prosím o kontrolu (prevence) Vyřešeno

[Mefisto]

zdravím

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:11, on 10.10.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=61005
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=61005
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=61005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Microsoft WinUpdate] C:\WINDOWS\system32\msupdte.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 9493 bytes

[Reklama]

[Damned]

Preventivka na Trojana?

Je zbytečné, aby ti běžel Ad-aware a Spyware Terminator. Jeden si proto klidně odinstaluj.
Odinstaluj si i Logitech Desktop Messenger a Crawler Toolbar.

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=61005
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=61005
O4 - HKLM\..\Run: [Microsoft WinUpdate] C:\WINDOWS\system32\msupdte.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Mefisto]

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2936
Windows 5.1.2600 Service Pack 2

10.10.2009 17:00:50
mbam-log-2009-10-10 (17-00-43).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 114596
Uplynulý čas: 13 minute(s), 23 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DrvFltIp (Rogue.UnVirex) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\msupdte.exe (Backdoor.Bot) -> No action taken.

[Damned]

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[Mefisto]

ComboFix 09-10-08.04 - Honzik 10.10.2009 18:11.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1022.510 [GMT 2:00]
Spuštěný z: c:\documents and settings\Honzik\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 091009-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-2312637841-3611878973-3006672306-1003
c:\windows\regedit.com
c:\windows\system32\drivers\npf.sys
c:\windows\system32\ieuinit.inf
c:\windows\system32\Packet.dll
c:\windows\system32\taskmgr.com
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF


((((((((((((((((((((((((( Soubory vytvořené od 2009-09-10 do 2009-10-10 )))))))))))))))))))))))))))))))
.

2009-10-03 07:09 . 2009-10-03 07:09 -------- d-----w- c:\program files\Empire XP 3.0
2009-10-03 07:06 . 2009-10-03 07:06 22016 ----a-w- c:\windows\system32\prospeed_bmp2jpg.dll
2009-10-02 22:09 . 2009-10-02 22:09 0 ----a-w- c:\windows\popcreg.dat
2009-10-02 20:01 . 2009-10-02 20:41 25 ----a-w- c:\windows\popcinfot.dat
2009-10-02 19:59 . 2009-10-02 22:09 -------- d-----w- c:\program files\PopCap Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 14:45 . 2008-10-05 17:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-04 15:06 . 2007-05-14 18:25 -------- d-----w- c:\program files\Spyware Terminator
2009-10-04 10:27 . 2007-08-20 12:41 138352 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-04 10:26 . 2007-08-20 12:41 191304 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-27 13:26 . 2007-07-14 17:41 -------- d-----w- c:\program files\HLSW
2009-09-26 10:53 . 2008-09-16 14:04 -------- d-----w- c:\program files\Activision
2009-09-10 12:54 . 2008-10-05 17:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2008-10-05 17:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-23 15:05 . 2009-08-17 14:54 -------- d-----w- c:\program files\Governor of Poker
2009-08-23 15:05 . 2007-08-29 08:00 -------- d-----w- c:\program files\ATMA V
2009-08-23 10:03 . 2007-08-28 21:41 -------- d-----w- c:\program files\Hero Editor
2009-08-21 08:15 . 2009-07-31 11:59 -------- d-----w- c:\program files\Diablo II
2009-08-17 11:29 . 2007-08-28 21:40 249856 ------w- c:\windows\Setup1.exe
2009-08-17 11:29 . 2007-08-28 21:40 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-08-12 19:19 . 2009-08-12 19:19 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-08-12 19:19 . 2009-08-01 13:47 35631 ----a-w- c:\windows\DIIUnin.dat
2009-08-12 13:48 . 2007-08-27 17:57 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-08-12 13:48 . 2007-08-27 17:57 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-08-12 13:48 . 2007-08-27 17:57 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-08-01 13:47 . 2009-08-01 13:47 94208 ----a-w- c:\windows\DIIUnin.exe
2009-08-01 13:47 . 2009-08-01 13:47 2829 ----a-w- c:\windows\DIIUnin.pif
2009-07-26 13:53 . 2009-07-26 13:53 794408 ----a-w- c:\windows\system32\pbsvc.exe
2009-07-26 13:53 . 2007-08-20 12:40 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-02-12 3276288]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [2008-09-09 1783808]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-03-09 37888]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2006-01-20 544768]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-20 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-08-23 16050688]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-18 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\Honzik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2007-5-31 625952]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-5-30 393216]
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-8-19 21504]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-2 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\GamePark\\GameparkClient.exe"=
"c:\\Program Files\\GamePark\\GamePark.url"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Team17 Software Ltd\\Worms Forts Under Siege\\WF.exe"=
"c:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"c:\\Program Files\\Counter-Strike\\hl.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Documents and Settings\\Honzik\\Dokumenty\\Aplikace\\různě hry\\bulanci.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\EA Games\\Battlefield 1942\\BF1942.exe"=
"c:\\Documents and Settings\\Honzik\\Dokumenty\\Downloads\\AoE2 conquerors\\empires2.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\Ubisoft\\Crytek\\Far Cry\\Bin32\\FarCry.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Diablo II\\Game.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26000:TCP"= 26000:TCP:Gamepark
"26000:UDP"= 26000:UDP:Gamepark
"29999:TCP"= 29999:TCP:Gamepark
"29999:UDP"= 29999:UDP:Gamepark

