Prosím o kontrolu logu...

[Death at Comp]

Zdravim...
Když jsem chtěl otevřít složku objevila se hláška "Problém explorer exe" a zavřela se.Tady je log z HT koukněte se na to...Díky.
Logfile of HijackThis v1.99.1
Scan saved at 19:52:44, on 6.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Virtual CD v8\System\VC8SecS.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\RAM Idle LE\RAM_XP.exe
C:\Program Files\Virtual CD v8\System\VC8Play.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\TRANSLAT\Wdict32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Virtual CD v8\System\VC8Tray.exe
C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O1 - Hosts: 77.75.76.3 seznam.cz
O1 - Hosts: 193.86.85.15 atlas.cz
O1 - Hosts: 194.50.240.198 csas.cz
O1 - Hosts: 194.79.52.192 idnes.cz
O1 - Hosts: 212.71.138.15 pocteni.jinak.cz
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Net\NetXfer\NXIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Burn4Free Toolbar Helper - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - (no file)
O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - (no file)
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: &Seznam Lištička - {B71B15CE-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Listicka\Toolbar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Net\NetXfer\NXToolBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Vypalování\Nero 8\Nero 8 Ultra Edition 8.2.8.0 CZ+ keygen\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [VC8Player] C:\Program Files\Virtual CD v8\System\VC8Play.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GEST] =
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WDICT32] C:\TRANSLAT\Wdict32.exe /l
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [CrystalXP] C:\Program Files\System\CrystalXP\CrystalXP.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
O8 - Extra context menu item: &Přelož do češtiny - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5034
O8 - Extra context menu item: Hledej v &Seznamu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5033
O8 - Extra context menu item: Hledej v Seznam &Fulltextu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5035
O8 - Extra context menu item: Stáhnout pomocí NetXferu - C:\Program Files\Net\NetXfer\NXAddLink.html
O8 - Extra context menu item: Stáhnout vše pomocí Net&Xferu - C:\Program Files\Net\NetXfer\NXAddList.html
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.idnes.cz/
O16 - DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} (ToolbarInetInstall Control) - http://www.listicka.cz/toolbar.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1420445173
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol ... _en_dl.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DirMngr - Unknown owner - C:\Program Files\System\GnuPG\dirmngr.exe" --service (file missing)
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: SQL Server (SONY_MEDIAMGR2) (MSSQL$SONY_MEDIAMGR2) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSONY_MEDIAMGR2 (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual CD v8 Management Service (VC8SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v8\System\VC8SecS.exe

[Reklama]

[jaro3]

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Death at Comp]

Malwarebytes' Anti-Malware 1.36
Verze databáze: 2084
Windows 5.1.2600 Service Pack 3

6.5.2009 21:32:07
mbam-log-2009-05-06 (21-31-54).txt

Typ skenu: Rychlý sken
Objektu skenováno: 116773
Uplynulý cas: 16 minute(s), 3 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 21
Infikované hodnoty registru: 7
Infikované položky dat registru: 0
Infikované složky: 11
Infikované soubory: 40

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\CLSID\{f80c1d93-0d22-436e-963e-9d3156997a4e} (Adware.Accoona) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ad7fafb0-16d6-40c3-af27-585d6e6453fd} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{944864a5-3916-46e2-96a9-a2e84f3f1208} (Adware.Accoona) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{364b6276-c6c1-40b6-a6d7-6c48871fd707} (Adware.Accoona) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db893839-10f0-4af9-92fa-b23528f530af} (Dialer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-0000-0000-0000-000020040000} (Trojan.Dialer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{944864a5-3916-46e2-96a9-a2e84f3f1208} (Adware.Accoona) -> No action taken.
HKEY_CLASSES_ROOT\VideoAXObject.Chl (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> No action taken.

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmcl-2.6.1.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpg-mux-2.0.1.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\liboggvorbis-0.3.1.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpa-enc-1.0.2.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpg-dec-1.0.3.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpv-enc-1.2.4.dll (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libimg-2.2.8.dll (Trojan.FakeAlert) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyGlobalSearch\bar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Advantage (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302} (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components (Adware.Advantage) -> No action taken.

Infikované soubory:
C:\Program Files\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Advantage\AdVantage.db (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\AdVantage.htm (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\ffext.mod (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\user.db (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc (Adware.Advantage) -> No action taken.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt (Adware.Advantage) -> No action taken.
C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vcmgcd32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\wgp.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libmcl-2.6.1.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libmpg-mux-2.0.1.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\liboggvorbis-0.3.1.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libmpa-enc-1.0.2.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libmpg-dec-1.0.3.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libmpv-enc-1.2.4.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\libimg-2.2.8.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\logo1_.exe (Worm.Viking) -> No action taken.
C:\WINDOWS\casino.INI (Malware.Trace) -> No action taken.
C:\WINDOWS\Fonts\bonehymie.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\fighting_spirit_tbs.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\ideoma_spray.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\oil_makes_you_run_faster.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\outlaw.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\preciosa.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\santacarla.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\sawesome.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\schnee.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\srg_marker.zip (Worm.Archive) -> No action taken.
C:\WINDOWS\Fonts\vtks_mercearia.zip (Worm.Archive) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochranu u Avastu+deaktivuj Spybot.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Zítra..

[Death at Comp]

Tady je log z MbAM po odstranění těch škodlivejch kódů:
Malwarebytes' Anti-Malware 1.36
Verze databáze: 2084
Windows 5.1.2600 Service Pack 3

6.5.2009 22:05:26
mbam-log-2009-05-06 (22-05-26).txt

Typ skenu: Rychlý sken
Objektu skenováno: 116791
Uplynulý cas: 13 minute(s), 35 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 21
Infikované hodnoty registru: 7
Infikované položky dat registru: 0
Infikované složky: 11
Infikované soubory: 40

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_CLASSES_ROOT\CLSID\{f80c1d93-0d22-436e-963e-9d3156997a4e} (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ad7fafb0-16d6-40c3-af27-585d6e6453fd} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{944864a5-3916-46e2-96a9-a2e84f3f1208} (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{364b6276-c6c1-40b6-a6d7-6c48871fd707} (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db893839-10f0-4af9-92fa-b23528f530af} (Dialer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-0000-0000-0000-000020040000} (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{944864a5-3916-46e2-96a9-a2e84f3f1208} (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\VideoAXObject.Chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmcl-2.6.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpg-mux-2.0.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\liboggvorbis-0.3.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpa-enc-1.0.2.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpg-dec-1.0.3.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libmpv-enc-1.2.4.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\libimg-2.2.8.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Advantage (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302} (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components (Adware.Advantage) -> Quarantined and deleted successfully.

Infikované soubory:
C:\Program Files\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\AdVantage.db (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\AdVantage.htm (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\ffext.mod (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\user.db (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt (Adware.Advantage) -> Quarantined and deleted successfully.
C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcmgcd32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\wgp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmcl-2.6.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmpg-mux-2.0.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\liboggvorbis-0.3.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmpa-enc-1.0.2.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmpg-dec-1.0.3.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmpv-enc-1.2.4.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libimg-2.2.8.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\logo1_.exe (Worm.Viking) -> Delete on reboot.
C:\WINDOWS\casino.INI (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\bonehymie.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\fighting_spirit_tbs.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\ideoma_spray.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\oil_makes_you_run_faster.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\outlaw.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\preciosa.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\santacarla.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\sawesome.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\schnee.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\srg_marker.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\vtks_mercearia.zip (Worm.Archive) -> Quarantined and deleted successfully.


