Prosim o kontrolu logu Vyřešeno

[Vasek17]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:37:49, on 2.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Ahead\InCD\InCDsrv.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Seznam\Postak\Postak.exe
I:\Program Files\Unlocker\UnlockerAssistant.exe
I:\WINDOWS\system32\RUNDLL32.EXE
I:\Program Files\Analog Devices\SoundMAX\SMTray.exe
I:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
I:\Program Files\HP\hpcoretech\hpcmpmgr.exe
I:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
I:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
I:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
I:\Program Files\Ahead\InCD\InCD.exe
I:\Program Files\Java\jre6\bin\jusched.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\A4Tech\Mouse\Amoumain.exe
I:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\DAEMON Tools Lite\daemon.exe
I:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
I:\Program Files\Java\jre6\bin\jqs.exe
I:\Program Files\Common Files\LightScribe\LSSrvc.exe
I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
I:\Program Files\CDBurnerXP\NMSAccessU.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
c:\Program Files\Spyware Terminator\sp_rsser.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - I:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - I:\WINDOWS\system32\nhekfvki.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SMail] "I:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "I:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] I:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] I:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] "I:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "I:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] I:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] I:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [RemoteControl] "I:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] I:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] I:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] I:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SpywareCease.exe] I:\Program Files\Spyware Cease\SpywareCease.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "I:\Documents and Settings\Ven@\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "I:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: hamachi.lnk = I:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = I:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = I:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - I:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: jzdiqs.dll
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - Unknown owner - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - Unknown owner - I:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Služba inteligentního přenosu na pozadí (BITS) - Unknown owner - I:\WINDOWS\
O23 - Service: InCD Helper (InCDsrv) - Nero AG - I:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - I:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - I:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - I:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - I:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - c:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8994 bytes


** Internet je celkove spomaleny, obcas vyskakuji reklamni okna a registrace nebo prihlaseni trva hrozne dlouho.

Dekuji za pomoc

[Reklama]

[jaro3]

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Vasek17]

Bohužel mi tento program nejde nainstalovat - 2x kliknu na Setup a nic se nestane

/odstraněna citace. není potřeba citovat příspěvek nad tebou. memphisto

[jaro3]

Zkus v nouz. režimu
Když nepůjde:
Vypni rez. ochrany u Avastu, Spyware Cease+štít u SpywareTerminatoru.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy se spuštěním , proveď v nouz. režimu.

[Vasek17]

Bohužel, ani v nouzovem rezimu nejde zadny z nich spustit.

/odstraněna citace.memphisto

[jaro3]

Zkus si zde
http://www.edisk.cz/stahni/23032/tools.rar_3.51MB.html
stáhnout některé prográmky co by se nám mohly hodit.
Rozbal si archiv do svého adresáře. Soubory jsou záměrně pojmenované jinak než původní v návodech, tak se nediv.
Zkus pak spustit:
VerTerm.exe, můžeš v nouzovém režimu.
VerTerm=Combofix
itr=RSIT
buss=DDS

[Vasek17]

Díky, s tímhle uz to slo

ComboFix 09-03-01.01 - Ven@ 2009-03-02 10:21:14.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1279.971 [GMT 1:00]
Spuštěný z: i:\documents and settings\Ven@\Plocha\VerTerm.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

i:\documents and settings\All Users\Nabídka Start\Programy\Spyware Cease
i:\documents and settings\All Users\Nabídka Start\Programy\Spyware Cease\Spyware Cease on the Web.lnk
i:\documents and settings\All Users\Nabídka Start\Programy\Spyware Cease\Spyware Cease.lnk
i:\documents and settings\All Users\Nabídka Start\Programy\Spyware Cease\Uninstall Spyware Cease.lnk
i:\program files\Spyware Cease
i:\program files\Spyware Cease\AutoUpdate.exe
i:\program files\Spyware Cease\DefendLog.txt
i:\program files\Spyware Cease\LSR.lsr
i:\program files\Spyware Cease\md5.dll
i:\program files\Spyware Cease\networkdll.dll
i:\program files\Spyware Cease\opfile.dll
i:\program files\Spyware Cease\RegDefend.ini
i:\program files\Spyware Cease\rgp.tmp
i:\program files\Spyware Cease\RkHitApi.dll
i:\program files\Spyware Cease\spkdll.dll
i:\program files\Spyware Cease\SpywareCease.exe
i:\program files\Spyware Cease\SpywareCease.chm
i:\program files\Spyware Cease\SpywareCease.url
i:\program files\Spyware Cease\swdb.ssk
i:\program files\Spyware Cease\unins000.dat
i:\program files\Spyware Cease\unins000.exe
i:\program files\Spyware Cease\update\Update.ini
i:\program files\Spyware Cease\zlib1.dll
i:\windows\system32\atbefipq.ini
i:\windows\system32\cdjdhehw.ini
i:\windows\system32\cfeosarb.ini
i:\windows\system32\cnyctcxh.ini
i:\windows\system32\cnyjwgrr.ini
i:\windows\system32\dojmniaa.ini
i:\windows\system32\drivers\RKHit.sys
i:\windows\system32\drivers\UACktafuxth.sys
i:\windows\system32\dvurnnxn.ini
i:\windows\system32\essfehot.ini
i:\windows\system32\etvhbkxh.ini
i:\windows\system32\fcccdBTn.dll.vir
i:\windows\system32\fcofbtmo.ini
i:\windows\system32\ffrimfej.ini
i:\windows\system32\jzdiqs.dll
i:\windows\system32\kljwaqyw.ini
i:\windows\system32\kqxakrry.ini
i:\windows\system32\lrhodgsg.ini
i:\windows\system32\lsprst7.dll
i:\windows\system32\mcrh.tmp
i:\windows\system32\moisgpxf.ini
i:\windows\system32\msssc.dll
i:\windows\system32\nhekfvki.dll
i:\windows\system32\npfbvowa.ini
i:\windows\system32\nTBdcccf.ini
i:\windows\system32\nTBdcccf.ini2
i:\windows\system32\quemoloj.ini
i:\windows\system32\rhixpkqo.ini
i:\windows\system32\rnvuvsbw.ini
i:\windows\system32\slpikaiy.dll
i:\windows\system32\ssprs.dll
i:\windows\system32\tihwpmsc.ini
i:\windows\system32\tpsenibx.ini
i:\windows\system32\UACabrpixdp.dll
i:\windows\system32\UACagvppxiv.log
i:\windows\system32\UACbugtivmw.log
i:\windows\system32\UACdbmkbstb.dll
i:\windows\system32\UACewbnmwie.dll
i:\windows\system32\UACexnktfsq.dat
i:\windows\system32\UACrxjetkdm.log
i:\windows\system32\UACxrxldlwo.dll
i:\windows\system32\uoormprt.ini
i:\windows\system32\vfaxtlrg.ini
i:\windows\system32\vmsshkha.ini
i:\windows\system32\whehdjdc.dll
i:\windows\system32\wyqawjlk.dll
i:\windows\system32\xbxxflfd.ini
i:\windows\system32\xrgrcyox.ini
i:\windows\system32\yaisriif.dll
i:\windows\system32\yiakipls.ini

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_rkhit
-------\Service_rkhit


((((((((((((((((((((((((( Soubory vytvořené od 2009-02-02 do 2009-03-02 )))))))))))))))))))))))))))))))
.