R0 psdrv02;CD Guard Environment Driver (v2);c:\windows\system32\drivers\psdrv02.sys [11.9.2006 14:01 67960]
R0 pssync05;CD Guard Synchronization Driver (v5);c:\windows\system32\drivers\pssync05.sys [3.11.2006 10:24 61312]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.11.2008 14:19 78416]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [14.5.2007 20:27 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.11.2008 14:19 20560]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 psrem02;CD Guard Drivers Auto Removal (v2);c:\windows\system32\psrem02.exe svc --> c:\windows\system32\psrem02.exe svc [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Honzik\Data aplikací\Mozilla\Firefox\Profiles\jjxcyzpk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-ATMA V - c:\progra~1\ATMAV~1\Setup.exe
AddRemove-{C13E90B0-4E1C-11DB-6784-0152EAA218BE} - c:\program files\Activision\Call of Duty 2 1.3\Uninst_Call of Duty(R) 2 Patch 1.3.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-10 18:23
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASFWHide]
"ImagePath"="\??\c:\documents and settings\Honzik\Local Settings\TEMP\ASFWHide"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(4036)
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\progra~1\WINDOW~2\wmpband.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\system32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2009-10-10 18:29 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-10 16:29

Před spuštěním: Volných bajtů: 121 341 100 032
Po spuštění: Volných bajtů: 127 133 896 704

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

222 --- E O F --- 2008-06-20 22:58


-----------------------

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2936
Windows 5.1.2600 Service Pack 2

10.10.2009 17:42:45
mbam-log-2009-10-10 (17-42-45).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 114697
Uplynulý čas: 8 minute(s), 31 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DrvFltIp (Rogue.UnVirex) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\msupdte.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\popcreg.dat
c:\windows\popcinfot.dat
c:\windows\system32\psrem02.exe
c:\windows\system32\GameMon.des
c:\windows\system32\GameMon.des.exe
c:\progra~1\ATMAV~1\Setup.exe

Folder::
C:\Program Files\Logitech\Desktop Messenger

DDS:
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=

Firefox::
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=

Driver::
npggsvc;nProtect GameGuard Service
npggsvc
psrem02;CD Guard Drivers Auto Removal (v2)
psrem02

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASFWHide]
"ImagePath"=-




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače
*****************************************************************************************************************************************
Červený soubor zkontroluj na Virustotalu a vlož sem odkaz na výsledek.
Pokud ho nenajdeš, dej si zobrazit skryté a systémové soubory. Pokud ti nabídne, že soubor už kontroloval,
nech ho zkontrolovat znovu, a počkej až se objeví "Dokončeno" a výsledek.Potom sem zkopíruj adresní řádek.

c:\windows\system32\pbsvc.exec:\windows\system32\pbsvc.exe

[Mefisto]

