Injector.GT (?) a jak se toho zbavit?

[Ronnie]

Bohužel ten Dr. Web nic nedělá, nechal jsem tam tu obrazovku tak 2 - 3 minuty a nic, ani ťuk:-/.

Log z OTL přikládám níže:

OTL logfile created on: 14.2.2010 11:33:06 - Run 2
OTL by OldTimer - Version 3.1.28.0 Folder = C:\Documents and Settings\Lucie Žemberyová\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 86,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 97,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298,08 Gb Total Space | 247,43 Gb Free Space | 83,01% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 1863,01 Gb Total Space | 68,45 Gb Free Space | 3,67% Space Free | Partition Type: NTFS

Computer Name: LUCIE
Current User Name: Lucie Žemberyová
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Lucie Žemberyová\Plocha\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Lucie Žemberyová\Plocha\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (NVSvc) -- C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)


========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (e1express) Intel(R) -- C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.seznam.cz"
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.01.12 10:28:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.12 10:26:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009.08.24 09:09:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009.02.02 10:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Extensions
[2010.02.13 22:03:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\fzpkbk93.novy\extensions
[2009.01.02 09:37:11 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\fzpkbk93.novy\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2009.01.26 12:59:16 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\fzpkbk93.novy\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2009.10.23 13:52:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\fzpkbk93.novy\extensions\cs@dictionaries.addons.mozilla.org
[2009.01.02 09:37:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions
[2009.01.02 09:37:13 | 000,000,000 | ---D | M] (Auto Copy) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2009.01.02 09:37:13 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.01.02 09:37:14 | 000,000,000 | ---D | M] (Add N Edit Cookies) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25c}
[2009.01.02 09:37:14 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2009.01.02 09:37:15 | 000,000,000 | ---D | M] (Seznam lištiÄŤka) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[2009.01.02 09:37:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{FF380879-E2AA-4E2D-A348-99B9CBD7D3C0}
[2009.01.02 09:37:15 | 000,000,000 | ---D | M] (Mouse Gestures) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2009.01.02 09:37:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pkxv5kk1.Nepojmenovaný\extensions\temp
[2009.01.01 21:12:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\pzb64k6n.default\extensions
[2009.01.02 09:37:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions
[2009.01.02 09:37:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{11483926-db67-4190-91b1-ef20fcec5f33}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{8e117890-a33f-424b-a2ea-deb272731365}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2009.01.02 09:37:17 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2009.01.02 09:37:19 | 000,000,000 | ---D | M] (Seznam lištiÄŤka) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[2009.01.02 09:37:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2009.01.02 09:37:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Mozilla\Firefox\Profiles\r9hgrc0s.default\extensions\temp
[2010.02.13 22:04:57 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.02.02 10:31:21 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2009.02.02 10:31:21 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2009.02.02 10:31:21 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2009.02.02 10:31:21 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2009.02.02 10:31:21 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0 CE\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0 CE\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0 CE\Acrobat\AcroIEFavClient.dll ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.01 20:23:16 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.02.14 11:31:08 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.02.14 11:26:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lucie Žemberyová\DoctorWeb
[2010.02.14 11:26:10 | 000,000,000 | ---D | C] -- C:\Program Files\DrWeb
[2010.02.13 22:08:06 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.02.13 21:56:25 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Lucie Žemberyová\Plocha\OTL.exe
[2010.02.13 21:21:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010.02.13 21:12:31 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.02.13 21:12:31 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.02.13 21:12:31 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.02.13 21:11:20 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.02.13 17:12:18 | 000,396,288 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Lucie Žemberyová\Plocha\h_j_t.exe
[2010.02.13 17:05:44 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Lucie Žemberyová\Recent
[2010.02.13 14:15:42 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.02.13 14:13:53 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.02.13 14:11:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft
[2010.02.13 14:10:12 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
[2010.02.13 14:10:12 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Data aplikací\Microsoft
[2010.02.13 14:10:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft
[2010.02.13 14:09:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.02.12 18:27:35 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010.02.12 18:27:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
[2010.02.12 18:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Malwarebytes
[2010.02.12 18:23:11 | 000,000,000 | ---D | C] -- C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2010.02.12 18:23:08 | 000,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.02.12 18:23:07 | 000,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.02.12 18:23:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.02.12 18:23:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
[2010.02.12 18:01:35 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010.02.08 17:43:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lucie Žemberyová\Plocha\weider
[2010.01.28 12:44:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Plzeň pro web
[2010.01.28 12:37:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Prodejna Brno
[2010.01.26 13:24:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\WinZip
[2010.01.26 13:23:57 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[32 C:\Documents and Settings\Lucie Žemberyová\Dokumenty\*.tmp files -> C:\Documents and Settings\Lucie Žemberyová\Dokumenty\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.02.14 11:32:13 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.02.14 11:32:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.02.14 11:31:37 | 004,456,448 | -H-- | M] () -- C:\Documents and Settings\Lucie Žemberyová\NTUSER.DAT
[2010.02.14 11:31:37 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Lucie Žemberyová\ntuser.ini
