Prosím o kontrolu logu - nutné

[Martinor]

Zdravím,pořád mi ve Firefoxu vyskakují jiná okna například na porno nebo na poker,nebo že jsem něco vyhrál.A to jdu třeba jenom na Seznam.cz a vyskočí mě další okno s pokerem nebo tak,jak se toho zbavit?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:26:54, on 24.7.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Atheros\ACU.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\System Control Manager\edd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIMP2\AIMP2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\IE8-WindowsXP-x86-CSY.exe
c:\d409bffdcf420a269ec0712747\update\iesetup.exe
c:\d409bffdcf420a269ec0712747\update\update.exe
C:\Documents and Settings\Owner\Plocha\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.icanseek.com/seek.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: CashBackAssistant - {00F5B5BA-E3C2-4b70-BF51-42A557914FAD} - C:\Program Files\Nice Prosper\CashBackAssistant\CashBackAssistantIE.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Media Access Startup - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\1.0.0.610\HPIEAddOn.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.0.0.3540\NPIEAddOn.dll
O3 - Toolbar: Desktop Smiley Toolbar - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\Desktop Smiley Toolbar\3.10.0.11120\stb0.dll
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 8647256975
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8647332600
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Konfigurační služba Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 8214 bytes


Díky

[Reklama]

[jaro3]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

Stáhni si GooredFix

a ulož si ho na plochu.Poklepej na něj .
Vyber 1 . Find Goored (no fix) a klikni na Enter.
Otevře se log , zkopíruj sem celý jeho obsah ( jinak ho najdeš na své ploše pod názvem Goored.txt).
Neklikej na volbu 2 !

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Martinor]

HJ:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:36:58, on 24.7.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\tsnp2std.exe
C:\Program Files\System Control Manager\edd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Atheros\ACU.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\PROGRA~1\AIMP2\AIMP2.exe
C:\Documents and Settings\Owner\Plocha\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.icanseek.com/seek.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: CashBackAssistant - {00F5B5BA-E3C2-4b70-BF51-42A557914FAD} - C:\Program Files\Nice Prosper\CashBackAssistant\CashBackAssistantIE.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Media Access Startup - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\1.0.0.610\HPIEAddOn.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.0.0.3540\NPIEAddOn.dll
O3 - Toolbar: Desktop Smiley Toolbar - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\Desktop Smiley Toolbar\3.10.0.11120\stb0.dll
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 8647256975
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8647332600
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Konfigurační služba Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 8019 bytes


GooredFix

GooredFix by jpshortstuff (12.07.09)
Log created at 18:22 on 24/07/2009 (Owner)
Firefox version 3.0.12 (cs)

========== GooredScan ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [10:20 07/12/2008]
{B13721C7-F507-4982-B2E5-502A71474FED} [15:05 08/12/2008]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{872A1C39-DF0B-4c8b-AD84-12BA24A3B781}"="C:\Program Files\DoubleD\Desktop Smiley Toolbar\3.10.0.11120\FFToolbar" [14:40 28/04/2009]
"{2224E955-00E9-4613-A844-CE69FCCAAE91}"="C:\Program Files\Internet Saving Optimizer\3.0.0.3540\FF" [14:41 28/04/2009]
"{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC}"="C:\Program Files\Media Access Startup\1.0.0.610\FF" [14:41 28/04/2009]

-=E.O.F=-


Malware:

Malwarebytes' Anti-Malware 1.39
Verze databáze: 2493
Windows 5.1.2600 Service Pack 2

24.7.2009 18:39:09
mbam-log-2009-07-24 (18-39-06).txt

Typ skenu: Rychlý sken
Objektu skenováno: 78903
Uplynulý cas: 3 minute(s), 6 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 4
Infikované klíce registru: 30
Infikované hodnoty registru: 2
Infikované položky dat registru: 0
Infikované složky: 30
Infikované soubory: 142

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
C:\Program Files\Media Access Startup\1.0.0.610\HPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.0.0.3540\NPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.0.0.3540\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> No action taken.

Infikované klíce registru:
HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{5297e905-1dfb-4a9c-9871-a4f95fd58945} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{95b92d92-8b7d-4a19-a3f1-43113b4dbcaf} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{c28a0312-c403-417b-a425-a915bc0519cd} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{d335d84d-61d8-4b5f-9c4e-067dc8b27ed5} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{42c23154-00fa-4a93-9de9-3eb523cffff6} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2e8e2100-98cb-4aac-9480-63a281acaff5} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{22c12739-c111-44c6-9bb7-f335c2a9be2a} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{edb1a56e-2224-4c79-a4bd-42a39c6e4608} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{27ff1ee8-8ccc-49e1-b801-f212e3744e80} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0514c9b0-e4c6-4d6b-a3a6-b38bc280b115} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3fb17508-0bf4-4fde-845a-323a1052957c} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{803e73fe-cb73-4d49-8aff-653fd6f44171} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3fb17508-0bf4-4fde-845a-323a1052957c} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{51b67a88-02d0-43cb-8d12-5ca3e2d4cf49} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d44cc2fb-77b8-48a5-a5dc-f961f2d258fb} (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
C:\Program Files\DoubleD (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\Desktop Smiley Toolbar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120 (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\FFToolbar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome\locale (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome\locale\en-US (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\components (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\searchplugins (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Skins (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610 (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\Data (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome\content (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\components (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540 (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\Data (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome\content (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\components (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750 (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data (Adware.DoubleD) -> No action taken.

