Prosím o kontrolu logu Vyřešeno

[řízek]

ještě než se do toho pustím mám firefox odinstalovat? Problém je v tom že chybu spojení mi hlásí i IE a Thunderbird jako bych byl odpojený od sítě(ale to nejsem)

[Reklama]

[jaro3]

Nemusíš nic odinstalovat. To se přepisuje v síť. připojených, tedy snad...
Tam by si to potom měl zkontrolovat.Případně zkusit opravit.

[řízek]

Tak jsem to projel Fixwareoutem a spojení opět nefungovalo.Vyplnil jsem protokol TCT/IP ručně a spojení naskočilo a v HJT jsem fixnul tu 17 a zase nic ,zase jsem přepisoval ten protokol a zase to běží ale 17 se objevila znovu
Protokol FIXWAREOUT
Username "ýˇzek" - 22.11.2008 18:17:47 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{35BFE89B-19A1-4974-89C9-CE97D4A9512F}
"nameserver"="85.255.112.129;85.255.112.121" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{75F22E2E-E412-4D23-B2A9-209EDBDDCF52}
"nameserver"="85.255.112.129;85.255.112.121" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{35BFE89B-19A1-4974-89C9-CE97D4A9512F}
"DhcpNameServer"="85.255.112.129;85.255.112.121" <Value cleared.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"SoundMan"="SOUNDMAN.EXE"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"OEXPRESS"=""
"CursorXP"="D:\\PROGRAMY\\Crusor xp\\CursorXP.exe"
"SpybotSD TeaTimer"="D:\\ANTIVIR\\Spybot - Search & Destroy\\TeaTimer.exe"
"WEBTRAN"=""
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:59:23, on 22.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
D:\ANTIVIR\Ad avare\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRAMY\Crusor xp\CursorXP.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\ANTIVIR\A-SQUARED FREE\a2service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
D:\PROGRAMY\totalcmd\TOTALCMD.EXE
D:\ANTIVIR\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\PROGRAMY\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - D:\PROGRAMY\FlashGet universal\ComDlls\bhoCATCH.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: CHelper Class - {99A7C4DD-B2E6-4CA0-BB6E-737A61364155} - D:\PROGRAMY\Eurotran\e2003i.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CursorXP] D:\PROGRAMY\Crusor xp\CursorXP.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download All by FlashGet - D:\PROGRAMY\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - D:\PROGRAMY\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: &Stáhnout s FlashGetem - D:\PROGRAMY\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: &Stáhnout vše s FlashGetem - D:\PROGRAMY\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - D:\PROGRAMY\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - D:\PROGRAMY\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - D:\PROGRAMY\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - D:\PROGRAMY\Eurotran\e2003i.dll
O9 - Extra 'Tools' menuitem: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - D:\PROGRAMY\Eurotran\e2003i.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFICEE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1952313437
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75F22E2E-E412-4D23-B2A9-209EDBDDCF52}: NameServer = 82.202.114.2,195.146.99.4
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\ANTIVIR\SUPERA\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\ANTIVIR\A-SQUARED FREE\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\ANTIVIR\Ad avare\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

--
End of file - 10481 bytes

Takže už opravdu nevím kud kam .

[jaro3]

Vypni rez. ochranu u Avastu.
Stáhni si ComboFix (by sUBs)

a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Budeme pokračovat zítra.

[řízek]

Dobrá,dámse do toho a zítra to pošlu ,zatímmoc děkuji Jarda

[jaro3]

ta položka 017 už je v pořádku , to už není ukrajinský server...
Ale pro pročištění můžeš ComboFix stejně použít.
Tedy zítra po obědu.

[řízek]

Tak jsem se k tomu konečně dostal a tady je ten výpis z Cmbo fixu:

ComboFix 08-11-22.02 - řízek 2008-11-23 14:09:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1052 [GMT 1:00]
Spuštěný z: c:\documents and settings\řízek\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\řízek\Data aplikací\BITS
c:\documents and settings\řízek\Data aplikací\BITS\BITS.ini
c:\documents and settings\řízek\Data aplikací\BITS\DHTTable.dat
c:\documents and settings\řízek\Data aplikací\BITS\ProxyList.ini
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081024231252.torrent.hybridlist
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081025000513.torrent.hybridlist
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081112184625.torrent
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081112184625.torrent.~tmp
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081112184625.torrent.bits
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081112184625.torrent.filelist
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081112184625.torrent.seeds
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081113153403.torrent
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081113153403.torrent.~tmp
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081113153403.torrent.bits
c:\documents and settings\řízek\Data aplikací\BITS\Torrent\20081113153403.torrent.filelist
c:\documents and settings\řízek\Data aplikací\inst.exe
c:\program files\Mozilla Firefox\components\iamfamous.dll
c:\windows\system32\systeminfo3.dll
D:\resycled
d:\resycled\boot.com
E:\resycled
e:\resycled\boot.com
F:\resycled
f:\resycled\boot.com