Tady je log z MbAM po restartu:
Malwarebytes' Anti-Malware 1.36
Verze databáze: 2084
Windows 5.1.2600 Service Pack 3

6.5.2009 22:51:55
mbam-log-2009-05-06 (22-51-55).txt

Typ skenu: Rychlý sken
Objektu skenováno: 116632
Uplynulý cas: 16 minute(s), 11 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)


A tady je log z ComboFix:
ComboFix 09-05-05.05 - ase 06.05.2009 23:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1271 [GMT 2:00]
Spuštěný z: c:\program files\System\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090506-0] *On-access scanning disabled* (Updated)
FW: Sunbelt Kerio Personal Firewall *enabled*
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ase\Local Settings\Temporary Internet Files\SLOVA.WAV
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
c:\windows\system32\win32.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-06 do 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-06 19:12 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-06 19:12 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-06 18:15 . 2009-05-06 18:15 -------- d---a-w c:\windows\system32\runouce.exe
2009-05-01 16:10 . 2009-05-01 16:10 308160 ----a-w c:\program files\avast_home_setup.exe
2009-04-29 21:30 . 2009-04-29 21:30 -------- d-----w c:\program files\Dips
2009-04-29 21:29 . 2009-04-29 21:29 4558 ----a-w c:\program files\dips.zip
2009-04-26 11:37 . 2009-04-26 15:24 -------- d-----w c:\program files\Blue soleil
2009-04-26 11:27 . 2009-04-26 11:32 90913287 ----a-w c:\program files\BlueSoleil_6.4.249.0.zip
2009-04-26 10:30 . 2009-04-26 10:30 -------- d-----w c:\program files\IVT Corporation
2009-04-23 18:21 . 2009-04-24 07:25 1124 ----a-w c:\windows\system32\ezdigsgn.dat
2009-04-20 10:22 . 2009-04-26 10:27 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-20 10:20 . 2009-04-20 10:21 -------- d-----w c:\windows\system32\drivers\UMDF
2009-04-20 10:20 . 2009-04-20 10:20 -------- d-----w c:\windows\system32\LogFiles
2009-04-19 20:32 . 2009-04-19 20:37 -------- d-----w c:\temp\Dokumenty 2
2009-04-16 09:35 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 09:35 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 09:35 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 09:35 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 09:35 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 09:35 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 09:35 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 09:35 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 09:35 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 09:35 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-14 17:11 . 2009-04-14 17:11 -------- d-----w c:\program files\AskBarDis

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 21:02 . 2008-02-05 19:14 -------- d-----w c:\program files\System
2009-05-06 20:21 . 2008-08-05 18:32 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-29 19:08 . 2007-02-19 12:28 10 ---ha-w c:\windows\popcinfo.dat
2009-04-27 05:39 . 2005-11-07 14:56 476182 ----a-w c:\windows\system32\perfh005.dat
2009-04-27 05:39 . 2005-11-07 14:56 96196 ----a-w c:\windows\system32\perfc005.dat
2009-04-26 11:35 . 2009-03-02 11:42 -------- d-----w c:\program files\BlueSoleil 6.4.249.0WithMobile
2009-04-19 17:29 . 2008-02-05 18:42 -------- d-----w c:\program files\Ostatní
2009-04-19 12:27 . 2009-03-04 21:44 -------- d-----w c:\program files\Opera
2009-04-19 12:18 . 2006-11-15 10:30 -------- d-----w c:\program files\LeechVideoConvert
2009-04-15 09:45 . 2006-01-08 22:10 -------- d-----w c:\program files\Java
2009-04-09 17:30 . 2008-02-05 18:18 -------- d-----w c:\program files\Hudba a Zvuky
2009-04-06 22:25 . 2006-08-29 14:02 -------- d-----w c:\program files\Common Files\Ahead
2009-04-06 19:44 . 2009-04-06 19:44 -------- d-----w c:\program files\Nero
2009-04-06 19:20 . 2009-04-06 19:14 944687 ----a-w c:\program files\General-CleanTool.zip
2009-04-06 18:44 . 2008-03-21 19:21 -------- d-----w c:\program files\Vypalování
2009-04-05 20:27 . 2008-03-21 19:21 -------- d-----w c:\program files\Video
2009-04-02 22:43 . 2009-04-02 20:50 -------- d-----w c:\program files\NewBlue
2009-04-02 22:20 . 2009-04-02 22:20 -------- d-----w c:\program files\Common Files\eSellerate
2009-04-02 20:58 . 2005-12-26 00:04 -------- d-----w c:\program files\Google
2009-03-31 09:13 . 2009-03-31 09:13 1490040 ----a-w c:\program files\snowman.zip
2009-03-27 18:15 . 2006-08-30 20:47 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-27 17:51 . 2008-02-05 22:42 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-27 17:50 . 2009-03-27 17:50 20113293 ----a-w c:\program files\klmcodec470.exe
2009-03-25 15:41 . 2009-03-25 15:41 -------- d-----w c:\program files\Common Files\soft602
2009-03-17 21:54 . 2008-08-15 19:57 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-09 12:27 . 2009-03-09 12:27 199 ----a-w c:\windows\Fonts\LICENSE.txt
2009-03-09 03:19 . 2009-01-09 14:24 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 09:01 . 2005-11-07 14:41 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-06 14:23 . 2005-11-07 14:55 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-04 21:10 . 2009-03-04 21:10 7562568 ----a-w c:\program files\Opera_964_int_Setup.exe
2009-03-03 00:14 . 2005-11-07 14:56 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-21 11:01 . 2009-02-21 11:01 228 ----a-r c:\windows\Fonts\font info.txt
2009-02-20 17:13 . 2005-11-07 14:55 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 18:56 . 2009-03-27 18:12 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 16:04 . 2009-02-09 16:04 1337 ----a-w c:\windows\Fonts\listemageren.txt
2009-02-09 14:07 . 2005-11-07 14:56 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2005-11-07 14:55 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2005-11-07 14:55 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2005-11-07 14:55 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2005-11-07 14:55 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2005-11-07 14:55 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2005-11-07 14:55 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 10:39 . 2005-11-07 14:55 35328 ----a-w c:\windows\system32\sc.exe
2008-12-28 15:18 . 2008-12-28 15:18 42308813 ----a-w c:\program files\VirtualCD8006EG_web.exe
2008-11-08 12:59 . 2008-11-08 12:59 1851544 ----a-w c:\program files\install_flash_player.exe
2008-09-25 13:39 . 2008-09-25 13:39 1109368 ----a-w c:\program files\General-CleanTool_2_2_0_37.exe
2008-08-24 22:26 . 2008-08-24 22:25 10245064 ----a-w c:\program files\DTPro4300302BasicTrial.exe
2008-01-12 00:34 . 2008-01-12 00:33 2989143 ----a-w c:\program files\dvdcutterSetup.exe
2008-01-05 21:28 . 2008-01-05 21:27 3552785 ----a-w c:\program files\dvd-audio-ripper.exe
2008-01-05 20:35 . 2008-01-05 20:35 1359301 ----a-w c:\program files\Camstudio-2.0-w32.zip
2008-01-05 20:22 . 2008-01-05 20:22 542652 ----a-w c:\program files\webshot.exe
2007-12-16 20:56 . 2007-12-16 20:57 912530 ----a-w c:\program files\ramidlLE.exe
2007-12-16 20:10 . 2007-12-16 20:11 1363963 ----a-w c:\program files\rrsetup.exe
2007-12-10 20:57 . 2007-12-10 20:57 6803408 ----a-w c:\program files\HDDlife_2.9.109.exe
2007-11-09 20:26 . 2007-11-09 20:25 10656216 ----a-w c:\program files\JoostSetup-Beta-1.0.exe
2007-07-23 19:47 . 2007-07-23 19:47 1102920 ----a-w c:\program files\tv.exe
2007-06-23 17:57 . 2007-02-16 15:03 1706566 ----a-w c:\program files\smsposilacinst.exe
2007-06-01 20:05 . 2007-06-01 20:05 5536535 ------w c:\program files\dvdfabplatinum3086.exe
2007-06-01 19:40 . 2007-06-01 19:40 3262452 ------w c:\program files\DVDFabPlatinum29.exe
2007-05-31 19:09 . 2007-05-31 19:08 553687 ----a-w c:\program files\regcleaner.exe
2007-02-04 17:30 . 2007-02-04 17:29 3836577 ----a-w c:\program files\DCPlusPlus-0.698.exe
2007-01-30 17:05 . 2007-01-30 16:56 21822168 ----a-w c:\program files\AdbeRdr80_en_US.exe
2006-12-26 16:51 . 2006-12-26 16:51 0 ----a-w c:\program files\bsplayer212.941_video.exe
2006-12-24 22:30 . 2006-12-24 22:30 1690752 ----a-w c:\program files\tcmd32.exe
2006-12-22 20:37 . 2006-12-22 20:38 614890 ----a-w c:\program files\utorrent16.exe
2006-11-19 13:45 . 2006-11-19 13:44 1484576 ----a-w c:\program files\ProcessExplorerNt.zip
2006-11-15 10:30 . 2006-11-15 10:27 7101440 ----a-w c:\program files\PocketDivXEncoder_0.3.60.exe
2006-11-15 10:26 . 2006-11-15 10:26 12577 ----a-w c:\program files\videodetect 0.91.xpi
2006-10-22 12:32 . 2006-10-22 12:32 774144 ----a-w c:\program files\RngInterstitial.dll
2006-09-20 17:27 . 2006-09-20 17:26 1986653 ----a-w c:\program files\videomach-3.4.1.exe
2006-08-30 20:54 . 2006-08-30 20:54 227776 ----a-w c:\program files\15039_18239.exe
2006-07-28 07:32 . 2006-07-28 07:32 7005 ----a-w c:\program files\Eula.txt
2006-07-12 11:59 . 2006-07-12 11:59 3278400 ----a-w c:\program files\procexp.exe
2006-04-27 15:40 . 2006-04-27 15:40 72418 ----a-w c:\program files\procexp.chm
2008-08-27 13:03 . 2007-08-13 13:08 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-08-31 10:28 . 2005-05-13 15:12 217073 --sha-r c:\windows\meta4.exe
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r c:\windows\system32\cygz.dll
2006-05-03 10:06 . 2008-06-21 20:51 163328 --sh--r c:\windows\system32\flvDX.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r c:\windows\system32\i420vfw.dll
2007-02-21 11:47 . 2008-06-21 20:51 31232 --sh--r c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-06-21 20:51 27648 --sh--w c:\windows\system32\Smab0.dll
2008-02-04 19:26 . 2008-06-21 20:51 151040 --sh--w c:\windows\system32\VistaUltm.dll
2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r c:\windows\system32\x.264.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 10:58 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"WDICT32"="c:\translat\Wdict32.exe" [2006-10-20 2355200]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-27 29744]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-09-02 26624]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-11 7311360]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2004-11-22 180224]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2008-02-21 453936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-05-26 257088]
"RAM Idle Professional"="c:\program files\RAM Idle LE\RAM_XP.exe" [2006-01-17 135168]
"VC8Player"="c:\program files\Virtual CD v8\System\VC8Play.exe" [2006-11-06 296520]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-11 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-11-11 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-08-26 16851456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ase\Nabˇdka Start\Programy\Po spuçtŘnˇ\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Firefox Preloader.lnk - c:\program files\Internet\FirefoxPreloader\FirefoxPreloader.exe [2006-3-26 98304]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\HRY\\Age of Empire 2\\EMPIRES2.EXE"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4ss.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\Win32\\RpcDataSrv.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [7.1.2009 23:39 20744]
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [28.11.2005 17:42 16640]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [31.3.2008 14:33 114768]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18.7.2006 13:02 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18.7.2006 13:02 91672]
R1 vdrv8000;vdrv8000;c:\windows\system32\drivers\vdrv8000.sys [4.1.2009 23:00 100352]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.3.2008 14:33 20560]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [28.11.2005 17:50 75829]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [28.11.2005 17:51 33959]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [28.11.2005 17:51 10005]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [7.11.2005 16:55 69120]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [28.11.2005 17:54 9510]
S1 ntiomin;ntiomin; [x]
S2 DirMngr;DirMngr;c:\program files\System\GnuPG\dirmngr.exe [17.9.2007 16:58 219136]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [19.12.2005 23:13 64896]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [19.12.2005 23:18 64896]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [20.8.2006 0:00 16512]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [7.12.2008 12:44 30088]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26.12.2005 2:04 29744]
S3 HHCDHelp.sys;HHCDHelp.sys;c:\windows\system32\drivers\HHCDHelp.sys [4.1.2009 23:00 11520]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 14:58 26248]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24.11.2008 23:31 29263712]
.
Obsah adresáře 'Naplánované úlohy'

