Prosím o kontrolu logu. Vyřešeno

[Pawkin]

tady je ten log z kombo fixu


ComboFix 09-05-30.03 - Tomáš Pawera 30.05.2009 22:06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.511.314 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomáš Pawera\Plocha\ComboFix.exe
AV: 0.-1.2089877597 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Install.txt

Nakažená kopie byla nalezena a vyléčena.
Obnovena kopie z -
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSNCACHE


((((((((((((((((((((((((( Soubory vytvořené od 2009-04-28 do 2009-05-30 )))))))))))))))))))))))))))))))
.

2009-05-30 19:46 . 2009-05-30 19:47 -------- d-----w c:\program files\CCleaner
2009-05-30 19:05 . 2009-05-30 19:05 -------- d-----w c:\program files\FileZilla FTP Client
2009-05-29 17:52 . 2009-05-29 18:01 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-05-29 17:51 . 2009-05-29 18:02 -------- d-----w c:\program files\Autodesk
2009-05-29 17:51 . 2005-05-26 13:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll
2009-05-29 17:37 . 2009-05-29 17:37 604416 ----a-w c:\windows\system32\TUProgSt.exe
2009-05-29 17:37 . 2009-04-27 12:21 28928 ----a-w c:\windows\system32\uxtuneup.dll
2009-05-29 17:36 . 2009-05-29 17:36 361216 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-05-29 17:21 . 2009-05-29 17:37 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-05-29 16:00 . 2009-05-29 16:01 -------- d-----w C:\rsit
2009-05-29 14:41 . 2009-05-29 14:41 -------- d-----w C:\_OTMoveIt
2009-05-29 13:47 . 2009-05-29 13:47 -------- d-----w c:\windows\system32\bfubackups
2009-05-29 10:23 . 2009-05-29 10:23 0 ----a-w c:\windows\nsreg.dat
2009-05-28 17:00 . 2009-05-26 11:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 17:00 . 2009-05-28 17:01 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-28 17:00 . 2009-05-26 11:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w C:\MyWorks
2009-05-28 15:34 . 2009-05-29 15:07 -------- d-----w c:\program files\ICQToolbar
2009-05-28 15:34 . 2009-05-29 10:43 -------- d-----w c:\program files\BitLord2
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\windows\Sun
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\program files\TorrentMan
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\program files\directx
2009-05-28 11:09 . 2009-05-28 11:09 -------- d-----w c:\program files\Trend Micro
2009-05-27 18:45 . 2009-05-27 18:46 -------- d-----w c:\windows\system32\NtmsData
2009-05-27 14:29 . 2009-05-27 14:29 -------- d-----w c:\documents and settings\Administrator\IETldCache
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-----w c:\documents and settings\Administrator\Data aplikací
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-s---w c:\documents and settings\Administrator
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-----w c:\documents and settings\Administrator\Šablony
2009-05-27 13:46 . 2009-05-27 13:46 -------- d-----w c:\program files\Common Files\HP
2009-05-25 15:26 . 2009-05-25 15:26 3968 ----a-w c:\windows\system32\drivers\avgclean.sys
2009-05-25 15:26 . 2009-05-25 15:26 4224 ----a-w c:\windows\system32\drivers\avg7rsw.sys
2009-05-25 15:26 . 2009-05-25 15:26 28416 ----a-w c:\windows\system32\drivers\avg7rsxp.sys
2009-05-25 15:26 . 2009-05-25 15:26 816672 ----a-w c:\windows\system32\drivers\avg7core.sys
2009-05-24 16:12 . 1998-09-02 08:28 38160 ----a-w c:\windows\system32\LMRTREND.dll
2009-05-24 16:12 . 1998-08-27 04:51 182032 ----a-w c:\windows\system32\dxtmsft3.dll
2009-05-24 16:12 . 1998-09-02 08:28 63488 ----a-w c:\windows\system32\unam4ie.exe
2009-05-24 16:12 . 1998-09-02 08:02 194320 ----a-w c:\windows\system32\qcut.dll
2009-05-24 16:12 . 1998-08-17 09:21 10240 ----a-w c:\windows\system32\vidx16.dll
2009-05-24 16:12 . 1998-08-17 09:21 11776 ----a-w c:\windows\system32\mciqtz.drv
2009-05-24 16:12 . 2009-05-24 16:12 4608 ----a-w c:\windows\system32\w95inf32.dll
2009-05-24 16:12 . 2009-05-24 16:12 2272 ----a-w c:\windows\system32\w95inf16.dll
2009-05-24 16:12 . 1998-10-29 14:45 306688 ----a-w c:\windows\IsUninst.exe
2009-05-24 16:10 . 2009-05-24 16:10 -------- d-sh--w c:\windows\system32\config\systemprofile\PrivacIE
2009-05-24 16:07 . 2008-04-13 19:20 182656 -c--a-w c:\windows\system32\dllcache\ndis.sys
2009-05-24 15:59 . 2009-05-24 15:59 98304 ----a-w c:\windows\system32\CmdLineExt.dll
2009-05-24 11:42 . 2009-05-24 11:42 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\l2schemas
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\system32\cs
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\system32\bits
2009-05-24 11:21 . 2009-05-24 11:27 -------- d-----w c:\windows\ServicePackFiles
2009-05-24 11:11 . 2009-05-24 11:11 -------- d-----w c:\windows\EHome
2009-05-24 11:06 . 2009-05-24 11:06 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-24 10:59 . 2009-05-24 10:59 -------- d-----w c:\windows\ie8updates
2009-05-24 10:58 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-24 10:56 . 2009-05-24 10:57 -------- dc-h--w c:\windows\ie8
2009-05-22 11:01 . 2004-08-17 13:43 326912 ------w c:\windows\system32\drivers\ati2mtaa.sys
2009-05-21 16:15 . 2004-08-25 10:52 516096 ------w c:\windows\system32\ati2sgag.exe
2009-05-21 16:15 . 2004-08-25 06:40 294912 ----a-r c:\windows\system32\atiiiexx.dll
2009-05-21 16:15 . 2004-08-25 06:22 151552 ----a-r c:\windows\system32\ATIDEMGR.dll
2009-05-21 16:14 . 2009-05-21 16:16 -------- d-----w c:\program files\ATI Technologies
2009-05-20 17:25 . 2009-05-20 17:25 -------- d-----w c:\program files\Conduit
2009-05-19 18:52 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-19 18:47 . 2008-06-14 17:35 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-19 18:47 . 2008-06-14 17:35 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-19 18:38 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-19 18:37 . 2009-02-09 11:26 2191232 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-19 18:37 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-19 18:37 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-05-19 18:37 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-19 18:37 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-19 18:37 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-19 18:37 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-19 18:37 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-19 18:37 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-19 18:36 . 2009-02-09 11:26 2147328 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-19 18:36 . 2009-02-09 11:26 2025984 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-19 16:52 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-19 16:49 . 2009-05-27 13:26 -------- d-----w c:\program files\ICQ6Toolbar
2009-05-19 16:46 . 2009-05-29 18:19 -------- d-----w c:\program files\ICQ6
2009-05-19 16:43 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-19 16:36 . 2009-05-29 14:42 -------- d-----w c:\program files\GameSpy Arcade
2009-05-19 16:33 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-19 16:26 . 2008-04-11 19:06 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-19 16:17 . 2008-10-15 16:38 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-19 15:33 . 2009-05-29 16:51 -------- d-----w C:\Thalie