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-23 do 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-23 13:45 . 2008-11-23 13:45 <DIR> d-------- c:\windows\LastGood
2008-11-22 19:34 . 2008-11-22 19:34 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-22 19:34 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-22 19:34 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-22 18:17 . 2008-11-22 18:24 <DIR> d-------- C:\fixwareout
2008-11-22 16:55 . 2008-11-22 16:55 68,098 --a------ c:\documents and settings\catchme.zip
2008-11-22 16:54 . 2008-11-22 16:54 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-11-22 16:40 . 2008-11-22 17:09 <DIR> d-------- C:\SDFix
2008-11-22 10:51 . 2008-11-22 10:51 <DIR> d-------- c:\windows\ERUNT
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\Administrator\Šablony
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d---s---- c:\documents and settings\Administrator
2008-11-19 16:38 . 2008-11-19 16:38 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-12 17:19 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 17:16 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 16:51 . 2008-11-12 16:51 <DIR> d-------- c:\program files\DivX
2008-11-07 10:43 . 2008-11-07 10:45 <DIR> d-------- c:\windows\system32\XPSViewer
2008-11-07 10:43 . 2008-11-07 10:43 <DIR> d-------- c:\program files\Reference Assemblies
2008-11-07 10:42 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-11-05 01:48 . 2008-07-12 08:18 3,851,784 --a------ c:\windows\system32\D3DX9_39.dll
2008-11-05 01:48 . 2008-07-12 08:18 1,493,528 --a------ c:\windows\system32\D3DCompiler_39.dll
2008-11-05 01:48 . 2008-07-31 10:40 509,448 --a------ c:\windows\system32\XAudio2_2.dll
2008-11-05 01:48 . 2008-07-12 08:18 467,984 --a------ c:\windows\system32\d3dx10_39.dll
2008-11-05 01:48 . 2008-07-31 10:41 238,088 --a------ c:\windows\system32\xactengine3_2.dll
2008-11-05 01:48 . 2008-07-31 10:41 68,616 --a------ c:\windows\system32\XAPOFX1_1.dll
2008-11-05 01:06 . 2002-12-12 00:14 1,629,696 --a------ c:\windows\system\d3d9.dll
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d-------- c:\windows\system32\AGEIA
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d-------- c:\program files\AGEIA Technologies
2008-11-05 00:31 . 2008-11-05 00:31 <DIR> d-------- c:\windows\Logs
2008-11-05 00:00 . 2008-11-05 00:00 221 --a------ c:\windows\NCLogConfig.ini
2008-11-04 00:15 . 2008-11-22 19:55 <DIR> dr-h----- c:\documents and settings\řízek\Recent
2008-11-04 00:15 . 2008-11-22 19:55 <DIR> dr-h----- c:\documents and settings\řízek\Recent
2008-11-03 12:46 . 2008-11-03 12:46 <DIR> d-------- c:\program files\GameBoost
2008-11-03 12:21 . 2008-11-03 12:25 22,328 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2008-11-03 12:21 . 2008-11-03 12:21 22,328 --a------ c:\documents and settings\řízek\Data aplikací\PnkBstrK.sys
2008-11-03 12:20 . 2008-11-03 12:25 103,736 --a------ c:\windows\system32\PnkBstrB.exe
2008-11-03 12:20 . 2008-11-03 12:25 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2008-11-03 12:20 . 2008-11-03 12:20 278 --a------ c:\windows\game.ini
2008-11-03 11:09 . 2008-11-03 11:09 <DIR> d-------- c:\program files\OpenAL
2008-11-03 11:09 . 2006-09-25 15:44 749,568 -ra------ c:\windows\system32\tmp1E.tmp
2008-11-03 11:09 . 2008-11-03 11:09 413,696 --a------ c:\windows\system32\wrap_oal.dll
2008-11-03 11:09 . 2008-11-03 11:09 86,016 --a------ c:\windows\system32\OpenAL32.dll
2008-11-03 11:08 . 2008-11-03 11:08 <DIR> d-------- c:\program files\WMV9_VCM
2008-11-03 01:42 . 2008-11-03 01:42 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\StoneLoopsRE
2008-11-03 01:09 . 2008-11-03 01:09 <DIR> d-------- c:\program files\Zoner
2008-10-31 14:45 . 2008-10-31 14:45 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\VitySoft
2008-10-31 14:39 . 2008-11-19 16:31 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\IDM
2008-10-31 14:39 . 2008-11-23 14:04 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\DMCache
2008-10-29 09:32 . 2008-10-29 09:32 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2008-10-29 06:36 . 2008-10-29 06:36 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\TuneUp Software
2008-10-29 06:32 . 2008-10-29 06:32 0 --a------ c:\windows\oodcnt.INI
2008-10-29 06:28 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\IObit
2008-10-28 23:36 . 2008-10-28 23:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll
2008-10-28 23:36 . 2008-10-28 23:36 823,296 --a------ c:\windows\system32\divx_xx07.dll
2008-10-28 23:35 . 2008-10-28 23:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll
2008-10-28 23:35 . 2008-10-28 23:35 802,816 --a------ c:\windows\system32\divx_xx11.dll
2008-10-28 23:35 . 2008-10-28 23:35 729,088 --a------ c:\windows\system32\divxdec.ax
2008-10-28 23:35 . 2008-10-28 23:35 684,032 --a------ c:\windows\system32\DivX.dll
2008-10-28 19:44 . 2008-10-28 19:44 <DIR> d-------- c:\documents and settings\řízek\DoctorWeb
2008-10-28 19:44 . 2008-10-28 19:44 <DIR> d-------- c:\documents and settings\řízek\DoctorWeb
2008-10-28 11:46 . 2008-09-12 11:44 206,256 --a------ c:\windows\system32\idmmbc.dll
2008-10-24 16:08 . 2008-10-24 16:08 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\GRETECH
2008-10-24 16:07 . 2008-10-24 16:07 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\GRETECH
2008-10-24 15:52 . 2008-10-24 15:52 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\FreeDownloadManager.ORG
2008-10-24 15:49 . 2008-11-22 18:15 1,069 --a------ c:\windows\system32\drivers\fwdrv.err
2008-10-24 13:39 . 2008-10-15 17:38 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-22 17:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-11-22 16:30 --------- d-----w c:\program files\Mozilla Thunderbird
2008-11-18 07:50 --------- d-----w c:\documents and settings\All Users\Data aplikací\DVD Shrink
2008-11-17 13:14 --------- d-----w c:\documents and settings\All Users\Data aplikací\MumboJumbo
2008-11-05 00:50 --------- d-----w c:\program files\ATI
2008-11-04 23:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-04 23:00 --------- d-----w c:\documents and settings\řízek\Data aplikací\HP
2008-11-03 11:20 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-03 00:12 --------- d-----w c:\documents and settings\řízek\Data aplikací\Zoner
2008-10-29 07:56 --------- d-----w c:\documents and settings\řízek\Data aplikací\Vso
2008-10-28 19:18 --------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2008-10-26 18:32 --------- d-----w c:\documents and settings\řízek\Data aplikací\Wildfire