2009-05-06 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-01-04 11:23]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-CrystalXP - c:\program files\System\CrystalXP\CrystalXP.exe
HKCU-Run-WEBTRAN - (no file)
HKLM-Run-NBKeyScan - c:\program files\Vypalování\Nero 8\Nero 8 Ultra Edition 8.2.8.0


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Přelož do češtiny - c:\program files\Seznam\Listicka\Toolbar.dll/5034
IE: Blokovat všechny obrázky ze stejného serveru
IE: Hledat
IE: Hledej v &Seznamu - c:\program files\Seznam\Listicka\Toolbar.dll/5033
IE: Hledej v Seznam &Fulltextu - c:\program files\Seznam\Listicka\Toolbar.dll/5035
IE: Otevřít v nové instanci programu
IE: Otevřít všechny odkazy na této stránce...
IE: Přidat do seznamu blokovaných reklam
IE: Stáhnout pomocí NetXferu - c:\program files\Net\NetXfer\NXAddLink.html
IE: Stáhnout vše pomocí Net&Xferu - c:\program files\Net\NetXfer\NXAddList.html
IE: Zvýraznit
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxp://www.listicka.cz/toolbar.cab
FF - ProfilePath - c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Opera\program\plugins\nppdf32.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 23:20
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vdrv8000]
"ImagePath"="system32\DRIVERS\vdrv8000.sys"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2411705400-1126069726-1247597796-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
@SACL=
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3404)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\program files\CursorXP\CurXP0.dll
c:\windows\system32\dvmurl.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\vypalovani\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Virtual CD v8\System\VC8SecS.exe
c:\windows\system32\rundll32.exe
c:\program files\Virtual CD v8\System\vc8tray.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Mozilla Firefox\firefox.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2009-05-06 23:32 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-05-06 21:32

Před spuštěním: Volných bajtů: 17 642 782 720
Po spuštění: Volných bajtů: 31 332 712 448

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

362 --- E O F --- 2009-04-24 09:01

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\runouce.exe
c:\windows\system32\ezdigsgn.dat
c:\windows\popcinfo.dat
c:\windows\meta4.exe
c:\windows\system32\flvDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\Smab0.dll
c:\windows\system32\VistaUltm.dll
c:\program files\Symantec\LiveUpdate\NDETECT.EXE
c:\windows\Tasks\Symantec NetDetect.job

Folder::
c:\windows\system32\runouce.exe
c:\program files\AskBarDis
c:\program files\Symantec

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=- 
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
c:\program files\VirtualCD8006EG_web.exe
c:\program files\bsplayer212.941_video.exe
c:\program files\15039_18239.exe
Vlož sem pak odkazy výsledků.

[Death at Comp]

Tady je log z ComboFixu po aplikaci scriptu:
ComboFix 09-05-05.05 - ase 08.05.2009 20:29.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1310 [GMT 2:00]
Spuštěný z: c:\program files\System\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\ase\Plocha\CFScript.txt.txt
AV: avast! antivirus 4.8.1335 [VPS 090507-0] *On-access scanning disabled* (Updated)
FW: Sunbelt Kerio Personal Firewall *enabled*
* Vytvořen nový Bod Obnovení

FILE ::
c:\program files\Symantec\LiveUpdate\NDETECT.EXE
c:\windows\meta4.exe
c:\windows\popcinfo.dat
c:\windows\system32\ezdigsgn.dat
c:\windows\system32\flvDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\runouce.exe
c:\windows\system32\Smab0.dll
c:\windows\system32\VistaUltm.dll
c:\windows\Tasks\Symantec NetDetect.job
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\00C62B33
c:\program files\AskBarDis\bar\Cache\00C62E40.bin
c:\program files\AskBarDis\bar\Cache\00C63015.bin
c:\program files\AskBarDis\bar\Cache\00C63209.bin
c:\program files\AskBarDis\bar\Cache\00C63322.bin
c:\program files\AskBarDis\bar\Cache\00C6342C.bin
c:\program files\AskBarDis\bar\Cache\00C635F1.bin
c:\program files\AskBarDis\bar\Cache\00C6371A.bin
c:\program files\AskBarDis\bar\Cache\00C63824.bin
c:\program files\AskBarDis\bar\Cache\00C6392D.bin
c:\program files\AskBarDis\bar\Cache\00C63A46.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\bar\Settings\prevCfg2.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
c:\program files\Symantec
c:\program files\Symantec\LiveUpdate\1.Settings.Default.LiveUpdate
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\program files\Symantec\LiveUpdate\h323log.txt
c:\program files\Symantec\LiveUpdate\LSETUP.EXE
c:\program files\Symantec\LiveUpdate\LUALL.EXE
c:\program files\Symantec\LiveUpdate\LUALL.HLP
c:\program files\Symantec\LiveUpdate\LuComServer.EXE
c:\program files\Symantec\LiveUpdate\LuComServerPS.DLL
c:\program files\Symantec\LiveUpdate\LUINFO.INF
c:\program files\Symantec\LiveUpdate\LUInit.exe
c:\program files\Symantec\LiveUpdate\LUInit.ini
c:\program files\Symantec\LiveUpdate\LUINSDLL.DLL
c:\program files\Symantec\LiveUpdate\NDETECT.EXE
c:\program files\Symantec\LiveUpdate\NetDetectController.DLL
c:\program files\Symantec\LiveUpdate\ProductRegCom.DLL
c:\program files\Symantec\LiveUpdate\README.TXT
c:\program files\Symantec\LiveUpdate\S32LIVE1.DLL
c:\program files\Symantec\LiveUpdate\S32LUCP1.CPL
c:\program files\Symantec\LiveUpdate\S32LUIS1.DLL
c:\program files\Symantec\LiveUpdate\S32LUWI1.DLL
c:\program files\Symantec\LiveUpdate\Settings.Default.LiveUpdate
c:\windows\meta4.exe
c:\windows\popcinfo.dat
c:\windows\system32\ezdigsgn.dat
c:\windows\system32\flvDX.dll
c:\windows\system32\msfDX.dll
c:\windows\system32\runouce.exe
c:\windows\system32\Smab0.dll
c:\windows\system32\VistaUltm.dll
c:\windows\Tasks\Symantec NetDetect.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-08 do 2009-05-08 )))))))))))))))))))))))))))))))
.