ComboFix 09-10-08.04 - Honzik 10.10.2009 19:38.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1022.419 [GMT 2:00]
Spuštěný z: c:\documents and settings\Honzik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Honzik\Plocha\CFScript.txt.txt
AV: avast! antivirus 4.8.1229 [VPS 091009-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\progra~1\ATMAV~1\Setup.exe"
"c:\windows\popcinfot.dat"
"c:\windows\popcreg.dat"
"c:\windows\system32\GameMon.des"
"c:\windows\system32\GameMon.des.exe"
"c:\windows\system32\psrem02.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Logitech\Desktop Messenger
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Install\bwUnin.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Install\LiteInst.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Install\readme.txt
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Install\win2000.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Plugins\Npavi32.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\backweb.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\backweb.tlb
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\bwfiles.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\BWCHelpr.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\bwlang.ini
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\bwsec.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\bwxtext.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\clntutil.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\Cpuinf32.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\ding.wav
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\EN\ClientRc.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\EN\registerRC.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\EN\SpriteRC.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\EN\UninstallRC.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\GAPlugProtocol.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\IAdHide.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\loading.htm
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\pacsupport.js
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\Pre6Import.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\register.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\Restart.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\runner.dll
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\runner.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\Sprite6.exe
c:\program files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\wtsisctd.exe
c:\program files\Logitech\Desktop Messenger\8876480\clasid.bak
c:\program files\Logitech\Desktop Messenger\8876480\enabled.txt
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\background.gif
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\browser.htm
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\cert.db
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\DefPrefs.ini
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\desktop-8876480-6536906.ico
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\desktop.ico
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bif
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bis
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.dat
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.idx
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.dat
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.idx
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.GIF
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.htm
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\main.wkg
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\UpgradePubKey.txt
c:\program files\Logitech\Desktop Messenger\8876480\InitData\Data\UsrPrefs.ini
c:\program files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\BWCHelpr-8876480.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrdan.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrdeu.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmresp.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrfin.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrfra.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrchs.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrcht.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrita.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrjpn.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrkor.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrnld.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrnor.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrptb.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\ldmrsve.dll
c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe.appid.8876480
c:\program files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll
c:\program files\Logitech\Desktop Messenger\8876480\readme.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\DataSets.ini
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e36\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e36\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e53\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e53\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e54\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3e54\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3ef0\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3ef0\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3f17\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\a9a3f17\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\BWEvents.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\chninfo.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\ChnReg.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\segrules.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\Stats.tmp
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\UserProf.bak
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\1269\UserProf.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\_bwfindx.zip
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\139MD Welcome Message.ipk
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Close.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Connect.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\logiaction.exe
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\main.bif
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\main.bis
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Offer2.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Privacy.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\resources.bis
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Sprite.log
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Summary.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\11e4f6f3\Teaser.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\BWEvents.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\chninfo.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\ChnReg.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\segrules.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\Stats.tmp
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\UserProf.bak
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\12bb\UserProf.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\BWEvents.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\chninfo.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\ChnReg.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\segrules.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\Stats.tmp
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\UserProf.bak
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7155\UserProf.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\BWEvents.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\chninfo.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\ChnReg.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\segrules.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\Stats.tmp
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\UserProf.bak
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\7158\UserProf.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\background.gif
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\browser.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\cache.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\cert.db
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\D0000000.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\DefPrefs.ini
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\desktop-8876480-6536906.ico
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\desktop.ico
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\GenFlash\1\gen.bif
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\GenFlash\1\gen.bis
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\GenFlash\1\info.iad
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\HostCache.ini
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\chandir.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\chandir.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\chn.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\chn.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\InfoCenter.GIF
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\InfoCenter.htm
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\inuse.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\L0000155.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\L0000156.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\L0000157.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\L0000158.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\main.log
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\player.ini
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_die.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_die.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_dnd.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_dnd.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_ext.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_ext.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_rcv.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\prs_rcv.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\S0000000.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\S0000001.FCS
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\storydb.dat
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\storydb.idx
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\UpgradePubKey.txt
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\UsrPrefs.ini
c:\program files\Logitech\Desktop Messenger\8876480\Users\Honzik\Data\wg1.wkg
c:\windows\popcinfot.dat
c:\windows\popcreg.dat
c:\windows\system32\GameMon.des

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PSREM02
-------\Service_psrem02


((((((((((((((((((((((((( Soubory vytvořené od 2009-09-10 do 2009-10-10 )))))))))))))))))))))))))))))))
.