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 20:01 . 2006-03-02 12:00 182656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-05-29 17:00 . 2007-03-07 15:26 -------- d-----w c:\program files\lg_fwupdate
2009-05-29 11:13 . 2007-02-23 21:24 -------- d-----w c:\program files\Servant Salamander 2.0
2009-05-29 11:13 . 2007-02-23 21:27 -------- d-----w c:\program files\PDFCreator
2009-05-29 10:43 . 2007-02-23 21:24 -------- d-----w c:\program files\Codec Pack - All In 1
2009-05-29 10:21 . 2007-02-23 21:23 -------- d-----w c:\program files\Winamp
2009-05-29 10:17 . 2007-09-14 14:15 -------- d-----w c:\program files\ESET
2009-05-28 16:23 . 2007-03-07 15:17 -------- d-----w c:\program files\CyberLink DVD Solution
2009-05-28 16:23 . 2007-02-23 19:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-28 15:36 . 2007-02-23 21:32 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-24 11:44 . 2006-03-02 12:00 73236 ----a-w c:\windows\system32\perfc005.dat
2009-05-24 11:44 . 2006-03-02 12:00 398472 ----a-w c:\windows\system32\perfh005.dat
2009-05-24 11:30 . 2007-02-23 19:28 76487 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-24 11:30 . 2007-02-23 19:28 2684 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-05-19 16:50 . 2007-02-23 21:26 -------- d-----w c:\program files\ICQLite
2009-03-08 02:34 . 2006-03-02 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2006-03-02 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2006-03-02 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2006-03-02 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2006-03-02 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2006-03-02 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2006-03-02 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2006-03-02 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2006-03-02 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2006-03-02 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:23 . 2006-03-02 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2004-10-01 14:00 . 2007-03-07 15:17 40960 ------w c:\program files\Uninstall_CDS.exe
.

