prosím o kotrolu logu Vyřešeno

[jaro3]

Samozřejmě , udělej zítra Combofix , vlož sem z něj log a budeme pokračovat.

[Reklama]

[milosb]

ahoj.tu je log z combo fix


ComboFix 10-07-27.02 - michal 28.07.2010 10:06:32.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1659 [GMT 2:00]
Spuštěný z: c:\documents and settings\michal\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\1029\dwintl.dll
c:\windows\system32\1029 . . . . nemohl být smazán

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Soubory vytvořené od 2010-06-28 do 2010-07-28 )))))))))))))))))))))))))))))))
.

2010-07-27 21:21 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 21:21 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-27 21:21 . 2010-07-27 21:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 20:39 . 2010-07-27 20:43 -------- d-----w- c:\program files\WinClamAVShield
2010-07-27 20:23 . 2010-07-27 20:23 -------- d-----w- C:\Nová složka
2010-07-27 15:01 . 2010-07-27 15:01 -------- d-----w- c:\program files\Driver Robot
2010-07-27 12:57 . 2010-07-27 13:24 -------- d-----w- c:\program files\Vstep
2010-07-27 07:50 . 2010-07-27 07:50 -------- d-----w- c:\program files\hj
2010-07-26 18:50 . 2010-07-26 18:54 -------- d-----w- c:\program files\Air Aces Pacific
2010-07-26 15:06 . 2010-07-27 22:14 -------- d-----w- c:\program files\SpeedFan
2010-07-26 12:03 . 2010-07-26 12:03 -------- d-----w- c:\windows\system32\Futuremark
2010-07-26 12:03 . 2004-10-25 18:02 21664 ----a-w- c:\windows\system32\drivers\Entech.sys
2010-07-26 12:03 . 2001-11-19 16:05 3972 ------w- c:\windows\system32\drivers\PciBus.sys
2010-07-26 12:02 . 2010-07-26 12:12 -------- d-----w- c:\program files\Futuremark
2010-07-26 09:36 . 2010-07-26 10:41 -------- d-----w- C:\Panzer Elite Action
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\AGEIA Technologies
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\windows\system32\AGEIA
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-24 21:01 . 2010-07-24 21:01 -------- d-----w- c:\program files\SSI
2010-07-24 21:00 . 2001-10-17 17:43 507904 ------w- c:\windows\Silent Hunter II remove.exe
2010-07-24 21:00 . 2000-12-15 21:58 44544 ----a-r- c:\windows\dsetup.dll
2010-07-24 21:00 . 2000-12-15 15:46 1772544 ----a-r- c:\windows\dsetup32.dll
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 19:00 . 2010-07-24 19:00 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 19:00 . 2010-07-24 19:00 -------- d-----w- c:\program files\NVIDIA Corporation
2010-07-24 18:59 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-07-24 18:59 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-07-24 18:59 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-07-24 18:59 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-07-24 18:59 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-07-24 18:59 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll
2010-07-24 17:32 . 2008-02-29 10:00 1419232 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll
2010-07-24 17:32 . 2008-02-29 09:12 35472 ----a-w- c:\windows\system32\drivers\LHidFilt.Sys
2010-07-24 16:32 . 2010-07-24 16:32 -------- d-----w- c:\program files\Stentec
2010-07-24 10:16 . 2010-07-24 10:16 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-23 18:09 . 2010-07-23 18:25 -------- d-----w- C:\foto kami
2010-07-23 17:55 . 2010-07-23 17:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-07-23 16:14 . 2010-07-23 16:14 -------- d-----w- c:\windows\Sun
2010-07-23 16:14 . 2010-07-23 16:14 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-19 11:15 . 2010-07-26 14:11 138968 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-19 11:15 . 2010-07-26 14:11 214592 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-19 11:14 . 2010-07-19 11:14 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\windows\system32\LogFiles
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\program files\EA Sports
2010-07-18 15:28 . 2010-07-18 15:28 -------- d-----w- C:\EVEREST Ultimate Edition 5.00.1652
2010-07-10 17:37 . 2010-07-10 17:37 -------- d-----w- c:\documents and settings\michal\dwhelper
2010-07-10 14:55 . 2010-07-12 16:12 -------- d-----w- c:\windows\system32\Adobe
2010-07-09 19:47 . 2010-07-09 19:47 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-04 11:50 . 2010-07-04 11:50 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-04 11:50 . 2010-07-27 09:40 -------- d-----w- c:\program files\Spyware Terminator
2010-07-03 17:52 . 2010-07-04 11:03 -------- d-----w- c:\program files\Yamicsoft
2010-07-03 13:08 . 2004-05-04 10:53 1645320 ----a-w- c:\windows\system32\gdiplus.dll
2010-07-03 08:25 . 2010-07-03 08:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-29 10:40 . 2010-06-29 10:42 -------- d-----w- C:\uprava fotiek
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\windows\SHELLNEW
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\program files\Microsoft.NET
2010-06-29 10:33 . 2010-06-29 10:33 -------- d-----r- C:\MSOCache
2010-06-28 18:19 . 2010-07-20 13:00 -------- d-----w- c:\program files\BSplayerPro
2010-06-28 10:21 . 2009-12-30 10:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2010-06-28 10:21 . 2010-06-29 09:55 -------- d-----w- c:\program files\VS Revo Group
2010-06-28 08:42 . 2010-06-28 08:42 -------- d-----w- c:\program files\Common Files\Java
2010-06-28 08:41 . 2010-06-28 08:41 -------- d-----w- c:\program files\Java