2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Plocha
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d--h----- i:\documents and settings\Administrator\Okolní tiskárny
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d--h----- i:\documents and settings\Administrator\Okolní síť
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Oblíbené položky
2009-03-02 08:48 . 2008-12-28 12:17 <DIR> d--h----- i:\documents and settings\Administrator\Šablony
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> dr------- i:\documents and settings\Administrator\Nabídka Start
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Dokumenty
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> dr-h----- i:\documents and settings\Administrator\Data aplikací
2009-03-02 08:48 . 2009-03-02 08:50 <DIR> d-------- i:\documents and settings\Administrator
2009-03-02 07:59 . 2009-03-02 07:59 <DIR> d-------- i:\program files\Malwarebytes' Anti-Malware
2009-03-01 10:51 . 2009-03-01 10:51 <DIR> d-------- i:\program files\CCleaner
2009-03-01 08:39 . 2009-03-01 08:39 54,156 --ah----- i:\windows\QTFont.qfn
2009-03-01 08:39 . 2009-03-01 08:39 1,409 --a------ i:\windows\QTFont.for
2009-03-01 08:27 . 2009-03-01 08:27 4,706 --a------ i:\windows\system32\PerfStringBackup.TMP
2009-03-01 08:25 . 2009-03-01 08:26 <DIR> d-------- i:\program files\Spyware Doctor
2009-03-01 08:25 . 2009-03-01 08:25 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\PC Tools
2009-03-01 08:25 . 2008-08-25 12:36 81,288 --a------ i:\windows\system32\drivers\iksyssec.sys
2009-03-01 08:25 . 2008-08-25 12:36 66,952 --a------ i:\windows\system32\drivers\iksysflt.sys
2009-03-01 08:25 . 2008-08-25 12:36 40,840 --a------ i:\windows\system32\drivers\ikfilesec.sys
2009-03-01 08:25 . 2008-06-02 16:19 29,576 --a------ i:\windows\system32\drivers\kcom.sys
2009-03-01 07:26 . 2009-03-01 07:39 <DIR> d-------- I:\VundoFix Backups
2009-02-28 19:29 . 2009-03-01 07:56 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\Spyware Terminator
2009-02-28 19:29 . 2009-03-01 08:25 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-02-28 19:29 . 2009-02-28 19:29 141,312 --a------ i:\windows\system32\drivers\sp_rsdrv2.sys
2009-02-28 19:21 . 2009-02-28 19:21 <DIR> d-------- i:\program files\Alwil Software
2009-02-28 19:18 . 2009-03-02 10:28 101,608 --a------ i:\windows\system32\drivers\47382e01.sys
2009-02-28 19:18 . 2009-02-28 19:18 74,752 --a------ i:\windows\system32\rsgxfuda.dll
2009-02-28 19:18 . 2009-03-02 07:37 5,164 --a------ i:\windows\system32\uacinit.dll
2009-02-27 20:28 . 2008-04-14 08:52 54,272 --a------ i:\windows\system32\vfwwdm32.dll
2009-02-27 20:28 . 2008-04-14 08:52 54,272 --a--c--- i:\windows\system32\dllcache\vfwwdm32.dll
2009-02-27 20:24 . 2009-02-27 20:24 <DIR> d-------- I:\Drivers
2009-02-27 20:24 . 2001-11-05 09:23 299,923 --a------ i:\windows\system32\drivers\sonyhcs.sys
2009-02-27 20:24 . 2002-10-15 22:41 102,220 --a------ i:\windows\system32\drivers\sonypvs1.sys
2009-02-27 20:24 . 2001-07-03 20:33 53,248 --a------ i:\windows\system32\SONYHCY.DLL
2009-02-27 20:24 . 2001-11-05 09:23 38,739 --a------ i:\windows\system32\drivers\sonyhcc.sys
2009-02-27 20:24 . 2001-11-05 09:23 6,097 --a------ i:\windows\system32\drivers\sonyhcb.sys
2009-02-27 20:24 . 2001-07-03 20:39 3,654 --a------ i:\windows\system32\drivers\Sonyhcp.dll
2009-02-27 19:48 . 2009-02-27 19:48 <DIR> d-------- i:\program files\CSM2002
2009-02-27 08:26 . 2009-02-27 20:23 <DIR> d-------- i:\program files\sony_drive
2009-02-24 19:40 . 2009-02-24 19:40 7,168 --ahs---- i:\windows\Thumbs.db
2009-02-24 11:05 . 2009-02-27 19:37 <DIR> d-------- i:\program files\MSDN(2)
2009-02-20 18:52 . 2009-02-27 19:39 <DIR> d-------- i:\program files\PVD15
2009-02-20 15:33 . 2009-02-27 19:39 <DIR> d-------- i:\program files\DesetiPrsty
2009-02-17 20:34 . 2009-02-17 21:03 <DIR> d-------- i:\program files\Microsoft SQL Server
2009-02-17 20:33 . 2009-02-17 20:33 <DIR> d-------- i:\program files\Microsoft SQL Server 2005 Mobile Edition
2009-02-17 20:33 . 2009-02-17 20:33 <DIR> d-------- i:\program files\Microsoft Device Emulator
2009-02-17 19:21 . 2009-02-27 19:49 <DIR> d-------- i:\program files\Microsoft.NET
2009-02-17 19:21 . 2009-02-27 19:49 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\PreEmptive Solutions
2009-02-17 19:05 . 2009-02-27 19:49 <DIR> d-------- i:\program files\Microsoft Visual Studio 8
2009-02-15 16:24 . 2009-02-15 16:29 <DIR> d-------- I:\eee6abb4fe8c95dc4179396eef75e6
2009-02-15 12:54 . 2009-02-27 19:50 <DIR> d-------- i:\program files\Transformers
2009-02-14 19:14 . 2009-02-27 20:41 <DIR> d-------- i:\program files\Bubble Struggle V1.2
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\NeroDigital(TM)
2009-02-14 10:23 . 2009-02-14 10:23 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\LightScribe
2009-02-14 10:18 . 2009-02-14 10:42 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\Nero
2009-02-14 09:48 . 2009-02-14 09:48 4,767 --a------ i:\windows\Irremote.ini
2009-02-14 09:42 . 2009-02-14 09:42 <DIR> d-------- i:\program files\Windows Sidebar
2009-02-14 09:17 . 2009-02-14 09:46 <DIR> d-------- i:\program files\Nero
2009-02-14 09:16 . 2009-02-14 09:26 <DIR> d-------- i:\program files\Common Files\Nero
2009-02-14 09:16 . 2009-02-14 09:31 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\Nero
2009-02-14 08:50 . 2009-02-14 08:50 <DIR> d-------- i:\program files\PSPad editor
2009-02-14 08:48 . 2009-02-14 08:48 <DIR> d-------- i:\program files\POKEMON
2009-02-14 07:47 . 2009-02-14 07:47 34,427,576 --a------ i:\windows\system32\xa1107296.exe
2009-02-14 07:47 . 2009-02-14 07:47 34,427,576 --a------ i:\windows\system32\xa1105093.exe
2009-02-12 17:16 . 2009-02-12 17:16 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\QIP
2009-02-08 11:05 . 1998-10-29 16:45 306,688 --a------ i:\windows\IsUninst.exe
2009-02-08 10:38 . 2009-02-08 10:38 <DIR> d-------- i:\windows\system32\save
2009-02-08 10:38 . 2009-02-08 10:38 34,427,576 --a------ i:\windows\system32\xa11955750.exe
2009-02-08 10:38 . 2009-02-08 10:38 34,427,576 --a------ i:\windows\system32\xa11953390.exe
2009-02-08 10:38 . 2009-02-08 10:38 167,936 --a------ i:\windows\system32\wr38501.dll
2009-02-06 17:57 . 2009-02-06 17:57 <DIR> d-------- i:\program files\KONAMI
2009-02-05 21:06 . 2009-02-06 20:15 <DIR> d-------- i:\program files\DkZ Studio
2009-02-04 17:14 . 2009-02-04 17:14 <DIR> d-------- i:\program files\Alcohol Soft
2009-02-04 17:14 . 2004-04-30 09:37 160,640 --a------ i:\windows\system32\drivers\a347bus.sys
2009-02-04 17:14 . 2004-04-30 09:33 5,248 --a------ i:\windows\system32\drivers\a347scsi.sys
