HijackThis log - prosím o kontrolu

[Stene]

Přidávám log kvůli problému s googlem
Počítač je každý týden čištěný CCleanerem. Díky


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:20:21, on 5.12.2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\Explorer.EXE
D:\Windows\SOUNDMAN.EXE
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Alwil Software\Avast4\ashDisp.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
D:\Users\Stene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yuns32.exe
C:\SVN repo\Torstise\bin\TSVNCache.exe
D:\Windows\system32\taskhost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\QIP2\qip.exe
D:\Windows\system32\wuauclt.exe
D:\Windows\system32\SearchFilterHost.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - D:\Users\Stene\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - D:\Users\Stene\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] "D:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: yuns32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O20 - AppInit_DLLs: D:\Windows\system32\kbdnet.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccess - Unknown owner - C:\mido\NMSAccess32.exe

--
End of file - 5779 bytes

[Reklama]

[Damned]

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - Startup: yuns32.exe
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Stene]

Něco to našlo :)


Malwarebytes' Anti-Malware 1.42
Verze databáze: 3299
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5.12.2009 12:04:26
mbam-log-2009-12-05 (12-04-18)1

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 95862
Uplynulý čas: 4 minute(s), 14 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 1
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 2
Infikované adresáře: 0
Infikované soubory: 7

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
D:\Windows\System32\kbdnet.dll (Spyware.Passwords) -> No action taken.

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\D:\Windows\System32\memman.vxd (Rogue.sysCleaner) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Spyware.Passwords) -> No action taken.

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.Passwords) -> Data: d:\windows\system32\kbdnet.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.Passwords) -> Data: system32\kbdnet.dll -> No action taken.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
D:\Windows\System32\kbdnet.dll (Spyware.Passwords) -> No action taken.
D:\Windows\System32\memman.vxd (Rogue.sysCleaner) -> No action taken.
D:\Windows\System32\mscert.dll (Spyware.Passwords) -> No action taken.
D:\Windows\yunns32.dll (Trojan.Agent) -> No action taken.
D:\Program Files\Adobe\acrotray.exe (Trojan.Agent) -> No action taken.
D:\Windows\System32\flags.ini (Malware.Trace) -> No action taken.
D:\Windows\System32\uses32.dat (Malware.Trace) -> No action taken.

[Damned]

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[Stene]

Malwarebytes' Anti-Malware 1.42
Verze databáze: 3299
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5.12.2009 13:50:24
mbam-log-2009-12-05 (13-50-24).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 97711
Uplynulý čas: 3 minute(s), 44 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)




ComboFix 09-12-04.04 - Stene 05.12.2009 13:32.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1024.593 [GMT 1:00]
Spuštěný z: c:\firefox - downloaded\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\config.data
d:\windows\system32\skinboxer43.dll
d:\windows\system32\thread.xml
d:\windows\system32\worker.info

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-11-05 do 2009-12-05 )))))))))))))))))))))))))))))))
.