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 09:48 . 2010-06-02 17:50 -------- d-----r- c:\program files\Skype
2010-07-26 19:06 . 2010-06-05 20:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-07-09 22:38 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\nvudisp.exe
2010-07-09 22:38 . 2010-06-02 10:16 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 22:38 . 2010-06-02 10:16 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-07-09 22:38 . 2006-10-22 10:22 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-07-09 22:38 . 2006-10-22 10:22 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-07-07 11:46 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-07-04 13:06 . 2010-06-03 18:11 -------- d-----w- c:\program files\Internet Download Manager
2010-06-28 08:55 . 2010-06-02 17:40 -------- d-----w- c:\program files\ESET
2010-06-26 17:20 . 2010-06-26 17:18 -------- d-----w- c:\program files\LEGO Company
2010-06-20 16:52 . 2010-06-20 16:52 -------- d-----w- c:\program files\AIMP2
2010-06-19 17:10 . 2010-06-19 17:10 -------- d-----w- c:\program files\Intel
2010-06-19 17:08 . 2010-06-19 17:08 -------- d-----w- c:\program files\Uniblue
2010-06-19 14:56 . 2010-06-19 14:56 1324940 ----a-w- C:\netstumblerinstaller_0_4_0.exe
2010-06-18 16:21 . 2010-06-18 16:19 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-06-18 16:20 . 2010-06-18 16:19 -------- d-----w- c:\program files\DVDVideoSoft
2010-06-18 14:43 . 2010-06-18 14:33 -------- d-----w- c:\program files\CD to MP3 Freeware
2010-06-17 18:48 . 2010-06-17 18:47 -------- d-----w- c:\program files\iTunes
2010-06-17 18:47 . 2010-06-17 18:47 -------- d-----w- c:\program files\iPod
2010-06-17 18:47 . 2010-06-17 18:46 -------- d-----w- c:\program files\Common Files\Apple
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Apple Software Update
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Bonjour
2010-06-14 17:02 . 2010-06-13 14:45 -------- d-----w- c:\program files\nLite
2010-06-13 14:44 . 2001-10-25 12:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-06-13 14:44 . 2001-10-25 12:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 18:14 . 2010-06-07 18:14 -------- d-----w- c:\program files\Redsystem
2010-06-07 18:10 . 2010-06-07 18:05 -------- d-----w- c:\program files\radioPlayer
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Conduit
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Ashampoo
2010-06-07 11:24 . 2010-06-07 11:24 -------- d-----w- c:\program files\Elaborate Bytes
2010-06-07 09:08 . 2010-06-07 09:08 -------- d-----w- c:\program files\iMesh Applications
2010-06-05 20:48 . 2010-06-05 20:48 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-06-05 20:48 . 2010-06-05 20:48 737280 ----a-w- c:\windows\iun6002.exe
2010-06-05 20:47 . 2010-06-05 20:47 -------- d-----w- c:\program files\CyberLink
2010-06-02 19:34 . 2010-06-02 19:34 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-02 18:02 . 2010-06-02 18:02 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-06-02 17:50 . 2010-06-02 17:50 -------- d-----w- c:\program files\Common Files\Skype
2010-06-02 17:14 . 2010-06-02 17:14 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-02 10:18 . 2010-06-02 09:36 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-06-02 10:18 . 2010-06-02 09:36 2426 ----a-w- c:\windows\PCHEALTH\HELPCTR\PackageStore\SkuStore.bin
2010-06-02 10:17 . 2010-06-02 09:36 8972 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cntstore.bin
2010-06-02 09:55 . 2010-06-02 09:55 -------- d-----w- c:\program files\Common Files\LightScribe
2010-06-02 09:45 . 2010-06-02 09:45 0 ----a-w- c:\windows\nsreg.dat
2010-06-02 09:37 . 2010-06-02 09:37 -------- d-----w- c:\program files\microsoft frontpage
2010-06-02 09:34 . 2010-06-02 09:34 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-06-26 26624]
"Google Update"="c:\documents and settings\michal\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-06-29 136176]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-07-04 3037696]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-07-29 2610608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-04-09 2029640]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online\\NFE.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Panzer Elite Action\\pea.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9.4.2009 15:18 107256]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.7.2010 13:50 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 731840]
S1 EterlogicVirtualSerialDriver;EterlogicVirtualSerialDriver;\??\c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys --> c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [28.6.2010 12:21 27064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.6.2010 21:34 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-28 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-03 20:18]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\michal\Data aplikací\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Prevziať cez IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Prevziať cez IDM všetky prepojenia - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Prevziať obsah FLV cez IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatche ... 60342&qkw=
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Nektra OEAPI - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
AddRemove-Aces High - c:\hitech~1\ACESHI~1\UNWISE.EXE
AddRemove-BurnAware Free_is1 - c:\program files\BurnAware Free\unins000.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-SeaMonkey (2.0.5) - c:\program files\SeaMonkey\uninstall\helper.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-28 10:11
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3916)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Celkový čas: 2010-07-28 10:14:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-28 08:14