2009-02-02 09:13 . 2009-02-02 09:14 <DIR> d-------- i:\program files\MotoGP
2009-02-02 09:12 . 2009-02-02 09:12 <DIR> d-------- i:\program files\Common Files\DirectX
2009-02-02 08:46 . 2009-02-02 12:24 1,519,619 --ahs---- i:\windows\system32\ebkodxhb.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 09:28 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Hamachi
2009-03-01 11:25 --------- d---a-w i:\documents and settings\All Users\Data aplikací\TEMP
2009-02-28 13:48 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Skype
2009-02-27 18:55 --------- d-----w i:\documents and settings\Ven@\Data aplikací\skypePM
2009-02-27 18:50 --------- d-----w i:\documents and settings\Ven@\Data aplikací\uTorrent
2009-02-27 18:49 --------- d-----w i:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-02-27 18:44 --------- d--h--w i:\program files\InstallShield Installation Information
2009-02-25 10:12 --------- d-----w i:\program files\QIP Infium
2009-02-23 17:24 --------- d-----w i:\documents and settings\Ven@\Data aplikací\ICQ
2009-02-21 11:53 --------- d-----w i:\program files\Call of Duty
2009-02-05 18:18 --------- d-----w i:\program files\Common Files\InstallShield
2009-02-01 08:15 --------- d-----w i:\program files\Buka
2009-01-31 10:23 --------- d-----w i:\program files\directx
2009-01-31 10:22 --------- d-----w i:\program files\Monte Cristo
2009-01-31 10:08 --------- d-----w i:\program files\Bus Driver
2009-01-30 11:31 --------- d-----w i:\program files\SUPERHRY
2009-01-26 18:26 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Canneverbe_Limited
2009-01-25 17:09 9,216 ----a-w i:\windows\system32\drivers\Amfilter.sys
2009-01-25 17:09 36,864 ----a-w i:\windows\system32\Amhooker.dll
2009-01-25 17:09 14,336 ----a-w i:\windows\system32\drivers\Amusbprt.sys
2009-01-25 17:09 14,336 ----a-w i:\windows\system32\drivers\Amps2prt.sys
2009-01-25 17:09 --------- d-----w i:\program files\A4Tech
2009-01-25 12:12 --------- d-----w i:\documents and settings\All Users\Data aplikací\hps
2009-01-25 12:11 --------- d-----w i:\program files\Teta
2009-01-24 21:24 2,287,104 ----a-w i:\windows\system32\TUKernel.exe
2009-01-24 21:20 --------- d-----w i:\documents and settings\All Users\Data aplikací\TuneUp Software
2009-01-24 21:06 --------- d-----w i:\program files\lg_fwupdate
2009-01-22 19:45 --------- d-----w i:\program files\EA GAMES
2009-01-22 17:29 --------- d-----w i:\program files\Youdagames
2009-01-20 16:48 68,096 ----a-w i:\windows\system32\dflfxxbx.dll
2009-01-17 20:02 --------- d-----w i:\program files\Skype
2009-01-17 20:02 --------- d-----w i:\program files\Common Files\Skype
2009-01-17 20:02 --------- d-----w i:\documents and settings\All Users\Data aplikací\Skype
2009-01-17 18:43 410,984 ----a-w i:\windows\system32\deploytk.dll
2009-01-17 18:43 --------- d-----w i:\program files\Java
2009-01-17 18:12 --------- d-----w i:\program files\Golden
2009-01-17 17:48 --------- d-----w i:\documents and settings\Ven@\Data aplikací\ACD Systems
2009-01-17 17:47 --------- d-----w i:\program files\Common Files\ACD Systems
2009-01-17 17:44 --------- d-----w i:\documents and settings\All Users\Data aplikací\ACD Systems
2009-01-17 17:43 --------- d-----w i:\program files\ACD Systems
2009-01-17 17:02 --------- d-----w i:\program files\totalcmd
2009-01-13 17:40 --------- d-----w i:\program files\Skispringen 2007
2009-01-13 17:20 101,376 ----a-w i:\windows\system32\drivers\ACEDRV07.sys
2009-01-12 17:15 --------- d-----w i:\program files\Common Files\LightScribe
2009-01-12 17:00 --------- d-----w i:\program files\Ahead
2009-01-12 16:59 --------- d-----w i:\program files\CyberLink DVD Solution
2009-01-12 16:59 --------- d-----w i:\program files\Common Files\Ahead
2009-01-12 16:58 --------- d-----w i:\program files\CyberLink
2009-01-12 16:20 --------- d-----w i:\program files\Czech Soccer Manager 2002 FE
2009-01-09 14:33 --------- d-----w i:\program files\valve
2009-01-09 14:29 25,280 ----a-w i:\windows\system32\drivers\hamachi.sys
2009-01-09 14:29 --------- d-----w i:\program files\Hamachi
2009-01-09 05:42 --------- d-----w i:\program files\Overland
2009-01-08 15:03 --------- d-----w i:\program files\Kavka
2009-01-08 15:02 --------- d-----w i:\program files\CDBurnerXP
2009-01-08 14:27 --------- d-----w i:\program files\ICQ6
2009-01-08 14:21 --------- d-----w i:\documents and settings\Ven@\Data aplikací\InstallShield
2009-01-08 14:11 --------- d-----w i:\program files\MSBuild
2009-01-08 14:04 --------- d-----w i:\program files\Reference Assemblies
2009-01-08 13:50 --------- d-----w i:\program files\uTorrent
2009-01-07 12:47 --------- d-----w i:\program files\BSplayer
2009-01-05 18:40 --------- d-----w i:\program files\Rockstar Games
2009-01-03 20:15 --------- d--h--w i:\program files\Zero G Registry
2009-01-03 20:14 --------- d-----w i:\program files\Sports Interactive
2009-01-03 20:13 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Sports Interactive
2009-01-03 20:00 --------- d-----w i:\program files\TrackMania Sunrise
2008-12-28 22:10 107,888 ----a-w i:\windows\system32\CmdLineExt.dll
2004-10-01 14:00 40,960 ----a-w i:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="i:\documents and settings\Ven@\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-01-08 133104]
"DAEMON Tools Lite"="i:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-19 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"SMail"="i:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"UnlockerAssistant"="i:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"NvCplDaemon"="i:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="i:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"PinnacleDriverCheck"="i:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"HP Software Update"="i:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HP Component Manager"="i:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPDJ Taskbar Utility"="i:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"DeviceDiscovery"="i:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"RemoteControl"="i:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"InCD"="i:\program files\Ahead\InCD\InCD.exe" [2005-07-08 1397760]
"SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 136600]
"WheelMouse"="i:\program files\A4Tech\Mouse\Amoumain.exe" [2009-01-25 204800]
"avast!"="i:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2004-06-13 98352]
"ashMaiSv"="i:\progra~1\ALWILS~1\Avast4\ashmaisv.exe" [2004-06-13 200752]
"nwiz"="nwiz.exe" [2006-10-22 i:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-08-13 i:\windows\system32\advpack.dll]