2009-10-03 07:09 . 2009-10-03 07:09 -------- d-----w- c:\program files\Empire XP 3.0
2009-10-03 07:06 . 2009-10-03 07:06 22016 ----a-w- c:\windows\system32\prospeed_bmp2jpg.dll
2009-10-02 19:59 . 2009-10-02 22:09 -------- d-----w- c:\program files\PopCap Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 17:48 . 2007-08-21 11:02 -------- d-----w- c:\program files\Logitech
2009-10-10 14:45 . 2008-10-05 17:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-04 15:06 . 2007-05-14 18:25 -------- d-----w- c:\program files\Spyware Terminator
2009-10-04 10:27 . 2007-08-20 12:41 138352 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-04 10:26 . 2007-08-20 12:41 191304 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-27 13:26 . 2007-07-14 17:41 -------- d-----w- c:\program files\HLSW
2009-09-26 10:53 . 2008-09-16 14:04 -------- d-----w- c:\program files\Activision
2009-09-10 12:54 . 2008-10-05 17:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2008-10-05 17:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-23 15:05 . 2009-08-17 14:54 -------- d-----w- c:\program files\Governor of Poker
2009-08-23 15:05 . 2007-08-29 08:00 -------- d-----w- c:\program files\ATMA V
2009-08-23 10:03 . 2007-08-28 21:41 -------- d-----w- c:\program files\Hero Editor
2009-08-21 08:15 . 2009-07-31 11:59 -------- d-----w- c:\program files\Diablo II
2009-08-17 11:29 . 2007-08-28 21:40 249856 ------w- c:\windows\Setup1.exe
2009-08-17 11:29 . 2007-08-28 21:40 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-08-12 19:19 . 2009-08-12 19:19 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-08-12 19:19 . 2009-08-01 13:47 35631 ----a-w- c:\windows\DIIUnin.dat
2009-08-12 13:48 . 2007-08-27 17:57 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-08-12 13:48 . 2007-08-27 17:57 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-08-12 13:48 . 2007-08-27 17:57 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-08-01 13:47 . 2009-08-01 13:47 94208 ----a-w- c:\windows\DIIUnin.exe
2009-08-01 13:47 . 2009-08-01 13:47 2829 ----a-w- c:\windows\DIIUnin.pif
2009-07-26 13:53 . 2009-07-26 13:53 794408 ----a-w- c:\windows\system32\pbsvc.exe
2009-07-26 13:53 . 2007-08-20 12:40 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-10_16.24.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-10 17:49 . 2009-10-10 17:49 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat
+ 2009-10-10 17:50 . 2009-10-10 17:50 16384 c:\windows\Temp\Perflib_Perfdata_24c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-02-12 3276288]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [2008-09-09 1783808]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-03-09 37888]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2006-01-20 544768]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-20 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-08-23 16050688]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-18 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\Honzik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2007-5-31 625952]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-5-30 393216]
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-8-19 21504]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-2 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\GamePark\\GameparkClient.exe"=
"c:\\Program Files\\GamePark\\GamePark.url"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Team17 Software Ltd\\Worms Forts Under Siege\\WF.exe"=
"c:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"c:\\Program Files\\Counter-Strike\\hl.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Documents and Settings\\Honzik\\Dokumenty\\Aplikace\\různě hry\\bulanci.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\EA Games\\Battlefield 1942\\BF1942.exe"=
"c:\\Documents and Settings\\Honzik\\Dokumenty\\Downloads\\AoE2 conquerors\\empires2.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\Ubisoft\\Crytek\\Far Cry\\Bin32\\FarCry.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Diablo II\\Game.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26000:TCP"= 26000:TCP:Gamepark
"26000:UDP"= 26000:UDP:Gamepark
"29999:TCP"= 29999:TCP:Gamepark
"29999:UDP"= 29999:UDP:Gamepark

R0 psdrv02;CD Guard Environment Driver (v2);c:\windows\system32\drivers\psdrv02.sys [11.9.2006 14:01 67960]
R0 pssync05;CD Guard Synchronization Driver (v5);c:\windows\system32\drivers\pssync05.sys [3.11.2006 10:24 61312]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.11.2008 14:19 78416]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [14.5.2007 20:27 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.11.2008 14:19 20560]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Honzik\Data aplikací\Mozilla\Firefox\Profiles\jjxcyzpk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-10 19:50
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\docume~1\Honzik\LOCALS~1\Temp\etilqs_QKwp33ExR2knsXhyJFfc 586752 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(784)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(3500)
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\progra~1\WINDOW~2\wmpband.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\system32\rundll32.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2009-10-10 19:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-10 17:55
ComboFix2.txt 2009-10-10 16:29

Před spuštěním: Volných bajtů: 127 112 835 072
Po spuštění: Volných bajtů: 127 053 950 976

382 --- E O F --- 2008-06-20 22:58









-----------------------







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:59:28, on 10.10.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8382 bytes











chování počítače? .. no nvm nic jsem nepociťoval předtim ani teď .. snad jen že se rychleji spustí jinak asi nic

jdu ještě udělat to s tim virustotalem

EDIT: http://www.virustotal.com/cs/analisis/d ... 1255197877

-doufám že jsem to udělal správně.. trošku sem se v těch intrukcích zamotal,ale myslim že jo

[Damned]

Výborně.

Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.

ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Kdyby něco, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

[Mefisto]

díky moc za rychlou pomoc ..