-10-11 02:13 2,939,121 --a------ C:\Program Files\ComboFix.exe
2008-10-11 01:33 . 2008-10-11 01:35 <DIR> d-------- C:\Nová složka
2008-10-11 01:09 . 2008-10-11 01:10 <DIR> d-------- C:\Program Files\ScreenShots
2008-10-10 23:40 . 2008-10-11 11:16 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-10 23:40 . 2008-10-11 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-10-10 23:16 . 2008-10-10 23:17 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-10-10 22:53 . 2008-10-10 22:54 4,513,971 --a------ C:\WINDOWS\REGBK00.ZIP
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\zts2.exe
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2008-10-10 22:45 . 2008-10-10 22:45 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\MicroWorld
2008-10-10 22:45 . 2008-04-14 08:52 147,968 --a------ C:\WINDOWS\R.COM
2008-10-10 22:45 . 2008-04-14 08:52 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-10-10 22:45 . 2008-10-10 22:48 52 --a------ C:\WINDOWS\Lic.xxx
2008-10-10 22:22 . 2008-10-10 22:22 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-09 11:08 . 2008-10-09 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\QIP
2008-10-09 11:01 . 2008-10-09 11:01 <DIR> d-------- C:\Program Files\QIP
2008-10-09 10:42 . 2008-10-09 10:42 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2008-10-09 10:42 . 2008-10-09 10:42 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-10-09 10:29 . 2008-10-09 10:29 <DIR> d-------- C:\Program Files\Skype
2008-10-09 10:29 . 2008-10-09 10:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-10-09 10:29 . 2008-10-09 10:53 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Skype
2008-10-09 10:28 . 2008-10-09 10:29 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Skype
2008-10-09 09:48 . 2008-10-09 09:48 <DIR> d-------- C:\Program Files\ICQ6Toolbar
2008-10-09 09:48 . 2008-10-09 09:48 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\ICQ
2008-10-09 09:45 . 2008-10-09 09:57 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\ICQ
2008-10-09 09:44 . 2008-10-09 09:57 <DIR> d-------- C:\Program Files\ICQ6
2008-10-08 21:52 . 2008-10-08 21:52 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Ashampoo
2008-10-08 21:47 . 2008-10-08 21:47 <DIR> d-------- C:\Program Files\Ashampoo
2008-10-08 21:47 . 2008-10-08 21:47 103,424 --a------ C:\WINDOWS\system32\PowerUp3_nat.dll
2008-10-08 21:42 . 2008-10-10 22:52 0 --a------ C:\WINDOWS\XXLGSC
2008-10-08 21:40 . 2008-10-08 21:40 356,352 --a------ C:\WINDOWS\TrnOutl.dll
2008-10-08 21:40 . 2008-10-08 21:40 294,912 --a------ C:\WINDOWS\TrnWord.dll
2008-10-08 21:40 . 2008-10-08 21:40 200,704 --a------ C:\WINDOWS\TRNOET.DLL
2008-10-08 21:40 . 2008-10-08 21:40 45,056 --a------ C:\WINDOWS\TRNOEH.DLL
2008-10-08 21:40 . 2008-10-08 21:40 26,624 --a------ C:\WINDOWS\OETRN.EXE
2008-10-08 21:40 . 2008-10-08 21:40 33 --a------ C:\WINDOWS\WTRDCTM.INI
2008-10-08 21:39 . 2008-10-08 21:39 516,096 --a------ C:\WINDOWS\UN32.EXE
2008-10-08 21:39 . 2008-10-08 21:39 2,753 --a------ C:\WINDOWS\UN32P.INI
2008-10-08 21:38 . 2008-10-08 21:42 <DIR> d-------- C:\TRANSLAT
2008-10-08 21:38 . 2008-10-10 22:52 4,235 --a------ C:\WINDOWS\WTRAN32.INI
2008-10-08 21:38 . 2008-10-11 11:15 2,529 --a------ C:\WINDOWS\TRNCOM.INI
2008-10-08 21:38 . 2008-10-08 21:43 1,849 --a------ C:\WINDOWS\WDICT32.INI
2008-10-08 21:38 . 2008-10-11 13:14 1,680 --a------ C:\WINDOWS\MAILTRAN.INI
2008-10-08 21:06 . 2008-10-08 21:06 <DIR> d-------- C:\Program Files\EA SPORTS
2008-10-08 18:50 . 2008-10-08 18:50 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-10-08 18:50 . 2008-10-08 18:50 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-10-08 18:49 . 2008-10-08 18:49 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-10-08 18:49 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-10-08 17:48 . 2008-10-08 17:55 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-10-08 17:43 . 2008-10-10 02:21 <DIR> d-------- C:\Program Files\ESET
2008-10-08 17:43 . 2008-10-08 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\ESET
2008-10-08 14:35 . 2008-10-08 14:35 <DIR> d-------- C:\SolarWinds
2008-10-08 11:42 . 2008-10-09 10:58 <DIR> d-------- C:\Program Files\3D Online Pool
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\Program Files\MSBuild
2008-10-08 11:21 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-10-08 10:51 . 2008-10-08 18:20 <DIR> d-------- C:\Program Files\SMS Zdarma
2008-10-08 10:41 . 2008-10-08 10:47 <DIR> d-------- C:\Program Files\Scorpions WinCheater