2009-05-06 19:12 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-06 19:12 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-01 16:10 . 2009-05-01 16:10 308160 ----a-w c:\program files\avast_home_setup.exe
2009-04-29 21:30 . 2009-04-29 21:30 -------- d-----w c:\program files\Dips
2009-04-29 21:29 . 2009-04-29 21:29 4558 ----a-w c:\program files\dips.zip
2009-04-26 11:37 . 2009-04-26 15:24 -------- d-----w c:\program files\Blue soleil
2009-04-26 11:27 . 2009-04-26 11:32 90913287 ----a-w c:\program files\BlueSoleil_6.4.249.0.zip
2009-04-26 10:30 . 2009-04-26 10:30 -------- d-----w c:\program files\IVT Corporation
2009-04-20 10:22 . 2009-04-26 10:27 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-20 10:20 . 2009-04-20 10:21 -------- d-----w c:\windows\system32\drivers\UMDF
2009-04-20 10:20 . 2009-04-20 10:20 -------- d-----w c:\windows\system32\LogFiles
2009-04-19 20:32 . 2009-04-19 20:37 -------- d-----w c:\temp\Dokumenty 2
2009-04-16 09:35 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 09:35 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 09:35 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 09:35 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 09:35 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 09:35 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 09:35 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 09:35 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 09:35 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 09:35 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 08:20 . 2008-08-05 18:32 -------- d-----w c:\program files\Mozilla Thunderbird
2009-05-06 21:02 . 2008-02-05 19:14 -------- d-----w c:\program files\System
2009-04-27 05:39 . 2005-11-07 14:56 476182 ----a-w c:\windows\system32\perfh005.dat
2009-04-27 05:39 . 2005-11-07 14:56 96196 ----a-w c:\windows\system32\perfc005.dat
2009-04-26 11:35 . 2009-03-02 11:42 -------- d-----w c:\program files\BlueSoleil 6.4.249.0WithMobile
2009-04-19 17:29 . 2008-02-05 18:42 -------- d-----w c:\program files\Ostatní
2009-04-19 12:27 . 2009-03-04 21:44 -------- d-----w c:\program files\Opera
2009-04-19 12:18 . 2006-11-15 10:30 -------- d-----w c:\program files\LeechVideoConvert
2009-04-15 09:45 . 2006-01-08 22:10 -------- d-----w c:\program files\Java
2009-04-09 17:30 . 2008-02-05 18:18 -------- d-----w c:\program files\Hudba a Zvuky
2009-04-06 22:25 . 2006-08-29 14:02 -------- d-----w c:\program files\Common Files\Ahead
2009-04-06 19:44 . 2009-04-06 19:44 -------- d-----w c:\program files\Nero
2009-04-06 19:20 . 2009-04-06 19:14 944687 ----a-w c:\program files\General-CleanTool.zip
2009-04-06 18:44 . 2008-03-21 19:21 -------- d-----w c:\program files\Vypalování
2009-04-05 20:27 . 2008-03-21 19:21 -------- d-----w c:\program files\Video
2009-04-02 22:43 . 2009-04-02 20:50 -------- d-----w c:\program files\NewBlue
2009-04-02 22:20 . 2009-04-02 22:20 -------- d-----w c:\program files\Common Files\eSellerate
2009-04-02 20:58 . 2005-12-26 00:04 -------- d-----w c:\program files\Google
2009-03-31 09:13 . 2009-03-31 09:13 1490040 ----a-w c:\program files\snowman.zip
2009-03-27 18:15 . 2006-08-30 20:47 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-27 17:51 . 2008-02-05 22:42 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-27 17:50 . 2009-03-27 17:50 20113293 ----a-w c:\program files\klmcodec470.exe
2009-03-25 15:41 . 2009-03-25 15:41 -------- d-----w c:\program files\Common Files\soft602
2009-03-17 21:54 . 2008-08-15 19:57 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-09 12:27 . 2009-03-09 12:27 199 ----a-w c:\windows\Fonts\LICENSE.txt
2009-03-09 03:19 . 2009-01-09 14:24 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:23 . 2005-11-07 14:55 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-04 21:10 . 2009-03-04 21:10 7562568 ----a-w c:\program files\Opera_964_int_Setup.exe
2009-03-03 00:14 . 2005-11-07 14:56 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-21 11:01 . 2009-02-21 11:01 228 ----a-r c:\windows\Fonts\font info.txt
2009-02-20 17:13 . 2005-11-07 14:55 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 18:56 . 2009-03-27 18:12 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 16:04 . 2009-02-09 16:04 1337 ----a-w c:\windows\Fonts\listemageren.txt
2009-02-09 14:07 . 2005-11-07 14:56 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2005-11-07 14:55 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2005-11-07 14:55 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2005-11-07 14:55 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2005-11-07 14:55 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2005-11-07 14:55 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2005-11-07 14:55 684032 ----a-w c:\windows\system32\advapi32.dll
2008-12-28 15:18 . 2008-12-28 15:18 42308813 ----a-w c:\program files\VirtualCD8006EG_web.exe
2008-11-08 12:59 . 2008-11-08 12:59 1851544 ----a-w c:\program files\install_flash_player.exe
2008-09-25 13:39 . 2008-09-25 13:39 1109368 ----a-w c:\program files\General-CleanTool_2_2_0_37.exe
2008-08-24 22:26 . 2008-08-24 22:25 10245064 ----a-w c:\program files\DTPro4300302BasicTrial.exe
2008-01-12 00:34 . 2008-01-12 00:33 2989143 ----a-w c:\program files\dvdcutterSetup.exe
2008-01-05 21:28 . 2008-01-05 21:27 3552785 ----a-w c:\program files\dvd-audio-ripper.exe
2008-01-05 20:35 . 2008-01-05 20:35 1359301 ----a-w c:\program files\Camstudio-2.0-w32.zip
2008-01-05 20:22 . 2008-01-05 20:22 542652 ----a-w c:\program files\webshot.exe
2007-12-16 20:56 . 2007-12-16 20:57 912530 ----a-w c:\program files\ramidlLE.exe
2007-12-16 20:10 . 2007-12-16 20:11 1363963 ----a-w c:\program files\rrsetup.exe
2007-12-10 20:57 . 2007-12-10 20:57 6803408 ----a-w c:\program files\HDDlife_2.9.109.exe
2007-11-09 20:26 . 2007-11-09 20:25 10656216 ----a-w c:\program files\JoostSetup-Beta-1.0.exe
2007-07-23 19:47 . 2007-07-23 19:47 1102920 ----a-w c:\program files\tv.exe
2007-06-23 17:57 . 2007-02-16 15:03 1706566 ----a-w c:\program files\smsposilacinst.exe
2007-06-01 20:05 . 2007-06-01 20:05 5536535 ------w c:\program files\dvdfabplatinum3086.exe
2007-06-01 19:40 . 2007-06-01 19:40 3262452 ------w c:\program files\DVDFabPlatinum29.exe
2007-05-31 19:09 . 2007-05-31 19:08 553687 ----a-w c:\program files\regcleaner.exe
2007-02-04 17:30 . 2007-02-04 17:29 3836577 ----a-w c:\program files\DCPlusPlus-0.698.exe
2007-01-30 17:05 . 2007-01-30 16:56 21822168 ----a-w c:\program files\AdbeRdr80_en_US.exe
2006-12-26 16:51 . 2006-12-26 16:51 0 ----a-w c:\program files\bsplayer212.941_video.exe
2006-12-24 22:30 . 2006-12-24 22:30 1690752 ----a-w c:\program files\tcmd32.exe
2006-12-22 20:37 . 2006-12-22 20:38 614890 ----a-w c:\program files\utorrent16.exe
2006-11-19 13:45 . 2006-11-19 13:44 1484576 ----a-w c:\program files\ProcessExplorerNt.zip
2006-11-15 10:30 . 2006-11-15 10:27 7101440 ----a-w c:\program files\PocketDivXEncoder_0.3.60.exe
2006-11-15 10:26 . 2006-11-15 10:26 12577 ----a-w c:\program files\videodetect 0.91.xpi
2006-10-22 12:32 . 2006-10-22 12:32 774144 ----a-w c:\program files\RngInterstitial.dll
2006-09-20 17:27 . 2006-09-20 17:26 1986653 ----a-w c:\program files\videomach-3.4.1.exe
2006-08-30 20:54 . 2006-08-30 20:54 227776 ----a-w c:\program files\15039_18239.exe
2006-07-28 07:32 . 2006-07-28 07:32 7005 ----a-w c:\program files\Eula.txt
2006-07-12 11:59 . 2006-07-12 11:59 3278400 ----a-w c:\program files\procexp.exe
2006-04-27 15:40 . 2006-04-27 15:40 72418 ----a-w c:\program files\procexp.chm
2008-08-27 13:03 . 2007-08-13 13:08 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r c:\windows\system32\cygz.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r c:\windows\system32\i420vfw.dll
2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r c:\windows\system32\x.264.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-05-06_21.21.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-08 07:02 . 2009-05-08 07:02 16384 c:\windows\Temp\Perflib_Perfdata_6bc.dat
+ 2009-05-08 07:03 . 2009-05-08 07:03 16384 c:\windows\Temp\Perflib_Perfdata_354.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"WDICT32"="c:\translat\Wdict32.exe" [2006-10-20 2355200]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-27 29744]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-09-02 26624]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-11 7311360]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2004-11-22 180224]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2008-02-21 453936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-05-26 257088]
"RAM Idle Professional"="c:\program files\RAM Idle LE\RAM_XP.exe" [2006-01-17 135168]
"VC8Player"="c:\program files\Virtual CD v8\System\VC8Play.exe" [2006-11-06 296520]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-11 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-11-11 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-08-26 16851456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ase\Nabˇdka Start\Programy\Po spuçtŘnˇ\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Firefox Preloader.lnk - c:\program files\Internet\FirefoxPreloader\FirefoxPreloader.exe [2006-3-26 98304]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\HRY\\Age of Empire 2\\EMPIRES2.EXE"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4ss.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\Win32\\RpcDataSrv.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [7.1.2009 23:39 20744]
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [28.11.2005 17:42 16640]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [31.3.2008 14:33 114768]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18.7.2006 13:02 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18.7.2006 13:02 91672]
R1 vdrv8000;vdrv8000;c:\windows\system32\drivers\vdrv8000.sys [4.1.2009 23:00 100352]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.3.2008 14:33 20560]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [28.11.2005 17:50 75829]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [28.11.2005 17:51 33959]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [28.11.2005 17:51 10005]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [7.11.2005 16:55 69120]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [28.11.2005 17:54 9510]
S1 ntiomin;ntiomin; [x]
S2 DirMngr;DirMngr;c:\program files\System\GnuPG\dirmngr.exe [17.9.2007 16:58 219136]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [19.12.2005 23:13 64896]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [19.12.2005 23:18 64896]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [20.8.2006 0:00 16512]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [7.12.2008 12:44 30088]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26.12.2005 2:04 29744]
S3 HHCDHelp.sys;HHCDHelp.sys;c:\windows\system32\drivers\HHCDHelp.sys [4.1.2009 23:00 11520]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 14:58 26248]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24.11.2008 23:31 29263712]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Přelož do češtiny - c:\program files\Seznam\Listicka\Toolbar.dll/5034
IE: Blokovat všechny obrázky ze stejného serveru
IE: Hledat
IE: Hledej v &Seznamu - c:\program files\Seznam\Listicka\Toolbar.dll/5033
IE: Hledej v Seznam &Fulltextu - c:\program files\Seznam\Listicka\Toolbar.dll/5035
IE: Otevřít v nové instanci programu
IE: Otevřít všechny odkazy na této stránce...
IE: Přidat do seznamu blokovaných reklam
IE: Stáhnout pomocí NetXferu - c:\program files\Net\NetXfer\NXAddLink.html
IE: Stáhnout vše pomocí Net&Xferu - c:\program files\Net\NetXfer\NXAddList.html
IE: Zvýraznit
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxp://www.listicka.cz/toolbar.cab
FF - ProfilePath - c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Opera\program\plugins\nppdf32.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-08 20:35
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2411705400-1126069726-1247597796-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
@SACL=
.
Celkový čas: 2009-05-08 20:39
ComboFix-quarantined-files.txt 2009-05-08 18:38
ComboFix2.txt 2009-05-06 21:33