2009-12-05 12:41 . 2009-12-05 12:41 -------- d-----w- d:\users\Stene\AppData\Local\temp
2009-12-05 12:41 . 2009-12-05 12:41 -------- d-----w- d:\users\Default\AppData\Local\temp
2009-12-05 10:58 . 2009-12-05 10:58 -------- d-----w- d:\users\Stene\AppData\Roaming\Malwarebytes
2009-12-05 10:58 . 2009-12-03 15:14 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-12-05 10:58 . 2009-12-05 10:58 -------- d-----w- d:\programdata\Malwarebytes
2009-12-05 10:58 . 2009-12-03 15:13 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-12-01 19:07 . 2002-01-08 01:20 339968 ----a-w- d:\windows\system32\MP3EncX.dll
2009-12-01 18:44 . 2007-05-10 11:30 360448 ----a-w- d:\windows\lame_enc.dll
2009-12-01 17:58 . 2009-11-22 18:09 2903456 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\setup_blazemp.exe
2009-12-01 17:57 . 2009-12-01 17:58 4096 dc-h--w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}
2009-11-29 18:23 . 2009-11-29 18:23 -------- d-----w- d:\program files\Realtek
2009-11-23 06:19 . 2009-11-23 06:19 -------- d-----w- d:\users\Stene\AppData\Local\MiTAC_International_Corpo
2009-11-18 17:42 . 2007-02-26 08:26 299008 ----a-w- d:\windows\Uninstall_tkexe.exe
2009-11-18 17:32 . 2009-11-18 17:32 14812423 ----a-w- d:\windows\system32\TiskProRadost_AlbumMaker_uninstaller.exe
2009-11-11 15:58 . 2009-11-11 16:04 4096 d-----w- d:\users\Stene\AppData\Roaming\Likno
2009-11-11 15:57 . 1998-06-17 23:00 49152 ----a-w- d:\windows\system32\MSCDRUN.DLL
2009-11-11 15:57 . 1998-04-23 23:00 368912 ----a-w- d:\windows\system32\vbar332.dll
2009-11-10 16:25 . 2009-11-10 16:29 -------- d-----w- d:\users\Stene\AppData\Roaming\Nero
2009-11-10 16:13 . 2009-11-10 16:14 -------- d-----w- d:\program files\Nero
2009-11-10 16:13 . 2009-11-10 16:14 -------- d-----w- d:\programdata\Nero
2009-11-10 16:13 . 2009-11-10 16:15 4096 d-----w- d:\program files\Common Files\Nero
2009-11-09 17:40 . 2009-11-09 17:40 -------- d-----w- d:\program files\Carambis
2009-11-08 17:07 . 2009-11-08 17:07 318464 ------w- d:\windows\system32\jmail_AutoBAUP.dll
2009-11-08 17:07 . 2009-11-08 17:07 720896 ----a-w- d:\windows\iun6002.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-05 11:51 . 2009-07-14 08:44 622422 ----a-w- d:\windows\system32\perfh005.dat
2009-12-05 11:51 . 2009-07-14 08:44 118604 ----a-w- d:\windows\system32\perfc005.dat
2009-11-29 18:23 . 2009-09-23 18:29 4096 d--h--w- d:\program files\InstallShield Installation Information
2009-11-22 18:09 . 2009-12-01 17:56 3579904 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\OFFLINE\59F37AFC\8917324D\BMP.exe
2009-11-09 16:05 . 2009-09-23 18:28 4096 d-----w- d:\program files\Common Files\InstallShield
2009-10-26 19:26 . 2009-10-26 19:24 4096 d-----w- d:\program files\IrfanView
2009-10-26 19:24 . 2009-10-26 19:24 -------- d-----w- d:\users\Stene\AppData\Roaming\IrfanView
2009-10-26 15:13 . 2009-10-26 15:13 -------- d-----w- d:\program files\Common Files\Macromedia
2009-10-25 18:08 . 2009-09-24 15:48 108824 ----a-w- d:\users\Stene\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-25 15:52 . 2009-09-24 16:57 12288 d-----w- d:\programdata\Microsoft Help
2009-10-25 13:00 . 2009-10-25 13:00 4096 d-----w- d:\program files\Microsoft Works
2009-10-25 12:59 . 2009-07-14 04:52 -------- d-----w- d:\program files\MSBuild
2009-10-25 12:53 . 2009-10-25 12:53 -------- d-----w- d:\program files\Microsoft.NET
2009-10-25 12:42 . 2009-10-25 12:42 -------- d-----w- d:\program files\Microsoft Visual Studio 8
2009-10-25 11:50 . 2009-10-10 18:21 4096 d-----w- d:\program files\Common Files\Adobe
2009-10-23 11:02 . 2009-10-23 11:02 4096 d-----w- d:\program files\Opera
2009-10-15 18:12 . 2009-10-15 18:12 -------- d-----w- d:\program files\MSECache
2009-10-12 12:47 . 2009-10-10 15:57 4096 d-----w- d:\program files\ICQ6Toolbar
2009-10-12 12:47 . 2009-10-10 15:57 -------- d-----w- d:\programdata\ICQ
2009-10-10 18:26 . 2009-10-10 18:26 -------- d-----w- d:\programdata\Adobe Systems
2009-10-10 18:22 . 2009-10-10 18:22 -------- d-----w- d:\program files\Common Files\Adobe Systems Shared
2009-10-06 13:40 . 2009-10-06 13:40 -------- d-----w- d:\users\Stene\AppData\Roaming\TortoiseSVN
2009-10-06 13:39 . 2009-10-06 13:39 -------- d-----w- d:\users\Stene\AppData\Roaming\Subversion
2009-10-06 13:38 . 2009-10-06 13:38 -------- d-----w- d:\program files\Common Files\TortoiseOverlays
2009-10-04 16:11 . 2009-09-23 18:28 319488 ----a-w- d:\windows\HideWin.exe
2009-09-16 03:59 . 2009-12-01 17:56 1411584 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\OFFLINE\3D2919A7\32F7A4D1\AdjMmsEng.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- d:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- d:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="d:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-08-17 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\malwarebytes' anti-malware\mbam.exe" [2009-12-03 1394000]
"SoundMan"="SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2009-03-10 604704]