2008-10-08 10:11 . 2008-10-08 10:11 <DIR> d-------- C:\Program Files\AskSBar
2008-10-08 10:11 . 2008-10-08 10:11 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Azureus
2008-10-08 10:11 . 2008-10-08 10:48 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Azureus
2008-10-08 10:10 . 2008-10-08 10:11 <DIR> d-------- C:\Program Files\Vuze
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\PC TRANSLATOR DEMO
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\LangSoft
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\LangSoft
2008-10-04 13:23 . 2008-10-04 13:23 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\PlayFirst
2008-10-04 13:23 . 2008-10-04 13:23 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\PlayFirst
2008-10-03 23:26 . 2008-10-03 23:26 <DIR> d-------- C:\Program Files\CherrySoft
2008-10-03 23:25 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-10-03 20:43 . 2008-10-03 20:43 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\OLYMPUS
2008-10-03 20:41 . 2008-10-03 20:41 <DIR> d-------- C:\WINDOWS\Cache
2008-10-03 20:40 . 2008-10-03 20:40 <DIR> d-------- C:\Program Files\OLYMPUS
2008-10-03 20:40 . 2008-10-03 20:40 <DIR> d-------- C:\Binaries
2008-10-03 20:39 . 2004-06-08 17:41 319,488 --------- C:\WINDOWS\system32\Pvmjpg21.dll
2008-10-03 20:39 . 2005-04-30 17:02 86,016 --a------ C:\WINDOWS\system32\bgsvcgen.exe
2008-10-03 20:39 . 2005-04-30 17:09 57,344 --a------ C:\WINDOWS\system32\GenSvcInst.exe
2008-10-03 20:39 . 2005-05-11 00:33 32,256 --a------ C:\WINDOWS\system32\drivers\cdrbsdrv.sys
2008-10-03 20:38 . 2008-10-03 20:38 <DIR> d-------- C:\Program Files\PIXELA
2008-10-03 20:37 . 2008-10-03 20:40 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2008-10-03 20:37 . 2008-10-03 20:37 <DIR> d-------- C:\Program Files\QuickTime
2008-10-03 20:37 . 1999-11-10 12:05 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2008-10-03 20:36 . 2008-10-03 20:37 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\QuickTime
2008-09-28 15:41 . 2008-10-08 11:25 <DIR> d-------- C:\Program Files\NetSoftware
2008-09-28 14:09 . 2008-09-28 14:09 <DIR> d-------- C:\WINDOWS\Delicious Emilys Tea Garden
2008-09-28 14:09 . 2008-09-28 14:21 <DIR> d-------- C:\Program Files\Delicious Emilys Tea Garden
2008-09-28 08:18 . 2008-09-28 08:18 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\GameHouse
2008-09-27 16:52 . 2008-10-08 17:48 <DIR> d-------- C:\Program Files\PicLensIE
2008-09-27 16:23 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-27 16:23 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-27 16:23 . 2007-03-08 07:09 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-27 16:23 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-27 16:23 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-27 16:23 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-27 16:23 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-27 16:23 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-27 16:23 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-27 11:45 . 2008-09-27 11:45 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-27 11:45 . 2008-09-27 11:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-27 11:45 . 2008-09-27 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2008-09-22 03:00 . 2008-09-22 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-21 22:03 . 2008-10-03 21:21 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\gtk-2.0
2008-09-21 22:02 . 2008-09-21 22:02 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Inkscape
2008-09-21 21:56 . 2008-09-21 22:02 <DIR> d-------- C:\Program Files\Inkscape
2008-09-21 09:08 . 2008-09-21 09:08 <DIR> d-------- C:\Program Files\Build-a-lot 2 Town of the Year
2008-09-20 21:16 . 2008-09-20 21:16 <DIR> d-------- C:\Program Files\Governor of Poker
2008-09-20 21:09 . 2008-09-20 21:09 <DIR> d-------- C:\Program Files\Cinema Tycoon 2 Movie Mania
2008-09-20 20:23 . 2008-09-20 20:23 <DIR> d-------- C:\Program Files\Alawar
2008-09-20 20:23 . 2008-09-20 20:24 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\AlawarWrapper
2008-09-20 19:04 . 2008-09-20 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\MythPeople
2008-09-20 19:03 . 2008-09-20 20:04 <DIR> d-------- C:\Program Files\Miriel The Magical Merchant
2008-09-20 15:48 . 2008-09-20 18:59 <DIR> d-------- C:\Program Files\Buildalot 2 Town Of The Year
2008-09-20 15:45 . 2008-09-20 15:45 <DIR> d-------- C:\Program Files\ReflexiveArcade