------- Sigcheck -------

[-] 2008-04-14 03:22 1034240 1BC8976AA32F8B85CD972586A2327447 c:\windows\EXPLORER.EXE
[-] 2007-06-13 13:11 1033728 9B32416BD5988C97B6397CE0B02CAF97 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 13:23 1033728 ED7B460B142A32097B8A8F6ECC941815 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2006-03-02 12:00 1032704 53114D57AB73A406AC7F602227781A99 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 03:22 1034240 27AFD587C462E280EE046B8CCA3C2CD1 c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2006-03-02 12:00 24576 836F7960362FF95C5D49E40B891F2CFC c:\windows\$NtServicePackUninstall$\userinit.exe
[7] 2008-04-14 03:22 26112 7DC1830F22E7D275B438127B68030239 c:\windows\ServicePackFiles\i386\userinit.exe
[7] 2008-04-14 03:22 26112 7DC1830F22E7D275B438127B68030239 c:\windows\SoftwareDistribution\Download\44c8256673ca0542cb198384f8131b68\userinit.exe
[-] 2008-04-14 03:22 26112 7C38A638CD8632EF077783D6EE51065C c:\windows\system32\userinit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-09-16 69632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\BitLord2\\BitLord.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 14:24 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [19.5.2009 18:49 222456]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [29.5.2009 19:37 604416]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-05-30 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:37]

2009-05-30 c:\windows\Tasks\User_Feed_Synchronization-{DB97E567-291E-4B34-8D35-AE6DDBCE7786}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKU-Default-Run-CTFMON.EXE - c:\windows\system32\CTFMON.EXE
HKU-Default-Run-reader_s - c:\documents and settings\Tomáš Pawera\reader_s.exe
HKU-Default-Run-AVG7_Run - c:\progra~1\Grisoft\AVGFRE~1\avgw.exe
HKU-Default-Run-svc - c:\program files\ThunMail\testabd.exe
SafeBoot-procexp90.Sys


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www
FF - ProfilePath - c:\documents and settings\Tomáš Pawera\Data aplikací\Mozilla\Firefox\Profiles\28t5x1f4.default\
FF - component: c:\documents and settings\Tomáš Pawera\Data aplikací\Mozilla\Firefox\Profiles\28t5x1f4.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-30 22:11
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,e4,e9,5a,e5,9a,8d,45,a1,f7,b5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,e4,e9,5a,e5,9a,8d,45,a1,f7,b5,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(608)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\msacm32.drv

- - - - - - - > 'explorer.exe'(888)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-05-30 22:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-05-30 20:14

Před spuštěním: Volných bajtů: 53 921 443 840
Po spuštění: Volných bajtů: 54 040 997 888

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

265 --- E O F --- 2009-05-28 18:07


jo a jeste sem se chtel zeptat nod ma v karantene 722 souboru co to znamena ??? vyleci se nekdy tak ze tam nebude zaden soubor??? muzu soubory ktere sou v karantene smazat?? nebude to mit nake spatne nasledky?? dikY za odpoved

[Reklama]

[jaro3]

NOD32 to nevyléčí...Až budeš mít comp bez nákaz a vyčištěný a bude šlapat , jak má tak můžeš celou karanténu smazat.