i:\documents and settings\Ven@\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - i:\program files\Hamachi\hamachi.exe [2009-01-09 625952]

i:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - i:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-28 113664]
Adobe Reader Speed Launch.lnk - i:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - i:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - i:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="i:\documents and settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jzdiqs.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"i:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"i:\\Program Files\\valve\\hl.exe"=
"i:\\Program Files\\CS 1.6\\Valve\\CS1.6_INT\\cstrike.exe"=
"i:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"i:\\Program Files\\Call of Duty\\CoDMP.exe"=
"i:\\Program Files\\CS 1.6\\Valve\\CS1.6_INT\\hl.exe"=
"i:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"i:\\Program Files\\TrackMania Sunrise\\TmSunrise.exe"=
"i:\\Program Files\\uTorrent\\utorrent.exe"=
"i:\\Program Files\\ICQ6\\ICQ.exe"=
"i:\\WINDOWS\\system32\\mshta.exe"=
"i:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"i:\\Program Files\\Buka\\Codemasters\\Colin McRae Rally 2.0\\CMR2Network.exe"=
"i:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);i:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R3 PSched;Plánovač paketů technologie QoS;i:\windows\system32\drivers\psched.sys [2008-04-13 69120]
S3 CrystalSysInfo;CrystalSysInfo;i:\program files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 sdauxservice;PC Tools Auxiliary Service;i:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-01 356920]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31fd3eac-e639-11dd-9cee-000ea606fcc3}]
\Shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8272cd09-d4c7-11dd-80d4-806d6172696f}]
\Shell\AutoRun\command - H:\setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"i:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2008-12-28 i:\windows\Tasks\1-Click Maintenance.job
- i:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-30 14:13]

2009-02-16 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2009-03-01 i:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1214440339-1417001333-1003.job
- i:\documents and settings\Ven@\Local Settings\Data aplikac []

2009-02-14 i:\windows\Tasks\NeroLiveEpgUpdate-VAŠEK_Ven@.job
- i:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 13:51]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{77AB5974-55A3-4737-9FD5-B93C64307F78} - i:\windows\system32\nhekfvki.dll
HKLM-Run-SpywareCease.exe - i:\program files\Spyware Cease\SpywareCease.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - i:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: {0093AA1B-7277-4E02-8C9E-4FC750611226} = 193.179.143.3,193.179.143.5
FF - ProfilePath - i:\documents and settings\Ven@\Data aplikací\Mozilla\Firefox\Profiles\relvybdt.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - hxxp://stranky.damokles.cz/?431838