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-11 13:30 --------- d-----w C:\Documents and Settings\Administrator\Data aplikací\OpenOffice.org2
2008-10-11 11:30 --------- d-----w C:\Program Files\Zylom Games
2008-10-11 11:30 --------- d-----w C:\Documents and Settings\Administrator\Data aplikací\Zylom
2008-10-11 11:14 --------- d-----w C:\Program Files\eMule
2008-10-09 07:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-03 21:26 --------- d-----w C:\Program Files\CherrySoft
2008-09-12 19:36 --------- d-----w C:\Program Files\WinFast
2008-09-07 20:35 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2008-09-07 20:11 --------- d-----w C:\Program Files\PC Drivers HeadQuarters
2008-09-07 20:11 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters
2008-09-07 20:05 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-07 18:21 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-09-07 18:03 --------- d-----w C:\Program Files\C-Media
2008-09-07 17:20 --------- d-----w C:\Program Files\Lavalys
2008-09-07 16:22 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Zylom
2008-09-07 14:53 --------- d-----w C:\Documents and Settings\Forman\Data aplikací\OpenOffice.org2
2008-08-19 19:44 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-08-14 15:15 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-15 20:51 30,960,640 ----a-w C:\Program Files\StrongDC.pdb
2008-07-13 16:52 32,910 ----a-w C:\Program Files\changelog.txt
2008-07-13 16:52 23,555 ----a-w C:\Program Files\changelog-en.txt
2008-07-13 15:53 57,692 ----a-w C:\Program Files\EN_Example.xml
2008-07-06 13:15 139,755 ----a-w C:\Program Files\changelog-dc.txt
2007-03-02 17:16 18,593 ----a-w C:\Program Files\License.txt
2006-09-04 16:08 567 ----a-w C:\Program Files\dcppboot.xml
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-10-08 66912]