2008-10-24 15:06 --------- d-----w c:\program files\GRETECH
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-18 14:56 --------- d-----w c:\program files\icons
2008-10-18 08:23 --------- d-----w c:\documents and settings\řízek\Data aplikací\DivX
2008-10-17 22:46 --------- d-----w c:\program files\Program Files
2008-10-17 22:43 --------- d-----w c:\program files\TGTSoft
2008-10-17 22:11 --------- d-----w c:\program files\ofice excel
2008-10-17 10:13 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-10-17 10:13 47,360 ----a-w c:\documents and settings\řízek\Data aplikací\pcouffin.sys
2008-10-17 09:08 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2008-10-17 09:05 --------- d-----w c:\program files\MSBuild
2008-10-17 09:05 --------- d-----w c:\program files\Microsoft Works
2008-10-17 09:03 --------- d-----w c:\program files\Microsoft.NET
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-15 16:38 337,408 ----a-w c:\windows\system32\netapi32(2).dll
2008-10-15 07:55 --------- d-----w c:\documents and settings\řízek\Data aplikací\BSplayer PRO
2008-10-14 21:10 --------- d-----w c:\program files\DreamCatcher
2008-10-09 17:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\iolo
2008-10-09 17:49 --------- d-----w c:\documents and settings\řízek\Data aplikací\iolo
2008-10-09 17:47 --------- d-----w c:\documents and settings\LocalService\Data aplikací\iolo
2008-10-09 17:37 74,703 ----a-w c:\windows\system32\mfc45.dll
2008-10-09 13:32 --------- d-----w c:\program files\MOBILedit!
2008-10-09 13:24 --------- d-----w c:\documents and settings\All Users\Data aplikací\Bluetooth
2008-10-09 13:22 --------- d-----w c:\program files\IVT Corporation
2008-10-09 12:02 --------- d-----w c:\program files\Realtek AC97
2008-10-09 11:27 --------- d-----w c:\program files\Driver-Soft
2008-10-08 18:11 --------- d-----w c:\program files\XPC Tools
2008-10-07 14:41 --------- d-----w c:\program files\PopCap Games
2008-10-07 14:41 --------- d-----w c:\program files\Hry máma
2008-10-07 14:34 --------- d-----w c:\documents and settings\řízek\Data aplikací\StoneLoops
2008-10-07 14:00 --------- d-----w c:\program files\ReflexiveArcade
2008-10-06 14:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\Trymedia
2008-10-04 11:43 --------- d-----w c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2008-10-04 11:43 --------- d-----w c:\documents and settings\řízek\Data aplikací\SUPERAntiSpyware.com
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-28 16:50 --------- d-----w c:\documents and settings\řízek\Data aplikací\AdobeUM
2008-09-28 16:10 --------- d-----w c:\documents and settings\řízek\Data aplikací\Engelmann Media
2008-09-28 12:48 34,308 ----a-w c:\windows\system32\Chip.dll
2008-09-28 12:35 --------- d-----w c:\program files\7-ZipPortable
2008-09-27 21:07 --------- d-----w c:\documents and settings\All Users\Data aplikací\Elaborate Bytes
2008-09-25 21:34 --------- d-----w c:\program files\Common Files\Adobe
2008-09-25 09:48 --------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2008-09-25 09:29 --------- d-----w c:\documents and settings\řízek\Data aplikací\ACD Systems
2008-09-25 09:25 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2008-09-25 09:25 --------- d-----w c:\program files\Common Files\ACD Systems
2008-09-25 09:25 --------- d-----w c:\program files\ACD Systems
2008-09-25 09:25 --------- d-----w c:\documents and settings\All Users\Data aplikací\ACD Systems
2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-09-24 22:24 --------- d-----w c:\program files\Windows Media Connect 2
2008-09-24 20:38 --------- d-----w c:\program files\Common Files\Ahead
2008-09-24 10:38 --------- d-----w c:\documents and settings\řízek\Data aplikací\Ahead
2008-09-24 10:36 --------- d-----w c:\program files\Nero
2008-09-24 08:40 4,122,368 ----a-r c:\windows\system32\drivers\alcxwdm.sys
2008-09-24 08:12 --------- d-----w c:\program files\LightScribeTemplateLabeler
2008-09-24 08:08 --------- d-----w c:\documents and settings\All Users\Data aplikací\LightScribe
2008-09-24 08:04 --------- d-----w c:\program files\Common Files\LightScribe
2008-09-23 21:56 --------- d-----w c:\program files\Winamp
2008-09-23 21:51 --------- d-----w c:\documents and settings\řízek\Data aplikací\streamripper
2008-09-23 21:44 --------- d-----w c:\program files\Streamripper
2008-09-23 21:31 --------- d-----w c:\documents and settings\řízek\Data aplikací\Winamp
2008-09-23 09:43 --------- d-----w c:\documents and settings\All Users\Data aplikací\DAEMON Tools Pro
2008-09-23 09:07 --------- d-----w c:\program files\Alwil Software
2008-09-21 15:12 45,056 ----a-w c:\windows\TRNOEH.DLL
2008-09-21 15:12 26,624 ----a-w c:\windows\OETRN.EXE
2008-09-21 15:12 200,704 ----a-w c:\windows\TRNOET.DLL
2008-09-21 15:11 516,096 ----a-w c:\windows\UN32.EXE
2008-09-21 12:42 81,920 ----a-w c:\documents and settings\řízek\Data aplikací\ezpinst.exe
2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-09-15 15:27 1,846,400 ----a-w c:\windows\system32\win32k.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 139264]
"CursorXP"="d:\programy\Crusor xp\CursorXP.exe" [2005-01-19 128000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-12-14 221184]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\antivir\SUPERA\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 15:28 352256 d:\antivir\SUPERA\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" /background
"AdVantage"="c:\program files\AdVantage\AdVantage.exe"
"DriverUpdaterPro"=c:\program files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"CloneCDTray"="d:\vypalování\CloneCD\CloneCDTray.exe" /s
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"LogitechVideoRepair"=c:\program files\Logitech\Video\ISStart.exe
"LogitechVideoTray"=c:\program files\Logitech\Video\LogiTray.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"RestartNeroSetup"="c:\program files\Common Files\Ahead\Nero Web\SetupX.exe" MODE="update"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-23 78416]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-22 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-23 20560]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 MaplomL;MaplomL;c:\windows\system32\drivers\MaplomL.sys [2008-09-28 38336]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2006-03-02 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-22 65576]
R3 uscbs109;uscbs109;c:\windows\system32\DRIVERS\uscbs109.sys [2005-03-21 8672]
R3 uscsc109;uscsc109;c:\windows\system32\DRIVERS\uscsc109.sys [2005-03-21 102336]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-19 27904]