Ještě nákaza a zbytek po AVG.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\nsreg.dat
c:\windows\system32\drivers\avgclean.sys
c:\windows\system32\drivers\avg7rsw.sys
c:\windows\system32\drivers\avg7rsxp.sys
c:\windows\system32\drivers\avg7core.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Pawkin]

tady je ten lig z combo fixu


ComboFix 09-05-30.03 - Tomáš Pawera 31.05.2009 13:00.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.511.257 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomáš Pawera\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Tomáš Pawera\Plocha\CFScript.txt
AV: 0.-1.2089877597 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Vytvořen nový Bod Obnovení

FILE ::
"c:\windows\nsreg.dat"
"c:\windows\system32\drivers\avg7core.sys"
"c:\windows\system32\drivers\avg7rsw.sys"
"c:\windows\system32\drivers\avg7rsxp.sys"
"c:\windows\system32\drivers\avgclean.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\nsreg.dat
c:\windows\system32\drivers\avg7core.sys
c:\windows\system32\drivers\avg7rsw.sys
c:\windows\system32\drivers\avg7rsxp.sys
c:\windows\system32\drivers\avgclean.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-28 do 2009-05-31 )))))))))))))))))))))))))))))))
.

2009-05-30 19:46 . 2009-05-30 19:47 -------- d-----w c:\program files\CCleaner
2009-05-30 19:05 . 2009-05-30 19:05 -------- d-----w c:\program files\FileZilla FTP Client
2009-05-29 17:52 . 2009-05-29 18:01 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-05-29 17:51 . 2009-05-29 18:02 -------- d-----w c:\program files\Autodesk
2009-05-29 17:51 . 2005-05-26 13:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll
2009-05-29 17:37 . 2009-05-29 17:37 604416 ----a-w c:\windows\system32\TUProgSt.exe
2009-05-29 17:37 . 2009-04-27 12:21 28928 ----a-w c:\windows\system32\uxtuneup.dll
2009-05-29 17:36 . 2009-05-29 17:36 361216 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-05-29 17:21 . 2009-05-29 17:37 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-05-29 16:00 . 2009-05-29 16:01 -------- d-----w C:\rsit
2009-05-29 14:41 . 2009-05-29 14:41 -------- d-----w C:\_OTMoveIt
2009-05-29 13:47 . 2009-05-29 13:47 -------- d-----w c:\windows\system32\bfubackups
2009-05-28 17:00 . 2009-05-26 11:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 17:00 . 2009-05-28 17:01 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-28 17:00 . 2009-05-26 11:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w C:\MyWorks
2009-05-28 15:34 . 2009-05-29 15:07 -------- d-----w c:\program files\ICQToolbar
2009-05-28 15:34 . 2009-05-29 10:43 -------- d-----w c:\program files\BitLord2
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\windows\Sun
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\program files\TorrentMan
2009-05-28 15:34 . 2009-05-28 15:34 -------- d-----w c:\program files\directx
2009-05-28 11:09 . 2009-05-28 11:09 -------- d-----w c:\program files\Trend Micro
2009-05-27 18:45 . 2009-05-27 18:46 -------- d-----w c:\windows\system32\NtmsData
2009-05-27 14:29 . 2009-05-27 14:29 -------- d-----w c:\documents and settings\Administrator\IETldCache
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-----w c:\documents and settings\Administrator\Data aplikací
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-s---w c:\documents and settings\Administrator
2009-05-27 14:28 . 2009-05-28 15:33 -------- d-----w c:\documents and settings\Administrator\Šablony
2009-05-27 13:46 . 2009-05-27 13:46 -------- d-----w c:\program files\Common Files\HP
2009-05-24 16:12 . 1998-09-02 08:28 38160 ----a-w c:\windows\system32\LMRTREND.dll
2009-05-24 16:12 . 1998-08-27 04:51 182032 ----a-w c:\windows\system32\dxtmsft3.dll