d:\users\Stene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - d:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

R1 aswSP;avast! Self Protection;d:\windows\System32\drivers\aswSP.sys [12.10.2009 13:44 114768]
R2 aswFsBlk;aswFsBlk;d:\windows\System32\drivers\aswFsBlk.sys [12.10.2009 13:44 20560]
R2 aswMonFlt;aswMonFlt;d:\windows\System32\drivers\aswMonFlt.sys [12.10.2009 13:44 53328]
.
.
------- Doplňkový sken -------
.
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\users\Stene\AppData\Roaming\Mozilla\Firefox\Profiles\lp5h79uk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - plugin: c:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Driver Updater - (no file)
AddRemove-Blaze Media Pro - d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\setup_blazemp.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-Kalender - d:\windows\Uninstall_tkexe -kalender
AddRemove-NVIDIA Drivers - d:\windows\system32\NVUNINST.EXE UninstallGUI
AddRemove-{b615a8e7-3c43-4593-9649-2f36bc3ffa54} - d:\program files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=XM02-508X-MHAT-19WU-9Z3Z-0CH0-3U6E-85W5-MMHH-6647-1Z5L-7M8C-0U45-758P-0000


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3870805354-2536924046-3073466802-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CB080265-397A-D84E-7340-0B8628F36531}*]
"hahaldibkcbnnaac"=hex:6a,61,67,6d,68,64,70,64,61,66,67,65,61,68,6d,6e,64,63,
66,6a,00,00
"ianobhhmgcmiienkcn"=hex:6a,61,67,6d,68,64,70,64,61,66,67,65,61,68,6d,6e,64,63,
66,6a,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2009-12-05 13:45
ComboFix-quarantined-files.txt 2009-12-05 12:45

Před spuštěním: 2 122 637 312
Po spuštění: 2 380 775 424

- - End Of File - - 636133EE8885B80C64301C3722524CB8

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
d:\windows\Fonts\StaticCache.dat
D:\Windows\yuns32.exe

Folder::
d:\program files\ICQ6Toolbar

Firefox::
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=

RegLockDel::
[HKEY_USERS\S-1-5-21-3870805354-2536924046-3073466802-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CB080265-397A-D84E-7340-0B8628F36531}*]




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[Stene]

ComboFix 09-12-04.04 - Stene 05.12.2009 14:24.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1024.478 [GMT 1:00]
Spuštěný z: c:\firefox - downloaded\ComboFix.exe
Použité ovládací přepínače :: d:\users\Stene\Desktop\CFScript.txt

FILE ::
"d:\windows\Fonts\StaticCache.dat"
"d:\windows\yuns32.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\program files\ICQ6Toolbar
d:\program files\ICQ6Toolbar\Icons.bmp
d:\program files\ICQ6Toolbar\ICQ Service.exe
d:\program files\ICQ6Toolbar\icq6Toolbar.ico
d:\program files\ICQ6Toolbar\ICQToolBar.dll
d:\program files\ICQ6Toolbar\ICQUnToolbar.exe
d:\program files\ICQ6Toolbar\logo_small.gif
d:\program files\ICQ6Toolbar\ServiceStarter.exe
d:\program files\ICQ6Toolbar\short.wav
d:\program files\ICQ6Toolbar\Version.txt
d:\windows\Fonts\StaticCache.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-11-05 do 2009-12-05 )))))))))))))))))))))))))))))))
.