Před spuštěním: Volných bajtů: 31 270 604 800
Po spuštění: Volných bajtů: 31 249 866 752

361 --- E O F --- 2009-04-24 09:01

Tady je nový log z HJT:
Logfile of HijackThis v1.99.1
Scan saved at 20:44:37, on 8.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Virtual CD v8\System\VC8SecS.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\RAM Idle LE\RAM_XP.exe
C:\Program Files\Virtual CD v8\System\VC8Play.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Virtual CD v8\System\VC8Tray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Net\NetXfer\NXIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Burn4Free Toolbar Helper - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - (no file)
O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - (no file)
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: &Seznam Lištička - {B71B15CE-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Listicka\Toolbar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Net\NetXfer\NXToolBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe
O4 - HKLM\..\Run: [VC8Player] C:\Program Files\Virtual CD v8\System\VC8Play.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] =
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WDICT32] C:\TRANSLAT\Wdict32.exe /l
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
O8 - Extra context menu item: &Přelož do češtiny - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5034
O8 - Extra context menu item: Hledej v &Seznamu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5033
O8 - Extra context menu item: Hledej v Seznam &Fulltextu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5035
O8 - Extra context menu item: Stáhnout pomocí NetXferu - C:\Program Files\Net\NetXfer\NXAddLink.html
O8 - Extra context menu item: Stáhnout vše pomocí Net&Xferu - C:\Program Files\Net\NetXfer\NXAddList.html
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.idnes.cz/
O16 - DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} (ToolbarInetInstall Control) - http://www.listicka.cz/toolbar.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1420445173
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol ... _en_dl.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DirMngr - Unknown owner - C:\Program Files\System\GnuPG\dirmngr.exe" --service (file missing)
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: SQL Server (SONY_MEDIAMGR2) (MSSQL$SONY_MEDIAMGR2) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSONY_MEDIAMGR2 (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual CD v8 Management Service (VC8SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v8\System\VC8SecS.exe

Výsledek přes VirusTotal:
1.soubor:
Bigger than max permited size / Mayor del tamano máximo permitido
2.soubor-Načítání souboru trvalo zhruba 3 a půl hodiny potom jsem ho přerušil protože sem usoudil že není něco v pořádku"přišlo mi to dost dlouhá doba na to že mam rychlost int. 8Mbit/s a vytíženost serveru byla na prvnim stupni"
3.soubor:

Soubor 15039_18239.exe přijatý 2009.05.09 15:21:29 (CET)
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.05.09 -
AhnLab-V3 5.0.0.2 2009.05.09 -
AntiVir 7.9.0.166 2009.05.08 -
Antiy-AVL 2.0.3.1 2009.05.08 -
Authentium 5.1.2.4 2009.05.08 -
Avast 4.8.1335.0 2009.05.08 -
AVG 8.5.0.327 2009.05.09 -
BitDefender 7.2 2009.05.09 -
CAT-QuickHeal 10.00 2009.05.09 -
ClamAV 0.94.1 2009.05.09 -
Comodo 1157 2009.05.08 -
DrWeb 5.0.0.12182 2009.05.09 -
eSafe 7.0.17.0 2009.05.07 Suspicious File
eTrust-Vet 31.6.6497 2009.05.08 -
F-Prot 4.4.4.56 2009.05.08 -
F-Secure 8.0.14470.0 2009.05.08 -
Fortinet 3.117.0.0 2009.05.09 -
GData 19 2009.05.09 -
Ikarus T3.1.1.49.0 2009.05.09 -
K7AntiVirus 7.10.729 2009.05.08 -
Kaspersky 7.0.0.125 2009.05.09 -
McAfee 5609 2009.05.08 -
McAfee+Artemis 5609 2009.05.08 -
McAfee-GW-Edition 6.7.6 2009.05.09 -
Microsoft 1.4602 2009.05.09 -
NOD32 4063 2009.05.08 -
Norman 6.01.05 2009.05.08 -
nProtect 2009.1.8.0 2009.05.09 -
Panda 10.0.0.14 2009.05.09 -
PCTools 4.4.2.0 2009.05.07 -
Prevx 3.0 2009.05.09 -
Rising 21.28.52.00 2009.05.09 -
Sophos 4.41.0 2009.05.09 -
Sunbelt 3.2.1858.2 2009.05.09 -
Symantec 1.4.4.12 2009.05.09 -
TheHacker 6.3.4.1.323 2009.05.08 -
TrendMicro 8.950.0.1092 2009.05.08 -
VBA32 3.12.10.4 2009.05.08 -
ViRobot 2009.5.9.1727 2009.05.09 -
VirusBuster 4.6.5.0 2009.05.08 -
Rozšiřující informace
File size: 227776 bytes
MD5...: deeae745713077ada11a720bd1ed25cf
SHA1..: 6c72793e39d05527798028677e02752e154187c0
SHA256: 202f3294446f79675d6c14fbb754a2c21c7aaabcd0dd558b7d765c5fa90a7d60
SHA512: 7d639016583d87d2a1a9f1a49da5faf73d037875f4dd154ffb655aacc8dd6fdb<br>588e5c314c680050858612b9e950a485da321d678e5ea775bdf4a5d7d8c12d25
ssdeep: 6144:YvncXi6KFM0pp1F3Q8cDsyFy5k71+V42L8Ct/6A3ne:ynEidrfT3Q8cDjrY<br>7owSA3e<br>
PEiD..: UPX 2.90 [LZMA] -&gt; Markus Oberhumer, Laszlo Molnar &amp; John Reiser
TrID..: File type identification<br>UPX compressed Win32 Executable (39.5%)<br>Win32 EXE Yoda's Crypter (34.3%)<br>Win32 Executable Generic (11.0%)<br>Win32 Dynamic Link Library (generic) (9.8%)<br>Generic Win/DOS Executable (2.5%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x395a0<br>timedatestamp.....: 0x44a6b982 (Sat Jul 01 18:05:54 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>UPX0 0x1000 0x34000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>UPX1 0x35000 0x5000 0x4800 7.86 e039be8f8d03a5f4313479e2044fad35<br>.rsrc 0x3a000 0x7000 0x6e00 5.77 c428f8ee75d0e7c69c3339c6ee958afc<br><br>( 8 imports ) <br>&gt; KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess<br>&gt; ADVAPI32.dll: RegEnumKeyA<br>&gt; COMCTL32.dll: -<br>&gt; GDI32.dll: SetBkMode<br>&gt; ole32.dll: OleInitialize<br>&gt; SHELL32.dll: SHGetMalloc<br>&gt; USER32.dll: GetDC<br>&gt; VERSION.dll: VerQueryValueA<br><br>( 0 exports ) <br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-
packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch.UPX, UPX
packers (F-Prot): UPX
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=deeae745713077ada11a720bd1ed25cf' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=deeae745713077ada11a720bd1ed25cf&lt;/a&gt;

Antivirus;Verze;Poslední aktualizace;Výsledek
a-squared;4.0.0.101;2009.05.09;-
AhnLab-V3;5.0.0.2;2009.05.09;-
AntiVir;7.9.0.166;2009.05.08;-
Antiy-AVL;2.0.3.1;2009.05.08;-
Authentium;5.1.2.4;2009.05.08;-
Avast;4.8.1335.0;2009.05.08;-
AVG;8.5.0.327;2009.05.09;-
BitDefender;7.2;2009.05.09;-
CAT-QuickHeal;10.00;2009.05.09;-
ClamAV;0.94.1;2009.05.09;-
Comodo;1157;2009.05.08;-
DrWeb;5.0.0.12182;2009.05.09;-
eSafe;7.0.17.0;2009.05.07;Suspicious File
eTrust-Vet;31.6.6497;2009.05.08;-
F-Prot;4.4.4.56;2009.05.08;-
F-Secure;8.0.14470.0;2009.05.08;-
Fortinet;3.117.0.0;2009.05.09;-
GData;19;2009.05.09;-
Ikarus;T3.1.1.49.0;2009.05.09;-
K7AntiVirus;7.10.729;2009.05.08;-
Kaspersky;7.0.0.125;2009.05.09;-
McAfee;5609;2009.05.08;-
McAfee+Artemis;5609;2009.05.08;-
McAfee-GW-Edition;6.7.6;2009.05.09;-
Microsoft;1.4602;2009.05.09;-
NOD32;4063;2009.05.08;-
Norman;6.01.05;2009.05.08;-
nProtect;2009.1.8.0;2009.05.09;-
Panda;10.0.0.14;2009.05.09;-
PCTools;4.4.2.0;2009.05.07;-
Prevx;3.0;2009.05.09;-
Rising;21.28.52.00;2009.05.09;-
Sophos;4.41.0;2009.05.09;-
Sunbelt;3.2.1858.2;2009.05.09;-
Symantec;1.4.4.12;2009.05.09;-
TheHacker;6.3.4.1.323;2009.05.08;-
TrendMicro;8.950.0.1092;2009.05.08;-
VBA32;3.12.10.4;2009.05.08;-
ViRobot;2009.5.9.1727;2009.05.09;-
VirusBuster;4.6.5.0;2009.05.08;-

Rozšiřující informace
File size: 227776 bytes
MD5...: deeae745713077ada11a720bd1ed25cf
SHA1..: 6c72793e39d05527798028677e02752e154187c0
SHA256: 202f3294446f79675d6c14fbb754a2c21c7aaabcd0dd558b7d765c5fa90a7d60
SHA512: 7d639016583d87d2a1a9f1a49da5faf73d037875f4dd154ffb655aacc8dd6fdb<br>588e5c314c680050858612b9e950a485da321d678e5ea775bdf4a5d7d8c12d25
ssdeep: 6144:YvncXi6KFM0pp1F3Q8cDsyFy5k71+V42L8Ct/6A3ne:ynEidrfT3Q8cDjrY<br>7owSA3e<br>
PEiD..: UPX 2.90 [LZMA] -&gt; Markus Oberhumer, Laszlo Molnar &amp; John Reiser
TrID..: File type identification<br>UPX compressed Win32 Executable (39.5%)<br>Win32 EXE Yoda's Crypter (34.3%)<br>Win32 Executable Generic (11.0%)<br>Win32 Dynamic Link Library (generic) (9.8%)<br>Generic Win/DOS Executable (2.5%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x395a0<br>timedatestamp.....: 0x44a6b982 (Sat Jul 01 18:05:54 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>UPX0 0x1000 0x34000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>UPX1 0x35000 0x5000 0x4800 7.86 e039be8f8d03a5f4313479e2044fad35<br>.rsrc 0x3a000 0x7000 0x6e00 5.77 c428f8ee75d0e7c69c3339c6ee958afc<br><br>( 8 imports ) <br>&gt; KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess<br>&gt; ADVAPI32.dll: RegEnumKeyA<br>&gt; COMCTL32.dll: -<br>&gt; GDI32.dll: SetBkMode<br>&gt; ole32.dll: OleInitialize<br>&gt; SHELL32.dll: SHGetMalloc<br>&gt; USER32.dll: GetDC<br>&gt; VERSION.dll: VerQueryValueA<br><br>( 0 exports ) <br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-
packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch.UPX, UPX
packers (F-Prot): UPX
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=deeae745713077ada11a720bd1ed25cf' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=deeae745713077ada11a720bd1ed25cf&lt;/a&gt;

[jaro3]

JEŠTĚ JEDEN SCRIPT v CF:

Kód: Vybrat vše

KillAll::
File::
c:\program files\VirtualCD8006EG_web.exe
c:\program files\bsplayer212.941_video.exe
c:\program files\15039_18239.exe


Postup stejný jako výše, pak log z CF+HJT -novější verzi:
http://www.trendsecure.com/portal/en-US ... s/download
Zítra se kouknu.