---- NASTAVENÍ FIREFOXU ----
i:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 10:28:09
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\47382e01]
"ImagePath"="\SystemRoot\System32\drivers\47382e01.sys"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,7b,0f,64,00,ad,
97,f2,1d,c8,28,51,af,b0,29,a3,98,68,10,9b,b5,06,a3,7a,0c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,13,cf,e1,af,a3,
0d,87,75,71,3b,04,66,8b,46,0d,96,25,e9,ec,7e,a1,00,a4,e9,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,e2,ff,3b,be,dc,
71,17,4b,25,da,ec,7e,55,20,c9,26,69,99,30,33,54,52,f1,d8,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,7c,9a,d6,3b,a4,
87,92,a5,3e,1e,9e,e0,57,5a,93,61,5e,06,c8,20,a8,7c,af,5a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,7f,b8,ec,03,2a,
0f,5a,65,cd,44,cd,b9,a6,33,6c,cd,0f,6d,0e,72,9c,af,61,78,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,fd,14,8f,0c,11,
a9,9c,7a,b0,18,ed,a7,3f,8d,37,a4,4d,75,70,b0,6f,ad,59,e0,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,c1,54,db,86,0c,
7e,95,98,31,77,e1,ba,b1,f8,68,02,69,d0,c3,f7,6a,37,e8,3e,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,15,3a,55,0d,4c,
f1,52,ad,83,6c,56,8b,a0,85,96,ab,80,51,81,37,c3,0d,ca,19,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,3d,a7,59,0a,88,
f2,39,75,51,fa,6e,91,28,9e,14,cc,1d,9d,06,a0,6d,5f,4b,42,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,d7,ac,93,02,89,
01,6c,32,b1,cd,45,5a,a8,c4,f8,b9,8e,ca,77,59,fd,f7,33,be,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,59,6a,a4,e0,dd,
a9,99,37,e3,0e,66,d5,eb,bc,2f,6b,ce,13,63,da,e6,6c,92,08,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,fe,b0,ac,4e,02,
22,73,c4,fa,ea,66,7f,d4,3b,6b,70,2d,08,8b,90,f5,98,b8,51,6c,43,2d,1e,aa,22,\
.
------------------------ Jiné spuštené procesy ------------------------
.
i:\program files\Ahead\InCD\InCDsrv.exe
i:\program files\Alwil Software\Avast4\aswUpdSv.exe
i:\program files\Java\jre6\bin\jqs.exe
i:\program files\Common Files\LightScribe\LSSrvc.exe
i:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
i:\program files\CDBurnerXP\NMSAccessU.exe
i:\windows\system32\nvsvc32.exe
i:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Spyware Terminator\sp_rsser.exe
i:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-03-02 10:32:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-03-02 09:32:28

Před spuštěním: Volných bajtů: 333,580,976,128
Po spuštění: Volných bajtů: 333,449,854,976

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /noexecute=alwaysoff
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Vasek" /noexecute=optin /fastdetect /noexecute=alwaysoff

455

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Folder::
I:\VundoFix Backups
i:\windows\system32\save

File::
i:\windows\system32\uacinit.dll
i:\windows\system32\wr38501.dll
i:\windows\system32\ebkodxhb.tmp
i:\windows\system32\xa1107296.exe
i:\windows\system32\xa1105093.exe
i:\windows\system32\xa11955750.exe
i:\windows\system32\xa11953390.exe
i:\windows\system32\rsgxfuda.dll
i:\windows\system32\drivers\47382e01.sys
i:\windows\system32\dflfxxbx.dll

Driver:.
47382e01

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\47382e01]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Vasek17]

Tady to je

ComboFix 09-03-01.01 - Ven@ 2009-03-02 13:02:04.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1279.938 [GMT 1:00]
Spuštěný z: i:\documents and settings\Ven@\Plocha\VerTerm.exe
Použité ovládací přepínače :: i:\documents and settings\Ven@\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

FILE ::
i:\windows\system32\dflfxxbx.dll
i:\windows\system32\drivers\47382e01.sys
i:\windows\system32\ebkodxhb.tmp
i:\windows\system32\rsgxfuda.dll
i:\windows\system32\uacinit.dll
i:\windows\system32\wr38501.dll
i:\windows\system32\xa1105093.exe
i:\windows\system32\xa1107296.exe
i:\windows\system32\xa11953390.exe
i:\windows\system32\xa11955750.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\VundoFix Backups
i:\vundofix backups\byXqQiHy.dll.bad
i:\vundofix backups\byXRkKcC.dll.bad
i:\vundofix backups\cbXNGyAq.dll.bad
i:\vundofix backups\efcDVPhf.dll.bad
i:\vundofix backups\efcDWqrP.dll.bad
i:\vundofix backups\efcYQKDS.dll.bad
i:\vundofix backups\hgGYoooP.dll.bad
i:\vundofix backups\iiffDTNE.dll.bad
i:\vundofix backups\khfGyWQH.dll.bad
i:\vundofix backups\ljJyyvwT.dll.bad
i:\vundofix backups\mlJCVLFw.dll.bad
i:\vundofix backups\pmnkiJBU.dll.bad
i:\vundofix backups\qoMfgHBR.dll.bad
i:\vundofix backups\rqRJBSKE.dll.bad
i:\vundofix backups\rqRLfGvU.dll.bad
i:\vundofix backups\tuvTkhHb.dll.bad
i:\vundofix backups\urqOHWom.dll.bad
i:\vundofix backups\wvUKEttu.dll.bad
i:\vundofix backups\yayxurqq.dll.bad
i:\vundofix backups\yayYQHaB.dll.bad
i:\windows\system32\dflfxxbx.dll
i:\windows\system32\drivers\47382e01.sys
i:\windows\system32\ebkodxhb.tmp
i:\windows\system32\rsgxfuda.dll
i:\windows\system32\save
i:\windows\system32\save\Settings_YoudaFarmer_full.txt
i:\windows\system32\save\Storage_YoudaFarmer_full.txt
i:\windows\system32\uacinit.dll
i:\windows\system32\wr38501.dll
i:\windows\system32\xa1105093.exe
i:\windows\system32\xa1107296.exe
i:\windows\system32\xa11953390.exe
i:\windows\system32\xa11955750.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_47382e01


((((((((((((((((((((((((( Soubory vytvořené od 2009-02-02 do 2009-03-02 )))))))))))))))))))))))))))))))
.