2009-12-05 13:33 . 2009-12-05 13:33 -------- d-----w- d:\users\Stene\AppData\Local\temp
2009-12-05 13:33 . 2009-12-05 13:33 -------- d-----w- d:\users\Public\AppData\Local\temp
2009-12-05 13:33 . 2009-12-05 13:33 -------- d-----w- d:\users\Default\AppData\Local\temp
2009-12-05 10:58 . 2009-12-05 10:58 -------- d-----w- d:\users\Stene\AppData\Roaming\Malwarebytes
2009-12-05 10:58 . 2009-12-03 15:14 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-12-05 10:58 . 2009-12-05 10:58 -------- d-----w- d:\programdata\Malwarebytes
2009-12-05 10:58 . 2009-12-03 15:13 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-12-01 19:07 . 2002-01-08 01:20 339968 ----a-w- d:\windows\system32\MP3EncX.dll
2009-12-01 18:44 . 2007-05-10 11:30 360448 ----a-w- d:\windows\lame_enc.dll
2009-12-01 17:58 . 2009-11-22 18:09 2903456 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\setup_blazemp.exe
2009-12-01 17:57 . 2009-12-01 17:58 4096 dc-h--w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}
2009-11-29 18:23 . 2009-11-29 18:23 -------- d-----w- d:\program files\Realtek
2009-11-23 06:19 . 2009-11-23 06:19 -------- d-----w- d:\users\Stene\AppData\Local\MiTAC_International_Corpo
2009-11-18 17:42 . 2007-02-26 08:26 299008 ----a-w- d:\windows\Uninstall_tkexe.exe
2009-11-18 17:32 . 2009-11-18 17:32 14812423 ----a-w- d:\windows\system32\TiskProRadost_AlbumMaker_uninstaller.exe
2009-11-11 15:58 . 2009-11-11 16:04 4096 d-----w- d:\users\Stene\AppData\Roaming\Likno
2009-11-11 15:57 . 1998-06-17 23:00 49152 ----a-w- d:\windows\system32\MSCDRUN.DLL
2009-11-11 15:57 . 1998-04-23 23:00 368912 ----a-w- d:\windows\system32\vbar332.dll
2009-11-10 16:25 . 2009-11-10 16:29 -------- d-----w- d:\users\Stene\AppData\Roaming\Nero
2009-11-10 16:13 . 2009-11-10 16:14 -------- d-----w- d:\program files\Nero
2009-11-10 16:13 . 2009-11-10 16:14 -------- d-----w- d:\programdata\Nero
2009-11-10 16:13 . 2009-11-10 16:15 4096 d-----w- d:\program files\Common Files\Nero
2009-11-09 17:40 . 2009-11-09 17:40 -------- d-----w- d:\program files\Carambis
2009-11-08 17:07 . 2009-11-08 17:07 318464 ------w- d:\windows\system32\jmail_AutoBAUP.dll
2009-11-08 17:07 . 2009-11-08 17:07 720896 ----a-w- d:\windows\iun6002.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-05 13:13 . 2009-07-14 08:44 622422 ----a-w- d:\windows\system32\perfh005.dat
2009-12-05 13:13 . 2009-07-14 08:44 118604 ----a-w- d:\windows\system32\perfc005.dat
2009-12-05 12:46 . 2009-10-04 11:58 4096 d-----w- d:\program files\QIP2
2009-11-29 18:23 . 2009-09-23 18:29 4096 d--h--w- d:\program files\InstallShield Installation Information
2009-11-22 18:09 . 2009-12-01 17:56 3579904 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\OFFLINE\59F37AFC\8917324D\BMP.exe
2009-11-09 16:05 . 2009-09-23 18:28 4096 d-----w- d:\program files\Common Files\InstallShield
2009-10-26 19:26 . 2009-10-26 19:24 4096 d-----w- d:\program files\IrfanView
2009-10-26 19:24 . 2009-10-26 19:24 -------- d-----w- d:\users\Stene\AppData\Roaming\IrfanView
2009-10-26 15:13 . 2009-10-26 15:13 -------- d-----w- d:\program files\Common Files\Macromedia
2009-10-25 18:08 . 2009-09-24 15:48 108824 ----a-w- d:\users\Stene\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-25 15:52 . 2009-09-24 16:57 12288 d-----w- d:\programdata\Microsoft Help
2009-10-25 13:00 . 2009-10-25 13:00 4096 d-----w- d:\program files\Microsoft Works
2009-10-25 12:59 . 2009-07-14 04:52 -------- d-----w- d:\program files\MSBuild
2009-10-25 12:53 . 2009-10-25 12:53 -------- d-----w- d:\program files\Microsoft.NET
2009-10-25 12:42 . 2009-10-25 12:42 -------- d-----w- d:\program files\Microsoft Visual Studio 8
2009-10-25 11:50 . 2009-10-10 18:21 4096 d-----w- d:\program files\Common Files\Adobe
2009-10-23 11:02 . 2009-10-23 11:02 4096 d-----w- d:\program files\Opera
2009-10-15 18:12 . 2009-10-15 18:12 -------- d-----w- d:\program files\MSECache
2009-10-12 12:47 . 2009-10-10 15:57 -------- d-----w- d:\programdata\ICQ
2009-10-10 18:26 . 2009-10-10 18:26 -------- d-----w- d:\programdata\Adobe Systems