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-OEXPRESS - (no file)
HKCU-Run-WEBTRAN - (no file)


.
------- Doplňkový sken -------
.
FireFox -: Profile - c:\documents and settings\řízek\Data aplikací\Mozilla\Firefox\Profiles\gms0gj29.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://cs.start.mozilla.com/firefox?cli ... s:official
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 14:15:33
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(888)
d:\antivir\SUPERA\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2008-11-23 14:18:16
ComboFix-quarantined-files.txt 2008-11-23 13:18:11

Před spuštěním: Volných bajtů: 13 207 404 544
Po spuštění: Volných bajtů: 13,196,328,960

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=AlwaysOff

320 --- E O F --- 2008-11-23 12:46:09

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\spmsg2.dll
c:\windows\system32\tmp1E.tmp
c:\windows\UN32.EXE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[řízek]

Do toho Notepadu mám vložit toto ? :
File::
c:\windows\system32\spmsg2.dll
c:\windows\system32\tmp1E.tmp
c:\windows\UN32.EXE

[jaro3]

jj.

[řízek]

Tady jsou ty logy:
ComboFix 08-11-22.02 - řízek 2008-11-23 16:21:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1019 [GMT 1:00]
Spuštěný z: c:\documents and settings\řízek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\řízek\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

FILE ::
c:\windows\system32\spmsg2.dll
c:\windows\system32\tmp1E.tmp
c:\windows\UN32.EXE
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\spmsg2.dll
c:\windows\system32\tmp1E.tmp
c:\windows\UN32.EXE