2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Plocha
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d--h----- i:\documents and settings\Administrator\Okolní tiskárny
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d--h----- i:\documents and settings\Administrator\Okolní síť
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Oblíbené položky
2009-03-02 08:48 . 2008-12-28 12:17 <DIR> d--h----- i:\documents and settings\Administrator\Šablony
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> dr------- i:\documents and settings\Administrator\Nabídka Start
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> d-------- i:\documents and settings\Administrator\Dokumenty
2009-03-02 08:48 . 2008-12-28 13:11 <DIR> dr-h----- i:\documents and settings\Administrator\Data aplikací
2009-03-02 08:48 . 2009-03-02 08:50 <DIR> d-------- i:\documents and settings\Administrator
2009-03-02 07:59 . 2009-03-02 07:59 <DIR> d-------- i:\program files\Malwarebytes' Anti-Malware
2009-03-01 10:51 . 2009-03-01 10:51 <DIR> d-------- i:\program files\CCleaner
2009-03-01 08:39 . 2009-03-01 08:39 54,156 --ah----- i:\windows\QTFont.qfn
2009-03-01 08:39 . 2009-03-01 08:39 1,409 --a------ i:\windows\QTFont.for
2009-03-01 08:27 . 2009-03-01 08:27 4,706 --a------ i:\windows\system32\PerfStringBackup.TMP
2009-03-01 08:25 . 2009-03-01 08:26 <DIR> d-------- i:\program files\Spyware Doctor
2009-03-01 08:25 . 2009-03-01 08:25 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\PC Tools
2009-03-01 08:25 . 2008-08-25 12:36 81,288 --a------ i:\windows\system32\drivers\iksyssec.sys
2009-03-01 08:25 . 2008-08-25 12:36 66,952 --a------ i:\windows\system32\drivers\iksysflt.sys
2009-03-01 08:25 . 2008-08-25 12:36 40,840 --a------ i:\windows\system32\drivers\ikfilesec.sys
2009-03-01 08:25 . 2008-06-02 16:19 29,576 --a------ i:\windows\system32\drivers\kcom.sys
2009-02-28 19:29 . 2009-03-01 07:56 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\Spyware Terminator
2009-02-28 19:29 . 2009-03-01 08:25 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-02-28 19:29 . 2009-02-28 19:29 141,312 --a------ i:\windows\system32\drivers\sp_rsdrv2.sys
2009-02-28 19:21 . 2009-02-28 19:21 <DIR> d-------- i:\program files\Alwil Software
2009-02-27 20:28 . 2008-04-14 08:52 54,272 --a------ i:\windows\system32\vfwwdm32.dll
2009-02-27 20:28 . 2008-04-14 08:52 54,272 --a--c--- i:\windows\system32\dllcache\vfwwdm32.dll
2009-02-27 20:24 . 2009-02-27 20:24 <DIR> d-------- I:\Drivers
2009-02-27 20:24 . 2001-11-05 09:23 299,923 --a------ i:\windows\system32\drivers\sonyhcs.sys
2009-02-27 20:24 . 2002-10-15 22:41 102,220 --a------ i:\windows\system32\drivers\sonypvs1.sys
2009-02-27 20:24 . 2001-07-03 20:33 53,248 --a------ i:\windows\system32\SONYHCY.DLL
2009-02-27 20:24 . 2001-11-05 09:23 38,739 --a------ i:\windows\system32\drivers\sonyhcc.sys
2009-02-27 20:24 . 2001-11-05 09:23 6,097 --a------ i:\windows\system32\drivers\sonyhcb.sys
2009-02-27 20:24 . 2001-07-03 20:39 3,654 --a------ i:\windows\system32\drivers\Sonyhcp.dll
2009-02-27 19:48 . 2009-02-27 19:48 <DIR> d-------- i:\program files\CSM2002
2009-02-27 08:26 . 2009-02-27 20:23 <DIR> d-------- i:\program files\sony_drive
2009-02-24 19:40 . 2009-02-24 19:40 7,168 --ahs---- i:\windows\Thumbs.db
2009-02-24 11:05 . 2009-02-27 19:37 <DIR> d-------- i:\program files\MSDN(2)
2009-02-20 18:52 . 2009-02-27 19:39 <DIR> d-------- i:\program files\PVD15
2009-02-20 15:33 . 2009-02-27 19:39 <DIR> d-------- i:\program files\DesetiPrsty
2009-02-17 20:34 . 2009-02-17 21:03 <DIR> d-------- i:\program files\Microsoft SQL Server
2009-02-17 20:33 . 2009-02-17 20:33 <DIR> d-------- i:\program files\Microsoft SQL Server 2005 Mobile Edition
2009-02-17 20:33 . 2009-02-17 20:33 <DIR> d-------- i:\program files\Microsoft Device Emulator
2009-02-17 19:21 . 2009-02-27 19:49 <DIR> d-------- i:\program files\Microsoft.NET
2009-02-17 19:21 . 2009-02-27 19:49 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\PreEmptive Solutions
2009-02-17 19:05 . 2009-02-27 19:49 <DIR> d-------- i:\program files\Microsoft Visual Studio 8
2009-02-15 16:24 . 2009-02-15 16:29 <DIR> d-------- I:\eee6abb4fe8c95dc4179396eef75e6
2009-02-15 12:54 . 2009-02-27 19:50 <DIR> d-------- i:\program files\Transformers
2009-02-14 19:14 . 2009-02-27 20:41 <DIR> d-------- i:\program files\Bubble Struggle V1.2
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\NeroDigital(TM)
2009-02-14 10:23 . 2009-02-14 10:23 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\LightScribe
2009-02-14 10:18 . 2009-02-14 10:42 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\Nero
2009-02-14 09:48 . 2009-02-14 09:48 4,767 --a------ i:\windows\Irremote.ini
2009-02-14 09:42 . 2009-02-14 09:42 <DIR> d-------- i:\program files\Windows Sidebar
2009-02-14 09:17 . 2009-02-14 09:46 <DIR> d-------- i:\program files\Nero
2009-02-14 09:16 . 2009-02-14 09:26 <DIR> d-------- i:\program files\Common Files\Nero
2009-02-14 09:16 . 2009-02-14 09:31 <DIR> d-------- i:\documents and settings\All Users\Data aplikací\Nero
2009-02-14 08:50 . 2009-02-14 08:50 <DIR> d-------- i:\program files\PSPad editor
2009-02-14 08:48 . 2009-02-14 08:48 <DIR> d-------- i:\program files\POKEMON
2009-02-12 17:16 . 2009-02-12 17:16 <DIR> d-------- i:\documents and settings\Ven@\Data aplikací\QIP
2009-02-08 11:05 . 1998-10-29 16:45 306,688 --a------ i:\windows\IsUninst.exe
2009-02-06 17:57 . 2009-02-06 17:57 <DIR> d-------- i:\program files\KONAMI
2009-02-05 21:06 . 2009-02-06 20:15 <DIR> d-------- i:\program files\DkZ Studio
2009-02-04 17:14 . 2009-02-04 17:14 <DIR> d-------- i:\program files\Alcohol Soft
2009-02-04 17:14 . 2004-04-30 09:37 160,640 --a------ i:\windows\system32\drivers\a347bus.sys
2009-02-04 17:14 . 2004-04-30 09:33 5,248 --a------ i:\windows\system32\drivers\a347scsi.sys
2009-02-02 09:13 . 2009-02-02 09:14 <DIR> d-------- i:\program files\MotoGP
2009-02-02 09:12 . 2009-02-02 09:12 <DIR> d-------- i:\program files\Common Files\DirectX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 12:07 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Hamachi
2009-03-01 11:25 --------- d---a-w i:\documents and settings\All Users\Data aplikací\TEMP
2009-02-28 13:48 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Skype