[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-10-08 10:11 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2008-10-11 655360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"OEXPRESS"="C:\WINDOWS\OETRN.EXE" [2008-10-08 26624]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [2007-05-16 69632]
"WinFast Schedule"="C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [2007-05-22 405504]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-13 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-10-03 77824]
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 40960]
"C-Media Mixer"="Mixer.exe" [2001-10-22 C:\WINDOWS\mixer.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Forman\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 393216]

C:\Documents and Settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 393216]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytoosl"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=\\vak-bv.cz\sysvol\vak-bv.cz\scripts\Vak.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1614895754-1788223648-682003330-1155\Scripts\Logon\0\0]
"Script"=vodne.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 08:52 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-09-16 12:16 1833296 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Czech\\setup.exe"=
"C:\\Documents and Settings\\Administrator\\Plocha\\StrongDC.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-14 69120]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 9446]
R3 WFLR6654;WinFast DTV1800 H (Video);C:\WINDOWS\system32\drivers\wfeaglxt.sys [2007-01-19 393088]
S2 gupdate1c9165052630c6c;Google Update Service (gupdate1c9165052630c6c);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-14 133104]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2008-03-17 23152]
.
Obsah adresáře 'Naplánované úlohy'

2008-10-11 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-14 12:11]
.
.
------- Doplňkový sken -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\snf9m286.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.seznam.cz
FF -: plugin - C:\Documents and Settings\All Users\Data aplikacĂ­\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Google\Google Earth Plugin\npgeplugin.dll
FF -: plugin - C:\Program Files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-11 15:30:37
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\EverestDriver]
"ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
------------------------ Jiné spuštené procesy ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
.
**************************************************************************
.
Celkový čas: 2008-10-11 15:34:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-10-11 13:34:08
ComboFix2.txt 2008-10-11 10:12:10

Před spuštěním: Volných bajtů: 161 143 648 256
Po spuštění: Volných bajtů: 161,230,016,512

276 --- E O F --- 2008-09-29 01:00:31

[Marinus]

Problémy stále přetrvávají?

Spusť Poznámkový blok přes Start - Programy - Příslušenství a zkopíruj do něj celý tento text:

Kód: Vybrat vše

File::
C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
C:\WINDOWS\000001_.tmp
C:\WINDOWS\XXLGSC

Folder::
C:\Program Files\AskSBar

Registry::
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytoosl"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

Zvol možnost Uložit soubor jako, pojmenuj soubor CFScript.txt a zvol Uložit jako typ Všechny soubory. Ulož soubor na plochu.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.

Automaticky se spustí ComboFix, vlož sem log, který vyběhne v závěru čistícího procesu.

Vlož sem log z ComboFixu a nový log z HijackThis.

[gena17]

prblémy zpusobovala cera se svim CD které přitáhla ze školy Nešlo to nainstalovat ,ale jen se to tak tvářilo.Protože to natahalo šmejdy do PC Pak nastaly ty problémy!!!!
ale tu je ten log


ComboFix 08-10-10.09 - Administrator 2008-10-11 19:40:11.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.667 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Administrator\Plocha\VirTerminator.exe
Použité ovládací přepínače :: C:\Documents and Settings\Administrator\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

[B]VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
C:\WINDOWS\000001_.tmp
C:\WINDOWS\XXLGSC
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
C:\Program Files\AskSBar\bar\Cache\0006EED7
C:\Program Files\AskSBar\bar\Cache\0057FB02.bin
C:\Program Files\AskSBar\bar\Cache\0057FD35.bin
C:\Program Files\AskSBar\bar\Cache\0057FF48.bin
C:\Program Files\AskSBar\bar\Cache\005800AF.bin
C:\Program Files\AskSBar\bar\Cache\00580236.bin
C:\Program Files\AskSBar\bar\Cache\00580524.bin
C:\Program Files\AskSBar\bar\Cache\files.ini
C:\Program Files\AskSBar\bar\History\search2
C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
C:\WINDOWS\000001_.tmp
C:\WINDOWS\XXLGSC

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-09-11 do 2008-10-11 )))))))))))))))))))))))))))))))
.