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-23 do 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-23 13:45 . 2008-11-23 13:45 <DIR> d-------- c:\windows\LastGood
2008-11-22 19:34 . 2008-11-22 19:34 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-22 19:34 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-22 19:34 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-22 18:17 . 2008-11-22 18:24 <DIR> d-------- C:\fixwareout
2008-11-22 16:55 . 2008-11-22 16:55 68,098 --a------ c:\documents and settings\catchme.zip
2008-11-22 16:54 . 2008-11-22 16:54 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-11-22 16:40 . 2008-11-22 17:09 <DIR> d-------- C:\SDFix
2008-11-22 10:51 . 2008-11-22 10:51 <DIR> d-------- c:\windows\ERUNT
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\Administrator\Šablony
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací
2008-11-22 07:58 . 2008-11-22 16:26 <DIR> d---s---- c:\documents and settings\Administrator
2008-11-19 16:38 . 2008-11-19 16:38 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-12 17:19 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 17:16 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 16:51 . 2008-11-12 16:51 <DIR> d-------- c:\program files\DivX
2008-11-07 10:43 . 2008-11-07 10:45 <DIR> d-------- c:\windows\system32\XPSViewer
2008-11-07 10:43 . 2008-11-07 10:43 <DIR> d-------- c:\program files\Reference Assemblies
2008-11-05 01:48 . 2008-07-12 08:18 3,851,784 --a------ c:\windows\system32\D3DX9_39.dll
2008-11-05 01:48 . 2008-07-12 08:18 1,493,528 --a------ c:\windows\system32\D3DCompiler_39.dll
2008-11-05 01:48 . 2008-07-31 10:40 509,448 --a------ c:\windows\system32\XAudio2_2.dll
2008-11-05 01:48 . 2008-07-12 08:18 467,984 --a------ c:\windows\system32\d3dx10_39.dll
2008-11-05 01:48 . 2008-07-31 10:41 238,088 --a------ c:\windows\system32\xactengine3_2.dll
2008-11-05 01:48 . 2008-07-31 10:41 68,616 --a------ c:\windows\system32\XAPOFX1_1.dll
2008-11-05 01:06 . 2002-12-12 00:14 1,629,696 --a------ c:\windows\system\d3d9.dll
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d-------- c:\windows\system32\AGEIA
2008-11-05 00:34 . 2008-11-05 00:34 <DIR> d-------- c:\program files\AGEIA Technologies
2008-11-05 00:31 . 2008-11-05 00:31 <DIR> d-------- c:\windows\Logs
2008-11-05 00:00 . 2008-11-05 00:00 221 --a------ c:\windows\NCLogConfig.ini
2008-11-04 00:15 . 2008-11-23 16:18 <DIR> dr-h----- c:\documents and settings\řízek\Recent
2008-11-04 00:15 . 2008-11-23 16:18 <DIR> dr-h----- c:\documents and settings\řízek\Recent
2008-11-03 12:46 . 2008-11-03 12:46 <DIR> d-------- c:\program files\GameBoost
2008-11-03 12:21 . 2008-11-03 12:25 22,328 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2008-11-03 12:21 . 2008-11-03 12:21 22,328 --a------ c:\documents and settings\řízek\Data aplikací\PnkBstrK.sys
2008-11-03 12:20 . 2008-11-03 12:25 103,736 --a------ c:\windows\system32\PnkBstrB.exe
2008-11-03 12:20 . 2008-11-03 12:25 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2008-11-03 12:20 . 2008-11-03 12:20 278 --a------ c:\windows\game.ini
2008-11-03 11:09 . 2008-11-03 11:09 <DIR> d-------- c:\program files\OpenAL
2008-11-03 11:09 . 2008-11-03 11:09 413,696 --a------ c:\windows\system32\wrap_oal.dll
2008-11-03 11:09 . 2008-11-03 11:09 86,016 --a------ c:\windows\system32\OpenAL32.dll
2008-11-03 11:08 . 2008-11-03 11:08 <DIR> d-------- c:\program files\WMV9_VCM
2008-11-03 01:42 . 2008-11-03 01:42 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\StoneLoopsRE
2008-11-03 01:09 . 2008-11-03 01:09 <DIR> d-------- c:\program files\Zoner
2008-10-31 14:45 . 2008-10-31 14:45 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\VitySoft
2008-10-31 14:39 . 2008-11-19 16:31 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\IDM
2008-10-31 14:39 . 2008-11-23 14:04 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\DMCache
2008-10-29 09:32 . 2008-10-29 09:32 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2008-10-29 06:36 . 2008-10-29 06:36 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\TuneUp Software
2008-10-29 06:32 . 2008-10-29 06:32 0 --a------ c:\windows\oodcnt.INI
2008-10-29 06:28 . 2008-11-22 16:26 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\IObit
2008-10-28 23:36 . 2008-10-28 23:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll
2008-10-28 23:36 . 2008-10-28 23:36 823,296 --a------ c:\windows\system32\divx_xx07.dll
2008-10-28 23:35 . 2008-10-28 23:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll
2008-10-28 23:35 . 2008-10-28 23:35 802,816 --a------ c:\windows\system32\divx_xx11.dll
2008-10-28 23:35 . 2008-10-28 23:35 729,088 --a------ c:\windows\system32\divxdec.ax
2008-10-28 23:35 . 2008-10-28 23:35 684,032 --a------ c:\windows\system32\DivX.dll
2008-10-28 19:44 . 2008-10-28 19:44 <DIR> d-------- c:\documents and settings\řízek\DoctorWeb
2008-10-28 19:44 . 2008-10-28 19:44 <DIR> d-------- c:\documents and settings\řízek\DoctorWeb
2008-10-28 11:46 . 2008-09-12 11:44 206,256 --a------ c:\windows\system32\idmmbc.dll
2008-10-24 16:08 . 2008-10-24 16:08 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\GRETECH
2008-10-24 16:07 . 2008-10-24 16:07 <DIR> d-------- c:\documents and settings\řízek\Data aplikací\GRETECH
2008-10-24 15:52 . 2008-10-24 15:52 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\FreeDownloadManager.ORG
2008-10-24 15:49 . 2008-11-22 18:15 1,069 --a------ c:\windows\system32\drivers\fwdrv.err
2008-10-24 13:39 . 2008-10-15 17:38 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 15:12 --------- d-----w c:\program files\Mozilla Thunderbird
2008-11-22 17:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-11-18 07:50 --------- d-----w c:\documents and settings\All Users\Data aplikací\DVD Shrink
2008-11-17 13:14 --------- d-----w c:\documents and settings\All Users\Data aplikací\MumboJumbo
2008-11-05 00:50 --------- d-----w c:\program files\ATI
2008-11-04 23:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-04 23:00 --------- d-----w c:\documents and settings\řízek\Data aplikací\HP
2008-11-03 11:20 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-03 00:12 --------- d-----w c:\documents and settings\řízek\Data aplikací\Zoner
2008-10-29 07:56 --------- d-----w c:\documents and settings\řízek\Data aplikací\Vso
2008-10-28 19:18 --------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2008-10-26 18:32 --------- d-----w c:\documents and settings\řízek\Data aplikací\Wildfire
2008-10-24 15:06 --------- d-----w c:\program files\GRETECH
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-18 14:56 --------- d-----w c:\program files\icons
2008-10-18 08:23 --------- d-----w c:\documents and settings\řízek\Data aplikací\DivX
2008-10-17 22:46 --------- d-----w c:\program files\Program Files
2008-10-17 22:43 --------- d-----w c:\program files\TGTSoft
2008-10-17 22:11 --------- d-----w c:\program files\ofice excel
2008-10-17 10:13 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-10-17 10:13 47,360 ----a-w c:\documents and settings\řízek\Data aplikací\pcouffin.sys
2008-10-17 09:08 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2008-10-17 09:05 --------- d-----w c:\program files\MSBuild
2008-10-17 09:05 --------- d-----w c:\program files\Microsoft Works
2008-10-17 09:03 --------- d-----w c:\program files\Microsoft.NET
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-15 16:38 337,408 ----a-w c:\windows\system32\netapi32(2).dll
2008-10-15 07:55 --------- d-----w c:\documents and settings\řízek\Data aplikací\BSplayer PRO
2008-10-14 21:10 --------- d-----w c:\program files\DreamCatcher
2008-10-09 17:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\iolo
2008-10-09 17:49 --------- d-----w c:\documents and settings\řízek\Data aplikací\iolo
2008-10-09 17:47 --------- d-----w c:\documents and settings\LocalService\Data aplikací\iolo
2008-10-09 17:37 74,703 ----a-w c:\windows\system32\mfc45.dll
2008-10-09 13:32 --------- d-----w c:\program files\MOBILedit!
2008-10-09 13:24 --------- d-----w c:\documents and settings\All Users\Data aplikací\Bluetooth
2008-10-09 13:22 --------- d-----w c:\program files\IVT Corporation
2008-10-09 12:02 --------- d-----w c:\program files\Realtek AC97
2008-10-09 11:27 --------- d-----w c:\program files\Driver-Soft
2008-10-08 18:11 --------- d-----w c:\program files\XPC Tools
2008-10-07 14:41 --------- d-----w c:\program files\PopCap Games
2008-10-07 14:41 --------- d-----w c:\program files\Hry máma
2008-10-07 14:34 --------- d-----w c:\documents and settings\řízek\Data aplikací\StoneLoops
2008-10-07 14:00 --------- d-----w c:\program files\ReflexiveArcade
2008-10-06 14:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\Trymedia