[Death at Comp]

Tady je log z CF:
ComboFix 09-05-05.05 - ase 09.05.2009 22:54.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1244 [GMT 2:00]
Spuštěný z: c:\program files\System\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\ase\Plocha\CFScript.txt.txt
AV: avast! antivirus 4.8.1335 [VPS 090508-0] *On-access scanning disabled* (Updated)
FW: Sunbelt Kerio Personal Firewall *enabled*

FILE ::
c:\program files\15039_18239.exe
c:\program files\bsplayer212.941_video.exe
c:\program files\VirtualCD8006EG_web.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\15039_18239.exe
c:\program files\bsplayer212.941_video.exe
c:\program files\VirtualCD8006EG_web.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-09 do 2009-05-09 )))))))))))))))))))))))))))))))
.

2009-05-06 19:12 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-06 19:12 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-01 16:10 . 2009-05-01 16:10 308160 ----a-w c:\program files\avast_home_setup.exe
2009-04-29 21:30 . 2009-04-29 21:30 -------- d-----w c:\program files\Dips
2009-04-29 21:29 . 2009-04-29 21:29 4558 ----a-w c:\program files\dips.zip
2009-04-26 11:37 . 2009-04-26 15:24 -------- d-----w c:\program files\Blue soleil
2009-04-26 11:27 . 2009-04-26 11:32 90913287 ----a-w c:\program files\BlueSoleil_6.4.249.0.zip
2009-04-26 10:30 . 2009-04-26 10:30 -------- d-----w c:\program files\IVT Corporation
2009-04-20 10:22 . 2009-04-26 10:27 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-20 10:20 . 2009-04-20 10:21 -------- d-----w c:\windows\system32\drivers\UMDF
2009-04-20 10:20 . 2009-04-20 10:20 -------- d-----w c:\windows\system32\LogFiles
2009-04-19 20:32 . 2009-04-19 20:37 -------- d-----w c:\temp\Dokumenty 2
2009-04-16 09:35 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 09:35 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 09:35 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 09:35 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 09:35 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 09:35 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 09:35 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 09:35 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 09:35 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 09:35 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-09 20:45 . 2008-02-05 19:14 -------- d-----w c:\program files\System
2009-05-09 10:51 . 2008-08-05 18:32 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-27 05:39 . 2005-11-07 14:56 476182 ----a-w c:\windows\system32\perfh005.dat
2009-04-27 05:39 . 2005-11-07 14:56 96196 ----a-w c:\windows\system32\perfc005.dat
2009-04-26 11:35 . 2009-03-02 11:42 -------- d-----w c:\program files\BlueSoleil 6.4.249.0WithMobile
2009-04-19 17:29 . 2008-02-05 18:42 -------- d-----w c:\program files\Ostatní
2009-04-19 12:27 . 2009-03-04 21:44 -------- d-----w c:\program files\Opera
2009-04-19 12:18 . 2006-11-15 10:30 -------- d-----w c:\program files\LeechVideoConvert
2009-04-15 09:45 . 2006-01-08 22:10 -------- d-----w c:\program files\Java
2009-04-09 17:30 . 2008-02-05 18:18 -------- d-----w c:\program files\Hudba a Zvuky
2009-04-06 22:25 . 2006-08-29 14:02 -------- d-----w c:\program files\Common Files\Ahead
2009-04-06 19:44 . 2009-04-06 19:44 -------- d-----w c:\program files\Nero
2009-04-06 19:20 . 2009-04-06 19:14 944687 ----a-w c:\program files\General-CleanTool.zip
2009-04-06 18:44 . 2008-03-21 19:21 -------- d-----w c:\program files\Vypalování
2009-04-05 20:27 . 2008-03-21 19:21 -------- d-----w c:\program files\Video
2009-04-02 22:43 . 2009-04-02 20:50 -------- d-----w c:\program files\NewBlue
2009-04-02 22:20 . 2009-04-02 22:20 -------- d-----w c:\program files\Common Files\eSellerate
2009-04-02 20:58 . 2005-12-26 00:04 -------- d-----w c:\program files\Google
2009-03-31 09:13 . 2009-03-31 09:13 1490040 ----a-w c:\program files\snowman.zip
2009-03-27 18:15 . 2006-08-30 20:47 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-27 17:51 . 2008-02-05 22:42 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-27 17:50 . 2009-03-27 17:50 20113293 ----a-w c:\program files\klmcodec470.exe
2009-03-25 15:41 . 2009-03-25 15:41 -------- d-----w c:\program files\Common Files\soft602
2009-03-17 21:54 . 2008-08-15 19:57 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-09 12:27 . 2009-03-09 12:27 199 ----a-w c:\windows\Fonts\LICENSE.txt
2009-03-09 03:19 . 2009-01-09 14:24 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:23 . 2005-11-07 14:55 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-04 21:10 . 2009-03-04 21:10 7562568 ----a-w c:\program files\Opera_964_int_Setup.exe
2009-03-03 00:14 . 2005-11-07 14:56 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-21 11:01 . 2009-02-21 11:01 228 ----a-r c:\windows\Fonts\font info.txt
2009-02-20 17:13 . 2005-11-07 14:55 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 18:56 . 2009-03-27 18:12 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 16:04 . 2009-02-09 16:04 1337 ----a-w c:\windows\Fonts\listemageren.txt
2009-02-09 14:07 . 2005-11-07 14:56 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2005-11-07 14:55 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2005-11-07 14:55 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2005-11-07 14:55 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2005-11-07 14:55 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2005-11-07 14:55 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2005-11-07 14:55 684032 ----a-w c:\windows\system32\advapi32.dll
2008-11-08 12:59 . 2008-11-08 12:59 1851544 ----a-w c:\program files\install_flash_player.exe
2008-09-25 13:39 . 2008-09-25 13:39 1109368 ----a-w c:\program files\General-CleanTool_2_2_0_37.exe
2008-08-24 22:26 . 2008-08-24 22:25 10245064 ----a-w c:\program files\DTPro4300302BasicTrial.exe
2008-01-12 00:34 . 2008-01-12 00:33 2989143 ----a-w c:\program files\dvdcutterSetup.exe
2008-01-05 21:28 . 2008-01-05 21:27 3552785 ----a-w c:\program files\dvd-audio-ripper.exe
2008-01-05 20:35 . 2008-01-05 20:35 1359301 ----a-w c:\program files\Camstudio-2.0-w32.zip
2008-01-05 20:22 . 2008-01-05 20:22 542652 ----a-w c:\program files\webshot.exe
2007-12-16 20:56 . 2007-12-16 20:57 912530 ----a-w c:\program files\ramidlLE.exe
2007-12-16 20:10 . 2007-12-16 20:11 1363963 ----a-w c:\program files\rrsetup.exe
2007-12-10 20:57 . 2007-12-10 20:57 6803408 ----a-w c:\program files\HDDlife_2.9.109.exe
2007-11-09 20:26 . 2007-11-09 20:25 10656216 ----a-w c:\program files\JoostSetup-Beta-1.0.exe
2007-07-23 19:47 . 2007-07-23 19:47 1102920 ----a-w c:\program files\tv.exe
2007-06-23 17:57 . 2007-02-16 15:03 1706566 ----a-w c:\program files\smsposilacinst.exe
2007-06-01 20:05 . 2007-06-01 20:05 5536535 ------w c:\program files\dvdfabplatinum3086.exe
2007-06-01 19:40 . 2007-06-01 19:40 3262452 ------w c:\program files\DVDFabPlatinum29.exe
2007-05-31 19:09 . 2007-05-31 19:08 553687 ----a-w c:\program files\regcleaner.exe
2007-02-04 17:30 . 2007-02-04 17:29 3836577 ----a-w c:\program files\DCPlusPlus-0.698.exe
2007-01-30 17:05 . 2007-01-30 16:56 21822168 ----a-w c:\program files\AdbeRdr80_en_US.exe
2006-12-24 22:30 . 2006-12-24 22:30 1690752 ----a-w c:\program files\tcmd32.exe
2006-12-22 20:37 . 2006-12-22 20:38 614890 ----a-w c:\program files\utorrent16.exe
2006-11-19 13:45 . 2006-11-19 13:44 1484576 ----a-w c:\program files\ProcessExplorerNt.zip
2006-11-15 10:30 . 2006-11-15 10:27 7101440 ----a-w c:\program files\PocketDivXEncoder_0.3.60.exe
2006-11-15 10:26 . 2006-11-15 10:26 12577 ----a-w c:\program files\videodetect 0.91.xpi
2006-10-22 12:32 . 2006-10-22 12:32 774144 ----a-w c:\program files\RngInterstitial.dll
2006-09-20 17:27 . 2006-09-20 17:26 1986653 ----a-w c:\program files\videomach-3.4.1.exe
2006-07-28 07:32 . 2006-07-28 07:32 7005 ----a-w c:\program files\Eula.txt
2006-07-12 11:59 . 2006-07-12 11:59 3278400 ----a-w c:\program files\procexp.exe
2006-04-27 15:40 . 2006-04-27 15:40 72418 ----a-w c:\program files\procexp.chm
2008-08-27 13:03 . 2007-08-13 13:08 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r c:\windows\system32\cygz.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r c:\windows\system32\i420vfw.dll
2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r c:\windows\system32\x.264.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-05-06_21.21.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-09 06:55 . 2009-05-09 06:55 16384 c:\windows\Temp\Perflib_Perfdata_6b0.dat
+ 2009-05-09 21:00 . 2009-05-09 21:00 16384 c:\windows\Temp\Perflib_Perfdata_65c.dat
- 2009-04-26 10:09 . 2009-04-26 10:09 16384 c:\windows\Temp\Perflib_Perfdata_65c.dat
+ 2009-05-09 21:00 . 2009-05-09 21:00 16384 c:\windows\Temp\Perflib_Perfdata_318.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"WDICT32"="c:\translat\Wdict32.exe" [2006-10-20 2355200]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-27 29744]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-09-02 26624]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-11 7311360]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2004-11-22 180224]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2008-02-21 453936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-05-26 257088]
"RAM Idle Professional"="c:\program files\RAM Idle LE\RAM_XP.exe" [2006-01-17 135168]
"VC8Player"="c:\program files\Virtual CD v8\System\VC8Play.exe" [2006-11-06 296520]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-11 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-11-11 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-08-26 16851456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\ase\Nabˇdka Start\Programy\Po spuçtŘnˇ\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Firefox Preloader.lnk - c:\program files\Internet\FirefoxPreloader\FirefoxPreloader.exe [2006-3-26 98304]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\HRY\\Age of Empire 2\\EMPIRES2.EXE"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4ss.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\Win32\\RpcDataSrv.exe"=
"c:\\Program Files\\Sandra Lite XI.SP2\\SiSoftware Sandra Lite XI.SP2\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [7.1.2009 23:39 20744]
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [28.11.2005 17:42 16640]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [31.3.2008 14:33 114768]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18.7.2006 13:02 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18.7.2006 13:02 91672]
R1 vdrv8000;vdrv8000;c:\windows\system32\drivers\vdrv8000.sys [4.1.2009 23:00 100352]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.3.2008 14:33 20560]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [28.11.2005 17:50 75829]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [28.11.2005 17:51 33959]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [28.11.2005 17:51 10005]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [7.11.2005 16:55 69120]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [28.11.2005 17:54 9510]
S1 ntiomin;ntiomin; [x]
S2 DirMngr;DirMngr;c:\program files\System\GnuPG\dirmngr.exe [17.9.2007 16:58 219136]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [19.12.2005 23:13 64896]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [19.12.2005 23:18 64896]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [20.8.2006 0:00 16512]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [7.12.2008 12:44 30088]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26.12.2005 2:04 29744]
S3 HHCDHelp.sys;HHCDHelp.sys;c:\windows\system32\drivers\HHCDHelp.sys [4.1.2009 23:00 11520]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 14:58 26248]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24.11.2008 23:31 29263712]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Přelož do češtiny - c:\program files\Seznam\Listicka\Toolbar.dll/5034
IE: Blokovat všechny obrázky ze stejného serveru
IE: Hledat
IE: Hledej v &Seznamu - c:\program files\Seznam\Listicka\Toolbar.dll/5033
IE: Hledej v Seznam &Fulltextu - c:\program files\Seznam\Listicka\Toolbar.dll/5035
IE: Otevřít v nové instanci programu
IE: Otevřít všechny odkazy na této stránce...
IE: Přidat do seznamu blokovaných reklam
IE: Stáhnout pomocí NetXferu - c:\program files\Net\NetXfer\NXAddLink.html
IE: Stáhnout vše pomocí Net&Xferu - c:\program files\Net\NetXfer\NXAddList.html
IE: Zvýraznit
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxp://www.listicka.cz/toolbar.cab
FF - ProfilePath - c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\documents and settings\ase\Data aplikací\Mozilla\Firefox\Profiles\s4do1w21.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Opera\program\plugins\nppdf32.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-09 23:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vdrv8000]
"ImagePath"="system32\DRIVERS\vdrv8000.sys"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2411705400-1126069726-1247597796-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
@SACL=
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1232)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\program files\CursorXP\CurXP0.dll
c:\windows\system32\dvmurl.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\vypalovani\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Virtual CD v8\System\VC8SecS.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Virtual CD v8\System\vc8tray.exe
c:\program files\Mozilla Firefox\firefox.exe
c:\windows\system32\wscntfy.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2009-05-09 23:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-05-09 21:18
ComboFix2.txt 2009-05-08 18:39
ComboFix3.txt 2009-05-06 21:33