Před spuštěním: Volných bajtů: 77 221 822 464
Po spuštění: Volných bajtů: 77 475 442 688

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - FFE7FAFA6F5439FBB03E835A062716B2

[jaro3]

Odinstaloval bych SpywareTerminator , máš přeci ESS..

Tutto složku (program) znáš:
c:\program files\hj ??

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\system32\ezsidmv.dat
c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys

Folder::
c:\windows\system32\1029

Driver::
EterlogicVirtualSerialDriver

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000

DDS::
uInternet Settings,ProxyOverride = *.local

Firefox::
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatche ... 60342&qkw=

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[milosb]

log z combo


ComboFix 10-07-27.02 - michal 28.07.2010 11:08:34.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1699 [GMT 2:00]
Spuštěný z: c:\documents and settings\michal\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\michal\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys"
"c:\windows\system32\ezsidmv.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat
c:\windows\system32\1029 . . . . nemohl být smazán

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ETERLOGICVIRTUALSERIALDRIVER
-------\Service_EterlogicVirtualSerialDriver


((((((((((((((((((((((((( Soubory vytvořené od 2010-06-28 do 2010-07-28 )))))))))))))))))))))))))))))))
.

2010-07-27 21:21 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 21:21 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-27 21:21 . 2010-07-27 21:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 20:23 . 2010-07-27 20:23 -------- d-----w- C:\Nová složka
2010-07-27 15:01 . 2010-07-27 15:01 -------- d-----w- c:\program files\Driver Robot
2010-07-27 12:57 . 2010-07-27 13:24 -------- d-----w- c:\program files\Vstep
2010-07-27 07:50 . 2010-07-27 07:50 -------- d-----w- c:\program files\hj
2010-07-26 18:50 . 2010-07-26 18:54 -------- d-----w- c:\program files\Air Aces Pacific
2010-07-26 15:06 . 2010-07-27 22:14 -------- d-----w- c:\program files\SpeedFan
2010-07-26 12:03 . 2010-07-26 12:03 -------- d-----w- c:\windows\system32\Futuremark
2010-07-26 12:03 . 2004-10-25 18:02 21664 ----a-w- c:\windows\system32\drivers\Entech.sys
2010-07-26 12:03 . 2001-11-19 16:05 3972 ------w- c:\windows\system32\drivers\PciBus.sys
2010-07-26 12:02 . 2010-07-26 12:12 -------- d-----w- c:\program files\Futuremark
2010-07-26 09:36 . 2010-07-26 10:41 -------- d-----w- C:\Panzer Elite Action
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\AGEIA Technologies
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\windows\system32\AGEIA
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-24 21:01 . 2010-07-24 21:01 -------- d-----w- c:\program files\SSI
2010-07-24 21:00 . 2001-10-17 17:43 507904 ------w- c:\windows\Silent Hunter II remove.exe