2008-10-04 11:43 --------- d-----w c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2008-10-04 11:43 --------- d-----w c:\documents and settings\řízek\Data aplikací\SUPERAntiSpyware.com
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-28 16:50 --------- d-----w c:\documents and settings\řízek\Data aplikací\AdobeUM
2008-09-28 16:10 --------- d-----w c:\documents and settings\řízek\Data aplikací\Engelmann Media
2008-09-28 12:48 34,308 ----a-w c:\windows\system32\Chip.dll
2008-09-28 12:35 --------- d-----w c:\program files\7-ZipPortable
2008-09-27 21:07 --------- d-----w c:\documents and settings\All Users\Data aplikací\Elaborate Bytes
2008-09-25 21:34 --------- d-----w c:\program files\Common Files\Adobe
2008-09-25 09:48 --------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2008-09-25 09:29 --------- d-----w c:\documents and settings\řízek\Data aplikací\ACD Systems
2008-09-25 09:25 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2008-09-25 09:25 --------- d-----w c:\program files\Common Files\ACD Systems
2008-09-25 09:25 --------- d-----w c:\program files\ACD Systems
2008-09-25 09:25 --------- d-----w c:\documents and settings\All Users\Data aplikací\ACD Systems
2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-09-24 22:24 --------- d-----w c:\program files\Windows Media Connect 2
2008-09-24 20:38 --------- d-----w c:\program files\Common Files\Ahead
2008-09-24 10:38 --------- d-----w c:\documents and settings\řízek\Data aplikací\Ahead
2008-09-24 10:36 --------- d-----w c:\program files\Nero
2008-09-24 08:40 4,122,368 ----a-r c:\windows\system32\drivers\alcxwdm.sys
2008-09-24 08:12 --------- d-----w c:\program files\LightScribeTemplateLabeler
2008-09-24 08:08 --------- d-----w c:\documents and settings\All Users\Data aplikací\LightScribe
2008-09-24 08:04 --------- d-----w c:\program files\Common Files\LightScribe
2008-09-23 21:56 --------- d-----w c:\program files\Winamp
2008-09-23 21:51 --------- d-----w c:\documents and settings\řízek\Data aplikací\streamripper
2008-09-23 21:44 --------- d-----w c:\program files\Streamripper
2008-09-23 21:31 --------- d-----w c:\documents and settings\řízek\Data aplikací\Winamp
2008-09-23 09:43 --------- d-----w c:\documents and settings\All Users\Data aplikací\DAEMON Tools Pro
2008-09-23 09:07 --------- d-----w c:\program files\Alwil Software
2008-09-21 15:12 45,056 ----a-w c:\windows\TRNOEH.DLL
2008-09-21 15:12 26,624 ----a-w c:\windows\OETRN.EXE
2008-09-21 15:12 200,704 ----a-w c:\windows\TRNOET.DLL
2008-09-21 12:42 81,920 ----a-w c:\documents and settings\řízek\Data aplikací\ezpinst.exe
2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-09-15 15:27 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:16 1,307,648 ------w c:\windows\system32\msxml6.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 139264]
"CursorXP"="d:\programy\Crusor xp\CursorXP.exe" [2005-01-19 128000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-12-14 221184]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\antivir\SUPERA\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 15:28 352256 d:\antivir\SUPERA\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" /background
"AdVantage"="c:\program files\AdVantage\AdVantage.exe"
"DriverUpdaterPro"=c:\program files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"CloneCDTray"="d:\vypalování\CloneCD\CloneCDTray.exe" /s
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"LogitechVideoRepair"=c:\program files\Logitech\Video\ISStart.exe
"LogitechVideoTray"=c:\program files\Logitech\Video\LogiTray.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"RestartNeroSetup"="c:\program files\Common Files\Ahead\Nero Web\SetupX.exe" MODE="update"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-23 78416]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-22 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-23 20560]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 MaplomL;MaplomL;c:\windows\system32\drivers\MaplomL.sys [2008-09-28 38336]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2006-03-02 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-22 65576]
R3 uscbs109;uscbs109;c:\windows\system32\DRIVERS\uscbs109.sys [2005-03-21 8672]
R3 uscsc109;uscsc109;c:\windows\system32\DRIVERS\uscsc109.sys [2005-03-21 102336]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-19 27904]