2008-10-11 19:01 . 2008-10-11 19:01 26 --a------ C:\WINDOWS\escan.dbf
2008-10-11 19:01 . 2008-10-11 19:01 20 --a------ C:\WINDOWS\WIN.PRO
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\PUB
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Program Files\Common Files\MicroWorld
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\remoteservice
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\LocalService\Plocha
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\LocalService\Oblíbené položky
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\LocalService\Šablony
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\LocalService\Nabídka Start
2008-10-11 18:57 . 2008-10-11 18:57 <DIR> d-------- C:\Documents and Settings\LocalService\Dokumenty
2008-10-11 18:57 . 2008-10-11 18:57 94,002 --a------ C:\WINDOWS\winsbak2.reg
2008-10-11 18:57 . 2008-10-11 18:57 12,946 --a------ C:\WINDOWS\winsbak.reg
2008-10-11 18:57 . 2008-08-14 17:08 211 --a------ C:\bootini.ins
2008-10-11 18:57 . 2008-10-11 18:57 0 --a------ C:\23990098.$$$
2008-10-11 18:56 . 2008-10-11 19:23 <DIR> d-------- C:\Program Files\eScan
2008-10-11 11:50 . 2008-10-11 11:50 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-10-11 11:49 . 2008-10-11 11:56 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-10-11 11:49 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-10-11 11:49 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-10-11 10:17 . 2008-10-11 10:18 1,393 --a------ C:\WINDOWS\imsins.BAK
2008-10-11 10:00 . 2008-10-11 19:21 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-11 10:00 . 2008-10-11 12:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-11 02:06 . 2008-10-11 02:13 2,939,121 --a------ C:\Program Files\ComboFix.exe
2008-10-11 01:33 . 2008-10-11 17:42 <DIR> d-------- C:\Nová složka
2008-10-11 01:09 . 2008-10-11 01:10 <DIR> d-------- C:\Program Files\ScreenShots
2008-10-10 23:40 . 2008-10-11 11:16 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-10 23:40 . 2008-10-11 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-10-10 23:16 . 2008-10-10 23:17 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-10-10 22:53 . 2008-10-10 22:54 4,513,971 --a------ C:\WINDOWS\REGBK00.ZIP
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\zts2.exe
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2008-10-10 22:48 . 2008-10-10 22:48 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2008-10-10 22:45 . 2008-10-10 22:45 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\MicroWorld
2008-10-10 22:45 . 2008-04-14 08:52 147,968 --a------ C:\WINDOWS\R.COM
2008-10-10 22:45 . 2008-04-14 08:52 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-10-10 22:45 . 2008-10-10 22:48 52 --a------ C:\WINDOWS\Lic.xxx
2008-10-10 22:22 . 2008-10-10 22:22 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-09 11:08 . 2008-10-09 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\QIP
2008-10-09 11:01 . 2008-10-09 11:01 <DIR> d-------- C:\Program Files\QIP
2008-10-09 10:42 . 2008-10-09 10:42 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2008-10-09 10:42 . 2008-10-09 10:42 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-10-09 10:29 . 2008-10-09 10:29 <DIR> d-------- C:\Program Files\Skype
2008-10-09 10:29 . 2008-10-09 10:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-10-09 10:29 . 2008-10-09 10:53 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Skype
2008-10-09 10:28 . 2008-10-09 10:29 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Skype
2008-10-09 09:48 . 2008-10-09 09:48 <DIR> d-------- C:\Program Files\ICQ6Toolbar
2008-10-09 09:48 . 2008-10-09 09:48 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\ICQ
2008-10-09 09:45 . 2008-10-09 09:57 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\ICQ
2008-10-09 09:44 . 2008-10-09 09:57 <DIR> d-------- C:\Program Files\ICQ6
2008-10-08 21:52 . 2008-10-08 21:52 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Ashampoo
2008-10-08 21:47 . 2008-10-08 21:47 <DIR> d-------- C:\Program Files\Ashampoo
2008-10-08 21:47 . 2008-10-08 21:47 103,424 --a------ C:\WINDOWS\system32\PowerUp3_nat.dll
2008-10-08 21:40 . 2008-10-08 21:40 356,352 --a------ C:\WINDOWS\TrnOutl.dll
2008-10-08 21:40 . 2008-10-08 21:40 294,912 --a------ C:\WINDOWS\TrnWord.dll
2008-10-08 21:40 . 2008-10-08 21:40 200,704 --a------ C:\WINDOWS\TRNOET.DLL
2008-10-08 21:40 . 2008-10-08 21:40 45,056 --a------ C:\WINDOWS\TRNOEH.DLL
2008-10-08 21:40 . 2008-10-08 21:40 26,624 --a------ C:\WINDOWS\OETRN.EXE
2008-10-08 21:40 . 2008-10-08 21:40 33 --a------ C:\WINDOWS\WTRDCTM.INI
2008-10-08 21:39 . 2008-10-08 21:39 516,096 --a------ C:\WINDOWS\UN32.EXE
2008-10-08 21:39 . 2008-10-08 21:39 2,753 --a------ C:\WINDOWS\UN32P.INI
2008-10-08 21:38 . 2008-10-08 21:42 <DIR> d-------- C:\TRANSLAT
2008-10-08 21:38 . 2008-10-11 17:57 4,235 --a------ C:\WINDOWS\WTRAN32.INI
2008-10-08 21:38 . 2008-10-11 17:38 2,529 --a------ C:\WINDOWS\TRNCOM.INI
2008-10-08 21:38 . 2008-10-08 21:43 1,849 --a------ C:\WINDOWS\WDICT32.INI
2008-10-08 21:38 . 2008-10-11 19:36 1,680 --a------ C:\WINDOWS\MAILTRAN.INI
2008-10-08 21:06 . 2008-10-08 21:06 <DIR> d-------- C:\Program Files\EA SPORTS
2008-10-08 18:50 . 2008-10-08 18:50 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-10-08 18:50 . 2008-10-08 18:50 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-10-08 18:49 . 2008-10-08 18:49 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-10-08 18:49 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-10-08 17:48 . 2008-10-08 17:55 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-10-08 17:43 . 2008-10-10 02:21 <DIR> d-------- C:\Program Files\ESET
2008-10-08 17:43 . 2008-10-08 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\ESET
2008-10-08 14:35 . 2008-10-08 14:35 <DIR> d-------- C:\SolarWinds
2008-10-08 11:42 . 2008-10-09 10:58 <DIR> d-------- C:\Program Files\3D Online Pool