2010-07-24 21:00 . 2000-12-15 21:58 44544 ----a-r- c:\windows\dsetup.dll
2010-07-24 21:00 . 2000-12-15 15:46 1772544 ----a-r- c:\windows\dsetup32.dll
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 19:00 . 2010-07-24 19:00 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 19:00 . 2010-07-24 19:00 -------- d-----w- c:\program files\NVIDIA Corporation
2010-07-24 18:59 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-07-24 18:59 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-07-24 18:59 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-07-24 18:59 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-07-24 18:59 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-07-24 18:59 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll
2010-07-24 17:32 . 2008-02-29 10:00 1419232 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll
2010-07-24 17:32 . 2008-02-29 09:12 35472 ----a-w- c:\windows\system32\drivers\LHidFilt.Sys
2010-07-24 16:32 . 2010-07-24 16:32 -------- d-----w- c:\program files\Stentec
2010-07-24 10:16 . 2010-07-24 10:16 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-23 18:09 . 2010-07-23 18:25 -------- d-----w- C:\foto kami
2010-07-23 17:55 . 2010-07-23 17:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-07-23 16:14 . 2010-07-23 16:14 -------- d-----w- c:\windows\Sun
2010-07-23 16:14 . 2010-07-23 16:14 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-19 11:15 . 2010-07-26 14:11 138968 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-19 11:15 . 2010-07-26 14:11 214592 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-19 11:14 . 2010-07-19 11:14 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\windows\system32\LogFiles
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\program files\EA Sports
2010-07-18 15:28 . 2010-07-18 15:28 -------- d-----w- C:\EVEREST Ultimate Edition 5.00.1652
2010-07-10 17:37 . 2010-07-10 17:37 -------- d-----w- c:\documents and settings\michal\dwhelper
2010-07-10 14:55 . 2010-07-12 16:12 -------- d-----w- c:\windows\system32\Adobe
2010-07-09 19:47 . 2010-07-09 19:47 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-03 17:52 . 2010-07-04 11:03 -------- d-----w- c:\program files\Yamicsoft
2010-07-03 13:08 . 2004-05-04 10:53 1645320 ----a-w- c:\windows\system32\gdiplus.dll
2010-07-03 08:25 . 2010-07-03 08:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-29 10:40 . 2010-06-29 10:42 -------- d-----w- C:\uprava fotiek
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\windows\SHELLNEW
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\program files\Microsoft.NET
2010-06-29 10:33 . 2010-06-29 10:33 -------- d-----r- C:\MSOCache
2010-06-28 18:19 . 2010-07-20 13:00 -------- d-----w- c:\program files\BSplayerPro
2010-06-28 10:21 . 2009-12-30 10:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2010-06-28 10:21 . 2010-06-29 09:55 -------- d-----w- c:\program files\VS Revo Group