Infikované soubory:
C:\Program Files\Media Access Startup\1.0.0.610\HPIEAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\DoubleD\Desktop Smiley Toolbar\3.10.0.11120\stb0.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Internet Saving Optimizer\3.0.0.3540\NPIEAddOn.dll (Adware.DoubleD) -> No action taken.
c:\documents and settings\Owner\Plocha\WoWEmuHacker5.exe (Trojan.Agent) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\AIMActiveXDLL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\AxGifAnimator.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\gdiplus.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\HookAPINT.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\mfc80.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Microsoft.VC80.CRT.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Microsoft.VC80.MFC.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\msvcr80.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\MyDll.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\OEActiveXDLL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\ProductInfo.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Riched20Smiley.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\SkinCrafterDll.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbAol.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbapp.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbapp.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbappHelper.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbasst.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbdl.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbIE.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbMsn.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbOL.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbOLEX.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbsvc.exe (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbYahoo8.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\stbYahoo9.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\2154df11395ea0249c4c54961007ff8a.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\362f27667f6d7af7e9d2a6856d6560f6.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\4b6752554c03dd13115a0078de71aa4d.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\default1.dat (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\fb0a3aaf0df9fc6e0a7bc656b80c3973.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\loading.dat (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\loading.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\loading_bg.gif (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Cache\loading_logo.jpg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Cursor.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_DailyVideo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Game.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Glitter.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Logo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Option.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Recipe.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Ringtone.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Screensaver.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Search.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Smiley.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Smiley_Config.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Smiley_TellAFriend.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Wallpaper.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\Module_Web.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\pixel.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\ProductInfo.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\profile.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\SearchEngineList.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\tbcore.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\ToolbarLayout.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\UpdateCentre.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\UpdateCentreBk.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome\DesktopSmileyToolbar.jar (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\chrome\locale\en-US\global.dtd (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\components\DDAutoComplete.js (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\components\ISmileyCore.xpt (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\components\SmileyCore.dll (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\fftoolbar\searchplugins\desktopsmileysearchplugins.xml (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\About.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Component_ComboBox.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Cursor.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_DailyVideo.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Game.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Glitter.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Logo.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Option.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Recipe.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Ringtone.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Screensaver.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Search.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Smiley.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Wallpaper.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\Module_Web.mg (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnDefault.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnDisplay.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnDisplay.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnDisplay18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnDisplay20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnGlitters.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnGlitters.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnGlitters18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnGlitters20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnSmiley.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnSmiley.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnSmiley18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnSmiley20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnTellFd.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnTellFd.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnTellFd18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnTellFd20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnWink.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnWink.png (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnWink18.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Icons\TBBtnWink20.bmp (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Skins\myskin1.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Skins\myskin2.skf (Adware.DoubleD) -> No action taken.
c:\program files\DoubleD\desktop smiley toolbar\3.10.0.11120\Skins\myskin3.skf (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\HPCommon.dll (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\hppx.exe (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\Data\config.md (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
c:\program files\media access startup\1.0.0.610\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\adwpx.exe (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\NPCommon.dll (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\Data\config.md (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\install.rdf (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome\NPAddOn.jar (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome\content\NPAddOn.js (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\chrome\content\NPAddOn.xul (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\components\NPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
c:\program files\internet saving optimizer\3.0.0.3540\FF\components\NPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\unins000.dat (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\unins000.exe (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\eacore.mx (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
c:\program files\system search dispatcher\1.2.0.750\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.

[jaro3]

Odinstaluj:
Media Access Startup
Internet Saving Optimizer
desktop smiley toolbar
CashBackAssistant


. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochranu u Avastu.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[Martinor]

Moc se omlouvám,byl jsem dlouho mimo republiku,můžem to dokončit ? Asi tam bude víc bordelu než jsem si myslel ...

Malwarebytes' Anti-Malware 1.40
Verze databáze: 2693
Windows 5.1.2600 Service Pack 2

25.8.2009 13:41:47
mbam-log-2009-08-25 (13-41-44).txt

Typ skenu: Rychlý sken
Objektu skenováno: 82158
Uplynulý cas: 3 minute(s), 23 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 3
Infikované klíce registru: 17
Infikované hodnoty registru: 2
Infikované položky dat registru: 0
Infikované složky: 12
Infikované soubory: 21

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
C:\Program Files\Media Access Startup\1.0.0.610\HPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> No action taken.

Infikované klíce registru:
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
C:\Program Files\DoubleD (Adware.DoubleD) -> No action taken.
C:\Program Files\DoubleD\Desktop Smiley Toolbar (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610 (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\Data (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome\content (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750 (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\Data (Adware.DoubleD) -> No action taken.