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-10-08 11:24 . 2008-10-08 11:24 <DIR> d-------- C:\Program Files\MSBuild
2008-10-08 11:21 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-10-08 10:51 . 2008-10-08 18:20 <DIR> d-------- C:\Program Files\SMS Zdarma
2008-10-08 10:41 . 2008-10-08 10:47 <DIR> d-------- C:\Program Files\Scorpions WinCheater
2008-10-08 10:11 . 2008-10-08 10:11 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Azureus
2008-10-08 10:11 . 2008-10-08 10:48 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\Azureus
2008-10-08 10:10 . 2008-10-08 10:11 <DIR> d-------- C:\Program Files\Vuze
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\PC TRANSLATOR DEMO
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\LangSoft
2008-10-08 09:57 . 2008-10-08 09:57 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\LangSoft
2008-10-04 13:23 . 2008-10-04 13:23 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\PlayFirst
2008-10-04 13:23 . 2008-10-04 13:23 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\PlayFirst
2008-10-03 23:26 . 2008-10-03 23:26 <DIR> d-------- C:\Program Files\CherrySoft
2008-10-03 23:25 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-10-03 20:43 . 2008-10-03 20:43 <DIR> d-------- C:\Documents and Settings\Administrator\Data aplikací\OLYMPUS
2008-10-03 20:41 . 2008-10-03 20:41 <DIR> d-------- C:\WINDOWS\Cache
2008-10-03 20:40 . 2008-10-03 20:40 <DIR> d-------- C:\Program Files\OLYMPUS
2008-10-03 20:40 . 2008-10-03 20:40 <DIR> d-------- C:\Binaries
2008-10-03 20:39 . 2004-06-08 17:41 319,488 --------- C:\WINDOWS\system32\Pvmjpg21.dll
2008-10-03 20:39 . 2005-04-30 17:02 86,016 --a------ C:\WINDOWS\system32\bgsvcgen.exe
2008-10-03 20:39 . 2005-04-30 17:09 57,344 --a------ C:\WINDOWS\system32\GenSvcInst.exe
2008-10-03 20:39 . 2005-05-11 00:33 32,256 --a------ C:\WINDOWS\system32\drivers\cdrbsdrv.sys
2008-10-03 20:38 . 2008-10-03 20:38 <DIR> d-------- C:\Program Files\PIXELA
2008-10-03 20:37 . 2008-10-03 20:40 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2008-10-03 20:37 . 2008-10-03 20:37 <DIR> d-------- C:\Program Files\QuickTime
2008-10-03 20:37 . 1999-11-10 12:05 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2008-10-03 20:36 . 2008-10-03 20:37 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\QuickTime
2008-09-28 15:41 . 2008-10-08 11:25 <DIR> d-------- C:\Program Files\NetSoftware
2008-09-28 14:09 . 2008-09-28 14:09 <DIR> d-------- C:\WINDOWS\Delicious Emilys Tea Garden
2008-09-28 14:09 . 2008-09-28 14:21 <DIR> d-------- C:\Program Files\Delicious Emilys Tea Garden
2008-09-28 08:18 . 2008-09-28 08:18 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\GameHouse
2008-09-27 16:52 . 2008-10-08 17:48 <DIR> d-------- C:\Program Files\PicLensIE
2008-09-27 16:23 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-27 16:23 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-27 16:23 . 2007-03-08 07:09 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-27 16:23 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-27 16:23 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-27 16:23 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-27 16:23 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-27 16:23 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-27 16:23 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-27 11:45 . 2008-09-27 11:45 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-27 11:45 . 2008-09-27 11:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-27 11:45 . 2008-09-27 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2008-09-22 03:00 . 2008-09-22 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-11 17:22 --------- d-----w C:\Documents and Settings\Administrator\Data aplikací\OpenOffice.org2
2008-10-11 16:58 8,192 ----a-w C:\WINDOWS\sporder.exe
2008-10-11 16:37 --------- d-----w C:\Program Files\eMule
2008-10-11 11:30 --------- d-----w C:\Program Files\Zylom Games
2008-10-11 11:30 --------- d-----w C:\Documents and Settings\Administrator\Data aplikací\Zylom
2008-10-09 07:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-03 21:26 --------- d-----w C:\Program Files\CherrySoft
2008-09-12 19:36 --------- d-----w C:\Program Files\WinFast
2008-09-07 20:35 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2008-09-07 20:11 --------- d-----w C:\Program Files\PC Drivers HeadQuarters
2008-09-07 20:11 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters
2008-09-07 20:05 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-07 18:21 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-09-07 18:03 --------- d-----w C:\Program Files\C-Media
2008-09-07 17:20 --------- d-----w C:\Program Files\Lavalys
2008-09-07 16:22 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Zylom
2008-09-07 14:53 --------- d-----w C:\Documents and Settings\Forman\Data aplikací\OpenOffice.org2
2008-08-19 19:44 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-08-14 15:15 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-16 16:34 97,280 ----a-w C:\WINDOWS\inst_tspx.exe
2008-07-16 15:47 1,540,096 ----a-w C:\WINDOWS\system32\contfilt.dll
2008-07-16 15:04 57,344 ----a-w C:\WINDOWS\inst_tsp.exe
2008-07-16 15:03 425,984 ----a-w C:\WINDOWS\system32\mwtsp.dll
2008-07-16 14:57 155,648 ----a-w C:\WINDOWS\system32\mwnsp.dll
2008-07-16 14:09 49,152 ----a-w C:\WINDOWS\killproc.exe
2008-07-15 20:51 30,960,640 ----a-w C:\Program Files\StrongDC.pdb
2008-07-13 16:52 32,910 ----a-w C:\Program Files\changelog.txt
2008-07-13 16:52 23,555 ----a-w C:\Program Files\changelog-en.txt
2008-07-13 15:53 57,692 ----a-w C:\Program Files\EN_Example.xml
2008-07-06 13:15 139,755 ----a-w C:\Program Files\changelog-dc.txt
2007-03-02 17:16 18,593 ----a-w C:\Program Files\License.txt
2006-09-04 16:08 567 ----a-w C:\Program Files\dcppboot.xml
.