2009-10-10 18:22 . 2009-10-10 18:22 -------- d-----w- d:\program files\Common Files\Adobe Systems Shared
2009-10-06 13:40 . 2009-10-06 13:40 -------- d-----w- d:\users\Stene\AppData\Roaming\TortoiseSVN
2009-10-06 13:39 . 2009-10-06 13:39 -------- d-----w- d:\users\Stene\AppData\Roaming\Subversion
2009-10-06 13:38 . 2009-10-06 13:38 -------- d-----w- d:\program files\Common Files\TortoiseOverlays
2009-10-04 16:11 . 2009-09-23 18:28 319488 ----a-w- d:\windows\HideWin.exe
2009-09-16 03:59 . 2009-12-01 17:56 1411584 -c--a-w- d:\programdata\{C712AF59-975F-4D33-BD94-F38108590815}\OFFLINE\3D2919A7\32F7A4D1\AdjMmsEng.dll
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- d:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-12-05_12.42.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:55 . 2009-12-05 13:11 35646 d:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-09-23 18:12 . 2009-12-05 11:48 16384 d:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:09 16384 d:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-09-23 18:12 . 2009-12-05 11:48 32768 d:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:09 32768 d:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:09 16384 d:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-09-23 18:12 . 2009-12-05 11:48 16384 d:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:09 16384 d:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-09-23 18:12 . 2009-12-05 11:48 16384 d:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-09-23 18:19 . 2009-12-05 12:00 32768 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-23 18:19 . 2009-12-05 13:16 32768 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-23 18:19 . 2009-12-05 13:16 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2009-09-23 18:19 . 2009-12-05 12:00 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2009-09-23 18:19 . 2009-12-05 12:00 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2009-09-23 18:19 . 2009-12-05 13:16 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:16 32768 d:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-09-23 18:12 . 2009-12-05 12:00 32768 d:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-09-23 18:12 . 2009-12-05 11:48 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-09-23 18:12 . 2009-12-05 13:09 16384 d:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-09-23 18:13 . 2009-12-05 13:11 5978 d:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3870805354-2536924046-3073466802-1001_UserData.bin
- 2009-09-23 18:13 . 2009-12-05 11:49 5978 d:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3870805354-2536924046-3073466802-1001_UserData.bin
+ 2000-03-29 14:17 . 2000-03-29 14:17 5824 d:\windows\System32\drivers\ASUSHWIO.SYS
- 2009-12-05 11:47 . 2009-12-05 11:47 2048 d:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-12-05 13:05 . 2009-12-05 13:09 2048 d:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-12-05 13:05 . 2009-12-05 13:09 2048 d:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-12-05 11:47 . 2009-12-05 11:47 2048 d:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:05 . 2009-12-05 13:13 606992 d:\windows\System32\perfh009.dat
- 2009-07-14 02:05 . 2009-12-05 11:51 606992 d:\windows\System32\perfh009.dat
- 2009-07-14 02:05 . 2009-12-05 11:51 103370 d:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2009-12-05 13:13 103370 d:\windows\System32\perfc009.dat
+ 2009-07-14 02:03 . 2009-12-05 13:22 6553600 d:\windows\System32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:03 . 2009-12-05 12:00 6553600 d:\windows\System32\SMI\Store\Machine\schema.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 16:55 85768 ----a-w- d:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="d:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-08-17 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\malwarebytes' anti-malware\mbam.exe" [2009-12-03 1394000]
"SoundMan"="SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2009-03-10 604704]