2009-02-27 18:55 --------- d-----w i:\documents and settings\Ven@\Data aplikací\skypePM
2009-02-27 18:50 --------- d-----w i:\documents and settings\Ven@\Data aplikací\uTorrent
2009-02-27 18:49 --------- d-----w i:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-02-27 18:44 --------- d--h--w i:\program files\InstallShield Installation Information
2009-02-25 10:12 --------- d-----w i:\program files\QIP Infium
2009-02-23 17:24 --------- d-----w i:\documents and settings\Ven@\Data aplikací\ICQ
2009-02-21 11:53 --------- d-----w i:\program files\Call of Duty
2009-02-05 18:18 --------- d-----w i:\program files\Common Files\InstallShield
2009-02-01 08:15 --------- d-----w i:\program files\Buka
2009-01-31 10:23 --------- d-----w i:\program files\directx
2009-01-31 10:22 --------- d-----w i:\program files\Monte Cristo
2009-01-31 10:08 --------- d-----w i:\program files\Bus Driver
2009-01-30 11:31 --------- d-----w i:\program files\SUPERHRY
2009-01-26 18:26 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Canneverbe_Limited
2009-01-25 17:09 9,216 ----a-w i:\windows\system32\drivers\Amfilter.sys
2009-01-25 17:09 36,864 ----a-w i:\windows\system32\Amhooker.dll
2009-01-25 17:09 14,336 ----a-w i:\windows\system32\drivers\Amusbprt.sys
2009-01-25 17:09 14,336 ----a-w i:\windows\system32\drivers\Amps2prt.sys
2009-01-25 17:09 --------- d-----w i:\program files\A4Tech
2009-01-25 12:12 --------- d-----w i:\documents and settings\All Users\Data aplikací\hps
2009-01-25 12:11 --------- d-----w i:\program files\Teta
2009-01-24 21:24 2,287,104 ----a-w i:\windows\system32\TUKernel.exe
2009-01-24 21:20 --------- d-----w i:\documents and settings\All Users\Data aplikací\TuneUp Software
2009-01-24 21:06 --------- d-----w i:\program files\lg_fwupdate
2009-01-22 19:45 --------- d-----w i:\program files\EA GAMES
2009-01-22 17:29 --------- d-----w i:\program files\Youdagames
2009-01-17 20:02 --------- d-----w i:\program files\Skype
2009-01-17 20:02 --------- d-----w i:\program files\Common Files\Skype
2009-01-17 20:02 --------- d-----w i:\documents and settings\All Users\Data aplikací\Skype
2009-01-17 18:43 410,984 ----a-w i:\windows\system32\deploytk.dll
2009-01-17 18:43 --------- d-----w i:\program files\Java
2009-01-17 18:12 --------- d-----w i:\program files\Golden
2009-01-17 17:48 --------- d-----w i:\documents and settings\Ven@\Data aplikací\ACD Systems
2009-01-17 17:47 --------- d-----w i:\program files\Common Files\ACD Systems
2009-01-17 17:44 --------- d-----w i:\documents and settings\All Users\Data aplikací\ACD Systems
2009-01-17 17:43 --------- d-----w i:\program files\ACD Systems
2009-01-17 17:02 --------- d-----w i:\program files\totalcmd
2009-01-13 17:40 --------- d-----w i:\program files\Skispringen 2007
2009-01-13 17:20 101,376 ----a-w i:\windows\system32\drivers\ACEDRV07.sys
2009-01-12 17:15 --------- d-----w i:\program files\Common Files\LightScribe
2009-01-12 17:00 --------- d-----w i:\program files\Ahead
2009-01-12 16:59 --------- d-----w i:\program files\CyberLink DVD Solution
2009-01-12 16:59 --------- d-----w i:\program files\Common Files\Ahead
2009-01-12 16:58 --------- d-----w i:\program files\CyberLink
2009-01-12 16:20 --------- d-----w i:\program files\Czech Soccer Manager 2002 FE
2009-01-09 14:33 --------- d-----w i:\program files\valve
2009-01-09 14:29 25,280 ----a-w i:\windows\system32\drivers\hamachi.sys
2009-01-09 14:29 --------- d-----w i:\program files\Hamachi
2009-01-09 05:42 --------- d-----w i:\program files\Overland
2009-01-08 15:03 --------- d-----w i:\program files\Kavka
2009-01-08 15:02 --------- d-----w i:\program files\CDBurnerXP
2009-01-08 14:27 --------- d-----w i:\program files\ICQ6
2009-01-08 14:21 --------- d-----w i:\documents and settings\Ven@\Data aplikací\InstallShield
2009-01-08 14:11 --------- d-----w i:\program files\MSBuild
2009-01-08 14:04 --------- d-----w i:\program files\Reference Assemblies
2009-01-08 13:50 --------- d-----w i:\program files\uTorrent
2009-01-07 12:47 --------- d-----w i:\program files\BSplayer
2009-01-05 18:40 --------- d-----w i:\program files\Rockstar Games
2009-01-03 20:15 --------- d--h--w i:\program files\Zero G Registry
2009-01-03 20:14 --------- d-----w i:\program files\Sports Interactive
2009-01-03 20:13 --------- d-----w i:\documents and settings\Ven@\Data aplikací\Sports Interactive
2009-01-03 20:00 --------- d-----w i:\program files\TrackMania Sunrise
2008-12-28 22:10 107,888 ----a-w i:\windows\system32\CmdLineExt.dll
2004-10-01 14:00 40,960 ----a-w i:\program files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-03-02_10.31.32.67 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-02 12:07:28 16,384 ----atw i:\windows\Temp\Perflib_Perfdata_414.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="i:\documents and settings\Ven@\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-01-08 133104]
"DAEMON Tools Lite"="i:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-19 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"SMail"="i:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"UnlockerAssistant"="i:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"NvCplDaemon"="i:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="i:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"PinnacleDriverCheck"="i:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"HP Software Update"="i:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HP Component Manager"="i:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPDJ Taskbar Utility"="i:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"DeviceDiscovery"="i:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"RemoteControl"="i:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"InCD"="i:\program files\Ahead\InCD\InCD.exe" [2005-07-08 1397760]
"SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 136600]
"WheelMouse"="i:\program files\A4Tech\Mouse\Amoumain.exe" [2009-01-25 204800]
"avast!"="i:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2004-06-13 98352]
"ashMaiSv"="i:\progra~1\ALWILS~1\Avast4\ashmaisv.exe" [2004-06-13 200752]
"nwiz"="nwiz.exe" [2006-10-22 i:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-08-13 i:\windows\system32\advpack.dll]