((((((((((((((((((((((((((((( snapshot@2008-10-11_12.11.48.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-04-03 11:08:46 8,464 ----a-w C:\WINDOWS\sporder.dll
+ 2008-01-08 13:00:10 509,952 ----a-w C:\WINDOWS\system32\eInstall.exe
+ 2002-12-18 15:58:32 32,768 ----a-w C:\WINDOWS\system32\esmxlog.dll
+ 2005-04-03 11:08:46 8,464 ----a-w C:\WINDOWS\system32\sporder.dll
+ 2005-10-09 16:53:50 125,440 ----a-w C:\WINDOWS\system32\UNZDLL.DLL
+ 2000-04-03 20:00:00 130,560 ----a-w C:\WINDOWS\system32\ZIPDLL.DLL
+ 2006-12-01 22:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 22:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 22:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 22:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 22:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2008-10-11 655360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"OEXPRESS"="C:\WINDOWS\OETRN.EXE" [2008-10-08 26624]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [2007-05-16 69632]
"WinFast Schedule"="C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [2007-05-22 405504]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-13 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-10-03 77824]
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 40960]
"eScan Updater"="C:\PROGRA~1\eScan\TRAYICOS.EXE" [2008-07-11 1772032]
"MailScan Dispatcher"="C:\PROGRA~1\eScan\LAUNCH.EXE" [2008-07-16 204800]
"C-Media Mixer"="Mixer.exe" [2001-10-22 C:\WINDOWS\mixer.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Forman\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 393216]