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 09:48 . 2010-06-02 17:50 -------- d-----r- c:\program files\Skype
2010-07-26 19:06 . 2010-06-05 20:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-07-09 22:38 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\nvudisp.exe
2010-07-09 22:38 . 2010-06-02 10:16 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 22:38 . 2010-06-02 10:16 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-07-09 22:38 . 2006-10-22 10:22 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-07-09 22:38 . 2006-10-22 10:22 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-07-07 11:46 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-07-04 13:06 . 2010-06-03 18:11 -------- d-----w- c:\program files\Internet Download Manager
2010-06-28 08:55 . 2010-06-02 17:40 -------- d-----w- c:\program files\ESET
2010-06-28 08:42 . 2010-06-28 08:42 -------- d-----w- c:\program files\Common Files\Java
2010-06-28 08:41 . 2010-06-28 08:41 -------- d-----w- c:\program files\Java
2010-06-26 17:20 . 2010-06-26 17:18 -------- d-----w- c:\program files\LEGO Company
2010-06-20 16:52 . 2010-06-20 16:52 -------- d-----w- c:\program files\AIMP2
2010-06-19 17:10 . 2010-06-19 17:10 -------- d-----w- c:\program files\Intel
2010-06-19 17:08 . 2010-06-19 17:08 -------- d-----w- c:\program files\Uniblue
2010-06-19 14:56 . 2010-06-19 14:56 1324940 ----a-w- C:\netstumblerinstaller_0_4_0.exe
2010-06-18 16:21 . 2010-06-18 16:19 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-06-18 16:20 . 2010-06-18 16:19 -------- d-----w- c:\program files\DVDVideoSoft
2010-06-18 14:43 . 2010-06-18 14:33 -------- d-----w- c:\program files\CD to MP3 Freeware
2010-06-17 18:48 . 2010-06-17 18:47 -------- d-----w- c:\program files\iTunes
2010-06-17 18:47 . 2010-06-17 18:47 -------- d-----w- c:\program files\iPod
2010-06-17 18:47 . 2010-06-17 18:46 -------- d-----w- c:\program files\Common Files\Apple
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Apple Software Update
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Bonjour
2010-06-14 17:02 . 2010-06-13 14:45 -------- d-----w- c:\program files\nLite
2010-06-13 14:44 . 2001-10-25 12:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-06-13 14:44 . 2001-10-25 12:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 18:14 . 2010-06-07 18:14 -------- d-----w- c:\program files\Redsystem
2010-06-07 18:10 . 2010-06-07 18:05 -------- d-----w- c:\program files\radioPlayer
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Conduit
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Ashampoo
2010-06-07 11:24 . 2010-06-07 11:24 -------- d-----w- c:\program files\Elaborate Bytes
2010-06-07 09:08 . 2010-06-07 09:08 -------- d-----w- c:\program files\iMesh Applications
2010-06-05 20:48 . 2010-06-05 20:48 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-06-05 20:48 . 2010-06-05 20:48 737280 ----a-w- c:\windows\iun6002.exe
2010-06-05 20:47 . 2010-06-05 20:47 -------- d-----w- c:\program files\CyberLink
2010-06-02 19:34 . 2010-06-02 19:34 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-02 17:50 . 2010-06-02 17:50 -------- d-----w- c:\program files\Common Files\Skype
2010-06-02 17:14 . 2010-06-02 17:14 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-02 10:18 . 2010-06-02 09:36 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-06-02 10:18 . 2010-06-02 09:36 2426 ----a-w- c:\windows\PCHEALTH\HELPCTR\PackageStore\SkuStore.bin
2010-06-02 10:17 . 2010-06-02 09:36 8972 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cntstore.bin
2010-06-02 09:55 . 2010-06-02 09:55 -------- d-----w- c:\program files\Common Files\LightScribe
2010-06-02 09:45 . 2010-06-02 09:45 0 ----a-w- c:\windows\nsreg.dat
2010-06-02 09:37 . 2010-06-02 09:37 -------- d-----w- c:\program files\microsoft frontpage
2010-06-02 09:34 . 2010-06-02 09:34 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-07-28_08.10.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-28 09:13 . 2010-07-28 09:13 16384 c:\windows\temp\Perflib_Perfdata_140.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-06-26 26624]
"Google Update"="c:\documents and settings\michal\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-06-29 136176]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-07-29 2610608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-04-09 2029640]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online\\NFE.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Panzer Elite Action\\pea.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9.4.2009 15:18 107256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 731840]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [28.6.2010 12:21 27064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.6.2010 21:34 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-28 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-03 20:18]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\michal\Data aplikací\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Prevziať cez IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Prevziať cez IDM všetky prepojenia - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Prevziať obsah FLV cez IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-28 11:13
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xF7637000]<< >>UNKNOWN [0xF7627000]<< >>UNKNOWN [0xF749A000]<< >>UNKNOWN [0x806ED000]<< >>UNKNOWN [0xF7A4F000]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf763bfc3
\Driver\ACPI -> 0xf75aecb8
\Driver\atapi -> 0xf74a07b4
IoDeviceObjectType -> DeleteProcedure -> 0x805a18f6
ParseProcedure -> 0x8056f26d
\Device\Harddisk0\DR0 -> DeleteProcedure -> 0x805a18f6
ParseProcedure -> 0x8056f26d
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> 0xf743aba0
PacketIndicateHandler -> 0xf7447b21
SendHandler -> 0xf742587b
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3088)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\windows\system32\msi.dll
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\windows\System32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-07-28 11:15:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-28 09:15