2009-05-24 16:12 . 1998-09-02 08:28 63488 ----a-w c:\windows\system32\unam4ie.exe
2009-05-24 16:12 . 1998-09-02 08:02 194320 ----a-w c:\windows\system32\qcut.dll
2009-05-24 16:12 . 1998-08-17 09:21 10240 ----a-w c:\windows\system32\vidx16.dll
2009-05-24 16:12 . 1998-08-17 09:21 11776 ----a-w c:\windows\system32\mciqtz.drv
2009-05-24 16:12 . 2009-05-24 16:12 4608 ----a-w c:\windows\system32\w95inf32.dll
2009-05-24 16:12 . 2009-05-24 16:12 2272 ----a-w c:\windows\system32\w95inf16.dll
2009-05-24 16:12 . 1998-10-29 14:45 306688 ----a-w c:\windows\IsUninst.exe
2009-05-24 16:10 . 2009-05-24 16:10 -------- d-sh--w c:\windows\system32\config\systemprofile\PrivacIE
2009-05-24 16:07 . 2008-04-13 19:20 182656 -c--a-w c:\windows\system32\dllcache\ndis.sys
2009-05-24 15:59 . 2009-05-24 15:59 98304 ----a-w c:\windows\system32\CmdLineExt.dll
2009-05-24 11:42 . 2009-05-24 11:42 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\l2schemas
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\system32\cs
2009-05-24 11:26 . 2009-05-24 11:26 -------- d-----w c:\windows\system32\bits
2009-05-24 11:21 . 2009-05-24 11:27 -------- d-----w c:\windows\ServicePackFiles
2009-05-24 11:11 . 2009-05-24 11:11 -------- d-----w c:\windows\EHome
2009-05-24 11:06 . 2009-05-24 11:06 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-24 10:59 . 2009-05-24 10:59 -------- d-----w c:\windows\ie8updates
2009-05-24 10:58 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-24 10:56 . 2009-05-24 10:57 -------- dc-h--w c:\windows\ie8
2009-05-22 11:01 . 2004-08-17 13:43 326912 ------w c:\windows\system32\drivers\ati2mtaa.sys
2009-05-21 16:15 . 2004-08-25 10:52 516096 ------w c:\windows\system32\ati2sgag.exe
2009-05-21 16:15 . 2004-08-25 06:40 294912 ----a-r c:\windows\system32\atiiiexx.dll
2009-05-21 16:15 . 2004-08-25 06:22 151552 ----a-r c:\windows\system32\ATIDEMGR.dll
2009-05-21 16:14 . 2009-05-21 16:16 -------- d-----w c:\program files\ATI Technologies
2009-05-20 17:25 . 2009-05-20 17:25 -------- d-----w c:\program files\Conduit
2009-05-19 18:52 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-19 18:47 . 2008-06-14 17:35 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-19 18:47 . 2008-06-14 17:35 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-19 18:38 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-19 18:37 . 2009-02-09 11:26 2191232 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-19 18:37 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-19 18:37 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-05-19 18:37 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-19 18:37 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-19 18:37 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-19 18:37 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-19 18:37 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-19 18:37 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-19 18:36 . 2009-02-09 11:26 2147328 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-19 18:36 . 2009-02-09 11:26 2025984 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-19 16:52 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-19 16:49 . 2009-05-27 13:26 -------- d-----w c:\program files\ICQ6Toolbar
2009-05-19 16:46 . 2009-05-29 18:19 -------- d-----w c:\program files\ICQ6
2009-05-19 16:43 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-19 16:36 . 2009-05-29 14:42 -------- d-----w c:\program files\GameSpy Arcade
2009-05-19 16:33 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-19 16:26 . 2008-04-11 19:06 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-19 16:17 . 2008-10-15 16:38 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-19 15:33 . 2009-05-29 16:51 -------- d-----w C:\Thalie