C:\Documents and Settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=\\vak-bv.cz\sysvol\vak-bv.cz\scripts\Vak.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1614895754-1788223648-682003330-1155\Scripts\Logon\0\0]
"Script"=vodne.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 08:52 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-09-16 12:16 1833296 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Czech\\setup.exe"=
"C:\\Documents and Settings\\Administrator\\Plocha\\StrongDC.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\PROGRA~1\\eScan\\DOWNLOAD.EXE"=
"C:\\PROGRA~1\\eScan\\TRAYICOS.EXE"=
"C:\\PROGRA~1\\COMMON~1\\MICROW~1\\Agent\\MWAGENT.EXE"=
"C:\\PROGRA~1\\eScan\\LICENSE.EXE"=
"C:\\PROGRA~1\\eScan\\MAILADM.EXE"=
"C:\\PROGRA~1\\COMMON~1\\MICROW~1\\eScanRAD\\ESCANRAD.EXE"=

R2 eScan-trayicos;eScan Server-Updater;C:\PROGRA~1\eScan\TRAYSSER.EXE [2008-07-16 78848]
R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R3 ProcObsrves;Process Creation Monitor;C:\PROGRA~1\eScan\ProcObsrves.sys [2008-04-15 5632]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-14 69120]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 9446]
R3 WFLR6654;WinFast DTV1800 H (Video);C:\WINDOWS\system32\drivers\wfeaglxt.sys [2007-01-19 393088]
S2 gupdate1c9165052630c6c;Google Update Service (gupdate1c9165052630c6c);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-14 133104]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2008-03-17 23152]
.
Obsah adresáře 'Naplánované úlohy'

2008-10-11 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-14 12:11]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-11 19:41:36
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet004\Services\EverestDriver]
"ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
Celkový čas: 2008-10-11 19:42:26
ComboFix-quarantined-files.txt 2008-10-11 17:42:23
ComboFix2.txt 2008-10-11 17:28:25
ComboFix3.txt 2008-10-11 13:34:12
ComboFix4.txt 2008-10-11 10:12:10

Před spuštěním: Volných bajtů: 160,636,190,720
Po spuštění: Volných bajtů: 160,620,277,760

318 --- E O F --- 2008-09-29 01:00:31
[/b]


Ještě mne zaráží taKONZOLA PRO ZOTAVENÍ to je co prosím?

[Marinus]

Jdi přes Start - Spustit a do volného řádku zkopíruj tento příkaz a potvrď: "%userprofile%\Plocha\VirTerminator.exe" /u - tohle odinstaluje ComboFix.
Co se týče Konzoly pro zotavení, podívej se sem: http://support.microsoft.com/kb/314058/cs
Normálně jí operační systém nemá nainstalovanou, pouze na zahraničních forech jí instalují jako záložní prostředek při použití ComboFixu. My jí neinstalujeme, neboť do ní můžeš v případě problémů nabootovat i z instalačního CD Windows.
Vlož sem ještě pro kontrolu nový log z HijackThis

[gena17]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24, on 2008-10-12
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\PROGRA~1\eScan\VISTA\avpmapp.exe
C:\PROGRA~1\eScan\TRAYSSER.EXE
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\PROGRA~1\eScan\consctl.exe
C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\MicroWorld\Agent\MWAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\eScan\TRAYICOS.EXE
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\WINDOWS\OETRN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\eScan\Vista\eScanMon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [eScan Updater] C:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\PROGRA~1\eScan\LAUNCH.EXE" /startup
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [OEXPRESS] C:\WINDOWS\OETRN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\windows\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\Software\..\Telephony: DomainName = vak-bv.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: Domain = vak-bv.cz
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: Domain = vak-bv.cz
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: eScan Monitor Service - MicroWorld Technologies Inc. - C:\PROGRA~1\eScan\VISTA\avpmapp.exe
O23 - Service: eScan Server-Updater (eScan-trayicos) - MicroWorld Technologies Inc. - C:\PROGRA~1\eScan\TRAYSSER.EXE
O23 - Service: Google Update Service (gupdate1c9165052630c6c) (gupdate1c9165052630c6c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9173 bytes

[Marinus]

Omlouvám se za zpoždění.

1) Fixni v HijackThis - zaškrtni vlevo čtverečky u daných položek a stiskni Fix checked:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)

2) Stáhni si, vybal a spusť program JavaRa - http://mesh.dl.sourceforge.net/sourcefo ... JavaRa.zip
Klikni na tlačítko Remove Older Versions k odstranění starých verzí Javy.
Poté stáhni a nainstaluj nejnovější verzi - Java Runtime Environment (JRE) 6 Update 10 - http://java.sun.com/javase/downloads/index.jsp

Pokud máš nainstalovaný eScan AV, doporučil bych k němu doplnit firewall.

Log je v pořádku.

[gena17]

Tak díky moc za pomoc.Zatim nemám žádny problem ,vše co jsi mě poradil sem spáchl