i:\documents and settings\Ven@\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - i:\program files\Hamachi\hamachi.exe [2009-01-09 625952]

i:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - i:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-28 113664]
Adobe Reader Speed Launch.lnk - i:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - i:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - i:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="i:\documents and settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"i:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"i:\\Program Files\\valve\\hl.exe"=
"i:\\Program Files\\CS 1.6\\Valve\\CS1.6_INT\\cstrike.exe"=
"i:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"i:\\Program Files\\Call of Duty\\CoDMP.exe"=
"i:\\Program Files\\CS 1.6\\Valve\\CS1.6_INT\\hl.exe"=
"i:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"i:\\Program Files\\TrackMania Sunrise\\TmSunrise.exe"=
"i:\\Program Files\\uTorrent\\utorrent.exe"=
"i:\\Program Files\\ICQ6\\ICQ.exe"=
"i:\\WINDOWS\\system32\\mshta.exe"=
"i:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"i:\\Program Files\\Buka\\Codemasters\\Colin McRae Rally 2.0\\CMR2Network.exe"=
"i:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);i:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R3 PSched;Plánovač paketů technologie QoS;i:\windows\system32\drivers\psched.sys [2008-04-13 69120]
S3 CrystalSysInfo;CrystalSysInfo;i:\program files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 sdauxservice;PC Tools Auxiliary Service;i:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-01 356920]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31fd3eac-e639-11dd-9cee-000ea606fcc3}]
\Shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8272cd09-d4c7-11dd-80d4-806d6172696f}]
\Shell\AutoRun\command - H:\setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"i:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2008-12-28 i:\windows\Tasks\1-Click Maintenance.job
- i:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-30 14:13]

2009-02-16 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2009-03-01 i:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1214440339-1417001333-1003.job
- i:\documents and settings\Ven@\Local Settings\Data aplikac []

2009-02-14 i:\windows\Tasks\NeroLiveEpgUpdate-VAŠEK_Ven@.job
- i:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 13:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - i:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: {0093AA1B-7277-4E02-8C9E-4FC750611226} = 193.179.143.3,193.179.143.5
FF - ProfilePath - i:\documents and settings\Ven@\Data aplikací\Mozilla\Firefox\Profiles\relvybdt.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - hxxp://stranky.damokles.cz/?431838

---- NASTAVENÍ FIREFOXU ----
i:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 13:07:56
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,7b,0f,64,00,ad,
97,f2,1d,c8,28,51,af,b0,29,a3,98,68,10,9b,b5,06,a3,7a,0c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,13,cf,e1,af,a3,
0d,87,75,71,3b,04,66,8b,46,0d,96,25,e9,ec,7e,a1,00,a4,e9,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,e2,ff,3b,be,dc,
71,17,4b,25,da,ec,7e,55,20,c9,26,69,99,30,33,54,52,f1,d8,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,7c,9a,d6,3b,a4,
87,92,a5,3e,1e,9e,e0,57,5a,93,61,5e,06,c8,20,a8,7c,af,5a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,7f,b8,ec,03,2a,
0f,5a,65,cd,44,cd,b9,a6,33,6c,cd,0f,6d,0e,72,9c,af,61,78,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,fd,14,8f,0c,11,
a9,9c,7a,b0,18,ed,a7,3f,8d,37,a4,4d,75,70,b0,6f,ad,59,e0,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,c1,54,db,86,0c,
7e,95,98,31,77,e1,ba,b1,f8,68,02,69,d0,c3,f7,6a,37,e8,3e,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,15,3a,55,0d,4c,
f1,52,ad,83,6c,56,8b,a0,85,96,ab,80,51,81,37,c3,0d,ca,19,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,3d,a7,59,0a,88,
f2,39,75,51,fa,6e,91,28,9e,14,cc,1d,9d,06,a0,6d,5f,4b,42,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,d7,ac,93,02,89,
01,6c,32,b1,cd,45,5a,a8,c4,f8,b9,8e,ca,77,59,fd,f7,33,be,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,59,6a,a4,e0,dd,
a9,99,37,e3,0e,66,d5,eb,bc,2f,6b,ce,13,63,da,e6,6c,92,08,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="i:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,fe,b0,ac,4e,02,
22,73,c4,fa,ea,66,7f,d4,3b,6b,70,2d,08,8b,90,f5,98,b8,51,6c,43,2d,1e,aa,22,\
.
------------------------ Jiné spuštené procesy ------------------------
.
i:\program files\Ahead\InCD\InCDsrv.exe
i:\program files\Alwil Software\Avast4\aswUpdSv.exe
i:\program files\Java\jre6\bin\jqs.exe
i:\program files\Common Files\LightScribe\LSSrvc.exe
i:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
i:\program files\CDBurnerXP\NMSAccessU.exe
i:\windows\system32\nvsvc32.exe
i:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Spyware Terminator\sp_rsser.exe
i:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-03-02 13:12:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-03-02 12:12:03
ComboFix2.txt 2009-03-02 09:32:38

Před spuštěním: Volných bajtů: 333 412 253 696
Po spuštění: Volných bajtů: 333,253,070,848

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP" /noexecute=optin /fastdetect /noexecute=alwaysoff
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Vasek" /noexecute=optin /fastdetect /noexecute=alwaysoff

411






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:13:45, on 2.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Ahead\InCD\InCDsrv.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\Java\jre6\bin\jqs.exe
I:\Program Files\Common Files\LightScribe\LSSrvc.exe
I:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
I:\Program Files\HP\hpcoretech\hpcmpmgr.exe
I:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
I:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
I:\Program Files\Ahead\InCD\InCD.exe
I:\Program Files\Java\jre6\bin\jusched.exe
I:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Documents and Settings\Ven@\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
I:\Program Files\CDBurnerXP\NMSAccessU.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
c:\Program Files\Spyware Terminator\sp_rsser.exe
I:\WINDOWS\system32\wscntfy.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\explorer.exe
I:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - I:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SMail] "I:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "I:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PinnacleDriverCheck] I:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] "I:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "I:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] I:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] I:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [RemoteControl] "I:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] I:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] I:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] I:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "I:\Documents and Settings\Ven@\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "I:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: hamachi.lnk = I:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = I:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = I:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - I:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{0093AA1B-7277-4E02-8C9E-4FC750611226}: NameServer = 193.179.143.3,193.179.143.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - Unknown owner - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - Unknown owner - I:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Služba inteligentního přenosu na pozadí (BITS) - Unknown owner - I:\WINDOWS\
O23 - Service: InCD Helper (InCDsrv) - Nero AG - I:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - I:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - I:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - I:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - I:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - c:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8645 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe"

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Pokud nejsou problémy , je to vše, můžeš dát vyřešeno, fajfku.