Před spuštěním: Volných bajtů: 77 426 548 736
Po spuštění: Volných bajtů: 77 417 381 888

- - End Of File - - 2154668BD0A7D39809F6AA87231794E4

[milosb]

log z malware



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4359

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

28.7.2010 11:23:17
mbam-log-2010-07-28 (11-23-17).txt

Typ skenu: Rychlý sken
Skenované objekty: 123747
Uplynulý čas: 4 minuta(y), 42 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[jaro3]

Mám pocit , že combofix smazal něco , co neměl...bude to chyba Combofixu.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KILLALL::

DeQuarantine::

C:\Qoobox\Quarantine\C\WINDOWS\system32\1029\dwintl.dll.vir

Quit::

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\1029\dwintl.dll

Pokud už byl soubor testován-klikni na otestovat znovu.
Až skončí test všech antivirů, vlož sem pak odkaz na stránku s výsledky.

Pozn.: VirusTotal má výpadek , použij:
http://www.virscan.org/

[milosb]

po poslednom teste combofixu som sa nemohol pripojiť na net.dal som bod obnovy.idem si pre istotu napaliť nejake zložky a fotky keby som niečo pokazil a musel preinštal win.tak sa odmlčím na pár minut.ok?

[milosb]

môžeme ísť na to.čo ďalej?

[jaro3]

Bodem obnovy si se zase vrátil možná na začátek. Obvykle stačí , po combofixu , když jsou nějaké potíže 1-3 restartovat PC.

Udělej normální Combofix , bez scriptu, předtím ale znovu MbAM.

[milosb]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4359

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

28.7.2010 14:04:49
mbam-log-2010-07-28 (14-04-49).txt

Typ skenu: Rychlý sken
Skenované objekty: 124025
Uplynulý čas: 5 minuta(y), 2 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[milosb]

ComboFix 10-07-27.04 - michal 28.07.2010 14:19:49.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1569 [GMT 2:00]
Spuštěný z: c:\documents and settings\michal\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-06-28 do 2010-07-28 )))))))))))))))))))))))))))))))
.