[2010.02.14 11:31:32 | 004,288,328 | -H-- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Local Settings\Data aplikací\IconCache.db
[2010.02.14 11:27:47 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.02.13 22:30:07 | 000,004,745 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.02.13 21:53:36 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lucie Žemberyová\Plocha\OTL.exe
[2010.02.13 21:19:37 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.02.13 21:09:30 | 003,857,112 | R--- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\CF.exe
[2010.02.13 21:09:30 | 003,857,112 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\ComboFix.exe
[2010.02.13 14:15:47 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010.02.13 10:59:38 | 000,396,288 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Lucie Žemberyová\Plocha\h_j_t.exe
[2010.02.13 10:11:25 | 000,000,507 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.02.13 10:11:25 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010.02.12 18:27:44 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Spybot - Search & Destroy.lnk
[2010.02.12 18:23:11 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.02.12 18:04:16 | 000,045,430 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\cc_20100212_180413.reg
[2010.02.12 18:01:36 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\CCleaner.lnk
[2010.02.12 17:34:03 | 000,039,424 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remik 2.doc
[2010.02.12 17:33:01 | 000,094,208 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remigius Machura-úpravy.doc
[2010.02.11 17:40:57 | 000,124,416 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remigius Machura-originál.doc
[2010.02.08 13:43:01 | 1156,811,334 | ---- | M] () -- C:\Thunderbird 2.0.0.23 (cs) - 2010-02-08.pcv
[2010.01.29 15:33:52 | 002,253,794 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\_eshop-šablona-rw.psd
[2010.01.29 11:42:36 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\David Endršt - očima autorky.doc
[2010.01.28 12:35:36 | 000,046,592 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Prodejny.doc
[2010.01.25 14:56:53 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Lhota příspěvky.doc
[2010.01.22 17:01:18 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Mašek - slovo autorky.doc
[2010.01.21 12:39:24 | 000,059,904 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\David Endršt - k autorizaci.doc
[2010.01.21 12:38:12 | 000,059,904 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Máte velmi zajímavou práci.doc
[2010.01.20 17:05:46 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\míša tvorba.doc
[2010.01.19 14:26:01 | 000,003,584 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.18 12:10:50 | 000,017,920 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\pro Míru.doc
[2010.01.18 12:08:56 | 000,017,920 | ---- | M] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\obchody
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[32 C:\Documents and Settings\Lucie Žemberyová\Dokumenty\*.tmp files -> C:\Documents and Settings\Lucie Žemberyová\Dokumenty\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.02.13 21:12:31 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.02.13 21:12:31 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.02.13 21:12:31 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.02.13 21:12:31 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.02.13 21:12:31 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.02.13 21:11:56 | 003,857,112 | R--- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\CF.exe
[2010.02.13 21:10:57 | 003,857,112 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\ComboFix.exe
[2010.02.13 14:15:47 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010.02.13 14:15:44 | 000,261,312 | ---- | C] () -- C:\cmldr
[2010.02.12 18:27:44 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Spybot - Search & Destroy.lnk
[2010.02.12 18:23:11 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.02.12 18:04:15 | 000,045,430 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\cc_20100212_180413.reg
[2010.02.12 18:01:36 | 000,001,548 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\CCleaner.lnk
[2010.02.12 11:35:41 | 000,039,424 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remik 2.doc
[2010.02.12 11:24:00 | 000,094,208 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remigius Machura-úpravy.doc
[2010.02.10 15:19:19 | 000,124,416 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Remigius Machura-originál.doc
[2010.02.08 13:38:55 | 1156,811,334 | ---- | C] () -- C:\Thunderbird 2.0.0.23 (cs) - 2010-02-08.pcv
[2010.01.28 16:44:27 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\David Endršt - očima autorky.doc
[2010.01.28 12:35:36 | 000,046,592 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Prodejny.doc
[2010.01.25 14:56:53 | 000,049,152 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\Lhota příspěvky.doc
[2010.01.22 15:29:52 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Mašek - slovo autorky.doc
[2010.01.21 12:39:24 | 000,059,904 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\David Endršt - k autorizaci.doc
[2010.01.20 17:05:46 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\míša tvorba.doc
[2010.01.19 15:21:05 | 000,059,904 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Dokumenty\Máte velmi zajímavou práci.doc
[2010.01.18 12:10:50 | 000,017,920 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\pro Míru.doc
[2010.01.18 11:59:20 | 000,017,920 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Plocha\obchody
[2009.11.30 15:59:35 | 000,000,145 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009.10.30 10:29:06 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.12 13:45:04 | 000,004,745 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009.01.08 13:00:41 | 000,008,422 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2009.01.01 21:22:24 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.10.07 13:33:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.10.07 13:33:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.10.07 13:33:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.10.07 13:33:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.10.07 13:33:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.06.11 09:02:34 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.06.11 09:02:32 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.06.11 09:02:32 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.06.11 09:02:32 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008.06.05 08:58:26 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.02.05 13:28:20 | 000,000,051 | ---- | C] () -- C:\Documents and Settings\Lucie Žemberyová\Local Settings\Data aplikací\setup.txt
[2006.10.03 01:40:42 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\CNCFLaNL.DLL
[2005.10.14 11:56:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.10.14 11:56:50 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005.10.14 11:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005.10.14 10:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 10:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005.10.14 10:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005.10.14 10:56:50 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005.10.14 10:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll

========== LOP Check ==========

[2009.02.10 14:17:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ACD Systems
[2010.02.13 14:10:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\avg9
[2009.01.02 10:16:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonBJ
[2009.09.11 13:25:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ICQ
[2009.11.03 10:14:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Temp
[2010.01.26 13:24:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\WinZip
[2009.01.01 21:05:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\ACD Systems
[2009.01.23 11:13:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Canon
[2010.02.12 10:20:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\ICQ
[2009.02.02 13:38:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Star-Tools
[2009.01.01 21:13:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lucie Žemberyová\Data aplikací\Thunderbird

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2009.12.08 13:02:28 | 000,000,036 | ---- | M] ()(C:\WINDOWS\System32\?L) -- C:\WINDOWS\System32\嵸£
[2009.12.08 13:02:28 | 000,000,036 | ---- | C] ()(C:\WINDOWS\System32\?L) -- C:\WINDOWS\System32\嵸£
< End of report >

[Reklama]

[jaro3]

Poklepej na ikonu OTL na ploše.Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Custom Scans/Fixes do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

:Files
C:\WINDOWS\tasks\SA.DAT

:Reg
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Poté klikni nahoře na Run Fix. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.

Stáhni si Dial-a-fix
Klikni na kladívko-další možnosti:
SFC scan - Spustí nástroj pro kontrolu systémových souborů (případná potřeba instalačního media Windows).
Klikni na službu a potom na GO.