Infikované soubory:
C:\Program Files\Media Access Startup\1.0.0.610\HPIEAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\Owner\Plocha\WoWEmuHacker5.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\HPCommon.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\hppx.exe (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\unins000.dat (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\unins000.exe (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\Data\config.md (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome.manifest (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\install.rdf (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> No action taken.
C:\Program Files\Media Access Startup\1.0.0.610\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\unins000.dat (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\unins000.exe (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\Data\eacore.mx (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.2.0.750\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> No action taken.



Combofix

ComboFix 09-08-24.06 - Owner 25.08.2009 13:45.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.3071.2482 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090512-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.0.0.610\Data\config.md
c:\program files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.xpt
c:\program files\Media Access Startup\1.0.0.610\FF\components\HPFFHelperComponent.js
c:\program files\Media Access Startup\1.0.0.610\FF\chrome.manifest
c:\program files\Media Access Startup\1.0.0.610\FF\chrome\content\HPAddOn.js
c:\program files\Media Access Startup\1.0.0.610\FF\chrome\content\HPAddOn.xul
c:\program files\Media Access Startup\1.0.0.610\FF\chrome\HPAddOn.jar
c:\program files\Media Access Startup\1.0.0.610\FF\install.rdf
c:\program files\Media Access Startup\1.0.0.610\HPCommon.dll
c:\program files\Media Access Startup\1.0.0.610\HPIEAddOn.dll
c:\program files\Media Access Startup\1.0.0.610\hppx.exe
c:\program files\Media Access Startup\1.0.0.610\unins000.dat
c:\program files\Media Access Startup\1.0.0.610\unins000.exe
c:\windows\AegisP.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-25 do 2009-08-25 )))))))))))))))))))))))))))))))
.

2009-08-19 21:39 . 2009-08-19 21:39 -------- d-----w- c:\windows\Sun
2009-08-19 10:01 . 2009-08-19 10:01 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-08-19 10:01 . 2009-08-19 10:01 -------- d-----w- c:\program files\Java
2009-08-16 18:01 . 2009-08-16 18:01 -------- d-----w- c:\windows\ServicePackFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-25 11:43 . 2004-08-18 12:00 46394 ----a-w- c:\windows\system32\perfc005.dat
2009-08-25 11:43 . 2004-08-18 12:00 310228 ----a-w- c:\windows\system32\perfh005.dat
2009-08-25 11:37 . 2009-07-24 16:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-25 11:30 . 2008-12-07 10:47 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-08-05 09:07 . 2004-08-18 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 11:36 . 2009-07-24 16:35 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2009-07-24 16:35 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-17 18:57 . 2004-08-18 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-16 13:50 . 2009-07-16 13:50 -------- d-----w- c:\program files\Codec Pack - All In 1
2009-07-16 13:50 . 2009-07-16 13:50 737280 ----a-w- c:\windows\iun6002.exe
2009-07-13 00:18 . 2004-08-18 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:59 . 2004-08-18 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-28 19:37 . 2008-12-07 04:00 101867 ----a-w- c:\windows\system32\nvModes.dat
2009-06-25 08:48 . 2004-08-18 12:00 723456 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:48 . 2004-08-18 12:00 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:48 . 2004-08-18 12:00 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:48 . 2004-08-18 12:00 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:48 . 2004-08-18 12:00 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:48 . 2004-08-18 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-22 11:34 . 2004-08-18 12:00 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2004-08-18 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 11:33 . 2004-08-18 12:00 78336 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:24 . 2004-08-18 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:31 . 2004-08-18 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-05 07:46 . 2008-12-06 18:20 655872 ----a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-18 12:00 1293312 ----a-w- c:\windows\system32\quartz.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tsnp2std"="c:\windows\tsnp2std.exe" [2005-08-17 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-18 8433664]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2007-10-19 180224]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 823296]
"ACU"="c:\program files\Atheros\ACU.exe" [2007-05-03 376921]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-21 37888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-19 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-18 1626112]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2006-06-29 89541]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-16 16855552]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-17 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Tortun\\gui.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [7.12.2008 6:02 39680]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [7.12.2008 6:00 35712]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.12.2008 17:55 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.12.2008 17:55 20560]
R2 NishService;SCM Driver Daemon;c:\program files\System Control Manager\edd.exe [7.12.2008 6:04 40960]
R3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [7.12.2008 6:04 9088]
R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [7.12.2008 14:40 57024]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.theprizeday.com/today.php
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\2fum6vsm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-25 13:47
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(912)
c:\windows\system32\antiwpa.dll
.
Celkový čas: 2009-08-25 13:49
ComboFix-quarantined-files.txt 2009-08-25 11:49

Před spuštěním: Volných bajtů: 17 795 440 640
Po spuštění: Volných bajtů: 18 646 241 280

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

146 --- E O F --- 2009-08-16 18:03

[jaro3]

Omlouvám se za prodlevu.

Měl si nejprve smazat , co našel MbAM, proveď znovu.

Manuálně smaž:
c:\program files\DAEMON Tools Toolbar