Před spuštěním: Volných bajtů: 31 262 781 440
Po spuštění: Volných bajtů: 31 211 900 928

340 --- E O F --- 2009-04-24 09:01

A tady je log z HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:44, on 10.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Virtual CD v8\System\VC8SecS.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\RAM Idle LE\RAM_XP.exe
C:\Program Files\Virtual CD v8\System\VC8Play.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\TRANSLAT\Wdict32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Virtual CD v8\System\VC8Tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\System\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Net\NetXfer\NXIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Burn4Free Toolbar Helper - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - (no file)
O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - (no file)
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: &Seznam Lištička - {B71B15CE-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Listicka\Toolbar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Net\NetXfer\NXToolBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe
O4 - HKLM\..\Run: [VC8Player] C:\Program Files\Virtual CD v8\System\VC8Play.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] =
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WDICT32] C:\TRANSLAT\Wdict32.exe /l
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files\Internet\FirefoxPreloader\FirefoxPreloader.exe
O8 - Extra context menu item: &Přelož do češtiny - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5034
O8 - Extra context menu item: Hledej v &Seznamu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5033
O8 - Extra context menu item: Hledej v Seznam &Fulltextu - res://C:\Program Files\Seznam\Listicka\Toolbar.dll/5035
O8 - Extra context menu item: Stáhnout pomocí NetXferu - C:\Program Files\Net\NetXfer\NXAddLink.html
O8 - Extra context menu item: Stáhnout vše pomocí Net&Xferu - C:\Program Files\Net\NetXfer\NXAddList.html
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.idnes.cz/
O16 - DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} (ToolbarInetInstall Control) - http://www.listicka.cz/toolbar.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1420445173
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol ... _en_dl.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DirMngr - Unknown owner - C:\Program Files\System\GnuPG\dirmngr.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Vypalování\Nero 9\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\vypalovani\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\Sandra Lite XI.SP2\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual CD v8 Management Service (VC8SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v8\System\VC8SecS.exe

--
End of file - 12682 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O2 - BHO: Burn4Free Toolbar Helper - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - (no file)
O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GEST] =
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
Vše.

[Death at Comp]

Takže jsem udělal vše co jsi napsal.T-Cleaner navymazal ani jeden z těch programů co měl a ATF Cleaner nevymazal hystorii z Firefoxu a z Opery ano.Jinak problém pořád stejný...

[jaro3]

Stáhni si Dial-a-fix
Klikni na kladívko-další možnosti:
SFC scan - Spustí nástroj pro kontrolu systémových souborů (případná potřeba instalačního media Windows).
Klikni na službu a potom na GO.