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 16:27:51
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(888)
d:\antivir\SUPERA\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2008-11-23 16:30:24
ComboFix-quarantined-files.txt 2008-11-23 15:30:19
ComboFix2.txt 2008-11-23 13:18:20

Před spuštěním: Volných bajtů: 13 178 187 776
Po spuštění: Volných bajtů: 13,166,600,192

282 --- E O F --- 2008-11-23 12:46:09

a ještě HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:31:34, on 23.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
D:\ANTIVIR\Ad avare\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
D:\ANTIVIR\A-SQUARED FREE\a2service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\PROGRAMY\Crusor xp\CursorXP.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
D:\ANTIVIR\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\PROGRAMY\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - D:\PROGRAMY\FlashGet universal\ComDlls\bhoCATCH.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: CHelper Class - {99A7C4DD-B2E6-4CA0-BB6E-737A61364155} - D:\PROGRAMY\Eurotran\e2003i.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CursorXP] D:\PROGRAMY\Crusor xp\CursorXP.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download All by FlashGet - D:\PROGRAMY\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - D:\PROGRAMY\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: &Stáhnout s FlashGetem - D:\PROGRAMY\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: &Stáhnout vše s FlashGetem - D:\PROGRAMY\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - D:\PROGRAMY\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - D:\PROGRAMY\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - D:\PROGRAMY\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - D:\PROGRAMY\Eurotran\e2003i.dll
O9 - Extra 'Tools' menuitem: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - D:\PROGRAMY\Eurotran\e2003i.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFICEE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1952313437
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75F22E2E-E412-4D23-B2A9-209EDBDDCF52}: NameServer = 82.202.114.2,195.146.99.4
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\ANTIVIR\SUPERA\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\ANTIVIR\A-SQUARED FREE\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\ANTIVIR\Ad avare\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

--
End of file - 10197 bytes

[jaro3]

Najdi a smaž:
C:\fixwareout
C:\SDFix


Fix v HJT:

Kód: Vybrat vše

O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Aktualizuj javu:
Java SE Runtime Environment 6u10

Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u10-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.