//////
Spusť F-Secure Online Scanner

Tento skener je možno použít jen v prohlížeči Internet Explorer! Postupuj podle instrukcí na stránce F-Secure pro správnou instalaci. Akceptuj licenci. Po instalaci ActiveX, klikni na Full System Scan. Když stahování skončeno, automaticky začne sken . Vyčkej konce skenu, po jeho dobu neprováděj jiné operace ani neklikej myší. Když skončí sken klikni na tlačítko Automatic clearing (recommended). Poté klikni na tlačítko Show Report a zkopíruj a vlož sem .

[Ronnie]

Vše s OTL jsem udělal, log je níže.

Ale u toho F-Secure Online Scanner si nejsem zrovna jistý, co to (ne)udělalo:
- nainstaloval jsem novou Javu, kterou to chtělo,
- pak jsem vybral jazyk, odsouhlasil podmínky použití a dal "Run Check",
- pak tam cca 30 vteřin běžel ukazatel průběhu,
- a tím to skončilo, napsalo to "you have succesfully launched F-S Online Scanner. You can run check again by clicking the button below."
- a nic víc - je to takto v pořádku nebo jsem udělal někde botu?

...aha, odpovím si sám, teď jsem to zkusil na jiném PC a tam teprv po posledním kroku, co jsem zmínil výše, naskočí správné testovací okno. To mi ale na problémovém počítači nenaskočilo, žádný firewall ani nic mého, co by to shazovalo, tam ale není... Nenapadá tě, co s tím?

Log z OTL:

All processes killed
========== OTL ==========
Process explorer.exe killed successfully!
No active process named firefox.exe was found!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\WINDOWS\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
========== FILES ==========
C:\WINDOWS\tasks\SA.DAT moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Lucie Žemberyová
->Temp folder emptied: 69902225 bytes
->Temporary Internet Files folder emptied: 154809 bytes
->FireFox cache emptied: 36995258 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2351732 bytes
%systemroot%\System32 .tmp files removed: 3770824 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 71645448 bytes

Total Files Cleaned = 176,00 mb


OTL by OldTimer - Version 3.1.28.0 log created on 02142010_155148

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[jaro3]

Nejpíš máš poškozený systém , proto jsem doporučoval tu opravu pomocí Dial-a-fix, tak to zkus , doufám , že máš instalačku.

[Ronnie]

Jj, systém je legální, instalačky mám. Dial-a-fix jsem udělal, dal mu DVD, hodně dlouhou dobu z něho něco načítal, ukazatel průběhu doběhl po čase do 100 %, okno zmizelo a bez jakékoliv další hlášky mě to vrátilo na původní okno, kde jsem vybíral to SFC Scan a dával GO.

[jaro3]

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Ronnie]

Bohužel, jak jsem psal někde v úvodu, MBAM sice spustím, ale po cca 5 vteřinách bez jakéhokoliv upozornění zmizí... sice tedy spustím třeba rychlý sken, ale projede prvních pár souborů a spadne. Kolik těch souborů stihne projet záleží na tom, jak rychle se k tomu startu proklikám, tzn. nekončí to (myslím) u stejného souboru.

[jaro3]

Ten script je OK, spíše to bude chybou na HDD atd. Zkus MbAM odinstalovat a znovu nainstalovat. Zkus zkontrolovat HDD a RAM.

[Ronnie]

Test HDD (klasicky chkdsk po restartu systému) bez problémů.
Test RAM pomocí MEMTEST 86 také bez problémů.

MBAM jsme potom zkusil odinstalovat a znovu nainstalovat, ale stále stejný stav - chvilku běží (ať už aktualizace po startu nebo i pak program) a po pár vteřinách beze slova vysvětlení prostě zmizí.

[jaro3]

Dnes končím , mrknu se na to zítra, zkusím něco vymyslet.

[Ronnie]

Ok, děkuji...