d:\users\Stene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - d:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

R1 aswSP;avast! Self Protection;d:\windows\System32\drivers\aswSP.sys [12.10.2009 13:44 114768]
R2 aswFsBlk;aswFsBlk;d:\windows\System32\drivers\aswFsBlk.sys [12.10.2009 13:44 20560]
R2 aswMonFlt;aswMonFlt;d:\windows\System32\drivers\aswMonFlt.sys [12.10.2009 13:44 53328]
.
.
------- Doplňkový sken -------
.
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\users\Stene\AppData\Roaming\Mozilla\Firefox\Profiles\lp5h79uk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - plugin: c:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3870805354-2536924046-3073466802-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CB080265-397A-D84E-7340-0B8628F36531}*]
"hahaldibkcbnnaac"=hex:6a,61,67,6d,68,64,70,64,61,66,67,65,61,68,6d,6e,64,63,
66,6a,00,00
"ianobhhmgcmiienkcn"=hex:6a,61,67,6d,68,64,70,64,61,66,67,65,61,68,6d,6e,64,63,
66,6a,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2009-12-05 14:36
ComboFix-quarantined-files.txt 2009-12-05 13:36
ComboFix2.txt 2009-12-05 12:45

Před spuštěním: 2 401 882 112
Po spuštění: 2 357 567 488

- - End Of File - - 8DCC97EDDCE2A3F094220A3531387BDB



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:35, on 5.12.2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\SOUNDMAN.EXE
D:\Program Files\Alwil Software\Avast4\ashDisp.exe
D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\SVN repo\Torstise\bin\TSVNCache.exe
D:\Windows\system32\taskhost.exe
D:\Windows\system32\notepad.exe
D:\Windows\system32\wuauclt.exe
D:\Windows\system32\notepad.exe
D:\Windows\explorer.exe
C:\SVN repo\Torstise\bin\TSVNCache.exe
D:\Windows\system32\SearchProtocolHost.exe
D:\Windows\system32\SearchFilterHost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] "D:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccess - Unknown owner - C:\mido\NMSAccess32.exe

--
End of file - 3820 bytes



Chování pc: Tak počítač se chová jak má - konečně. Google funguje. Děkuji ti mnohokrát Damned

[Damned]

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/Uninstall

Pokud nepůjde a ComboFix je na Ploše, tak Start-->Spustit a do řádku zkopíruj: "%userprofile%\Desktop\combofix" /uninstall
(Podle CF community bylo změněno /u na uninstall, pokud je na Ploše, tak daný řetězec)

Pokud ti nepůjde ani to tak najdi a smaž:
C:\327882R2FWJFW
C:\ComboFix
C:\Qoobox
C:\Combofix.txt
a Combofix.exe
Pak si stáhni OTCleanIt.
- Připoj se k internetu a dvojklikem spusť program
- Klikni na tlačítko CleanUp
- Po dokončení povol restart PC
- Po restartu tento nástroj smaž - není určen pro běžné používání


Stáhni si ToolsCleaner2 (by de A.Rothstein & Dj Quiou) na Plochu a spusť ho.

Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění) a odstraň nalezené.
Zavři a smaž program.

Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.