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 20:01 . 2006-03-02 12:00 182656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-05-29 17:00 . 2007-03-07 15:26 -------- d-----w c:\program files\lg_fwupdate
2009-05-29 11:13 . 2007-02-23 21:24 -------- d-----w c:\program files\Servant Salamander 2.0
2009-05-29 11:13 . 2007-02-23 21:27 -------- d-----w c:\program files\PDFCreator
2009-05-29 10:43 . 2007-02-23 21:24 -------- d-----w c:\program files\Codec Pack - All In 1
2009-05-29 10:21 . 2007-02-23 21:23 -------- d-----w c:\program files\Winamp
2009-05-29 10:17 . 2007-09-14 14:15 -------- d-----w c:\program files\ESET
2009-05-28 16:23 . 2007-03-07 15:17 -------- d-----w c:\program files\CyberLink DVD Solution
2009-05-28 16:23 . 2007-02-23 19:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-28 15:36 . 2007-02-23 21:32 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-24 11:44 . 2006-03-02 12:00 73236 ----a-w c:\windows\system32\perfc005.dat
2009-05-24 11:44 . 2006-03-02 12:00 398472 ----a-w c:\windows\system32\perfh005.dat
2009-05-24 11:30 . 2007-02-23 19:28 76487 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-24 11:30 . 2007-02-23 19:28 2684 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-05-19 16:50 . 2007-02-23 21:26 -------- d-----w c:\program files\ICQLite
2009-03-08 02:34 . 2006-03-02 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2006-03-02 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2006-03-02 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2006-03-02 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2006-03-02 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2006-03-02 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2006-03-02 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2006-03-02 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2006-03-02 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2006-03-02 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:23 . 2006-03-02 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2004-10-01 14:00 . 2007-03-07 15:17 40960 ------w c:\program files\Uninstall_CDS.exe
.

------- Sigcheck -------

[-] 2008-04-14 03:22 1034240 1BC8976AA32F8B85CD972586A2327447 c:\windows\EXPLORER.EXE
[-] 2007-06-13 13:11 1033728 9B32416BD5988C97B6397CE0B02CAF97 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 13:23 1033728 ED7B460B142A32097B8A8F6ECC941815 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2006-03-02 12:00 1032704 53114D57AB73A406AC7F602227781A99 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 03:22 1034240 27AFD587C462E280EE046B8CCA3C2CD1 c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2006-03-02 12:00 24576 836F7960362FF95C5D49E40B891F2CFC c:\windows\$NtServicePackUninstall$\userinit.exe
[7] 2008-04-14 03:22 26112 7DC1830F22E7D275B438127B68030239 c:\windows\ServicePackFiles\i386\userinit.exe
[7] 2008-04-14 03:22 26112 7DC1830F22E7D275B438127B68030239 c:\windows\SoftwareDistribution\Download\44c8256673ca0542cb198384f8131b68\userinit.exe
[-] 2008-04-14 03:22 26112 7C38A638CD8632EF077783D6EE51065C c:\windows\system32\userinit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-09-16 69632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\BitLord2\\BitLord.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 14:24 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [19.5.2009 18:49 222456]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [29.5.2009 19:37 604416]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-05-31 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:37]

2009-05-31 c:\windows\Tasks\User_Feed_Synchronization-{DB97E567-291E-4B34-8D35-AE6DDBCE7786}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www
FF - ProfilePath - c:\documents and settings\Tomáš Pawera\Data aplikací\Mozilla\Firefox\Profiles\28t5x1f4.default\
FF - component: c:\documents and settings\Tomáš Pawera\Data aplikací\Mozilla\Firefox\Profiles\28t5x1f4.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 13:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,e4,e9,5a,e5,9a,8d,45,a1,f7,b5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,e4,e9,5a,e5,9a,8d,45,a1,f7,b5,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(600)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2952)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-05-31 13:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-05-31 11:10
ComboFix2.txt 2009-05-30 20:14

Před spuštěním: Volných bajtů: 53 981 892 608
Po spuštění: Volných bajtů: 53 968 818 176

252 --- E O F --- 2009-05-28 18:07



a tady z hjt

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:14:49, on 31.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 4656 bytes

[jaro3]

Logy O.K:

použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Aktualizuj javu:
Java SE Runtime Environment 6u13
Vyber OS ( předpokládám Windows), dej zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u13-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , fafku.

[Pawkin]

muzu smazat soubory v karantene neznici se system??

[jaro3]

Nezničí , ty jsou v karanténě-tedy nefunkční. Pokud máš pC v pořádku tak vymaž celou karanténu.Je to vše.

[Pawkin]

diky moc uz vse jede jak ma