2010-07-28 10:02 . 2010-07-28 10:02 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-28 10:02 . 2010-07-28 11:47 -------- d-----w- c:\program files\WinClamAVShield
2010-07-28 10:02 . 2010-07-28 10:02 -------- d-----w- c:\program files\Spyware Terminator
2010-07-28 09:41 . 2010-07-28 10:02 -------- d-----w- C:\ComboFix(2)
2010-07-28 09:25 . 2010-07-28 10:02 -------- d-----w- C:\RECYCLER(2)
2010-07-27 21:21 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 21:21 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-27 21:21 . 2010-07-27 21:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 15:01 . 2010-07-27 15:01 -------- d-----w- c:\program files\Driver Robot
2010-07-27 12:57 . 2010-07-27 13:24 -------- d-----w- c:\program files\Vstep
2010-07-27 07:50 . 2010-07-27 07:50 -------- d-----w- c:\program files\hj
2010-07-26 18:50 . 2010-07-26 18:54 -------- d-----w- c:\program files\Air Aces Pacific
2010-07-26 15:06 . 2010-07-27 22:14 -------- d-----w- c:\program files\SpeedFan
2010-07-26 12:03 . 2010-07-26 12:03 -------- d-----w- c:\windows\system32\Futuremark
2010-07-26 12:03 . 2004-10-25 18:02 21664 ----a-w- c:\windows\system32\drivers\Entech.sys
2010-07-26 12:03 . 2001-11-19 16:05 3972 ------w- c:\windows\system32\drivers\PciBus.sys
2010-07-26 12:02 . 2010-07-26 12:12 -------- d-----w- c:\program files\Futuremark
2010-07-26 09:36 . 2010-07-26 10:41 -------- d-----w- C:\Panzer Elite Action
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\AGEIA Technologies
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\windows\system32\AGEIA
2010-07-25 19:24 . 2010-07-25 19:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-24 21:01 . 2010-07-24 21:01 -------- d-----w- c:\program files\SSI
2010-07-24 21:00 . 2001-10-17 17:43 507904 ------w- c:\windows\Silent Hunter II remove.exe
2010-07-24 21:00 . 2000-12-15 21:58 44544 ----a-r- c:\windows\dsetup.dll
2010-07-24 21:00 . 2000-12-15 15:46 1772544 ----a-r- c:\windows\dsetup32.dll
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 19:00 . 2010-07-24 19:00 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 19:00 . 2010-07-24 19:00 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 19:00 . 2010-07-24 19:00 -------- d-----w- c:\program files\NVIDIA Corporation
2010-07-24 18:59 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-07-24 18:59 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-07-24 18:59 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-07-24 18:59 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-07-24 18:59 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-07-24 18:59 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2010-07-24 17:32 . 2001-08-18 04:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2010-07-24 17:32 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll
2010-07-24 17:32 . 2008-02-29 10:00 1419232 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll
2010-07-24 17:32 . 2008-02-29 09:12 35472 ----a-w- c:\windows\system32\drivers\LHidFilt.Sys
2010-07-24 16:32 . 2010-07-24 16:32 -------- d-----w- c:\program files\Stentec
2010-07-23 18:09 . 2010-07-23 18:25 -------- d-----w- C:\foto kami
2010-07-23 17:55 . 2010-07-23 17:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-07-23 16:14 . 2010-07-23 16:14 -------- d-----w- c:\windows\Sun
2010-07-23 16:14 . 2010-07-23 16:14 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-19 11:15 . 2010-07-26 14:11 138968 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-19 11:15 . 2010-07-26 14:11 214592 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-19 11:14 . 2010-07-19 11:14 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\windows\system32\LogFiles
2010-07-18 19:32 . 2010-07-18 19:32 -------- d-----w- c:\program files\EA Sports
2010-07-18 15:28 . 2010-07-18 15:28 -------- d-----w- C:\EVEREST Ultimate Edition 5.00.1652
2010-07-10 17:37 . 2010-07-10 17:37 -------- d-----w- c:\documents and settings\michal\dwhelper
2010-07-10 14:55 . 2010-07-12 16:12 -------- d-----w- c:\windows\system32\Adobe
2010-07-09 19:47 . 2010-07-09 19:47 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-04 11:50 . 2010-07-04 11:50 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-03 17:52 . 2010-07-04 11:03 -------- d-----w- c:\program files\Yamicsoft
2010-07-03 13:08 . 2004-05-04 10:53 1645320 ----a-w- c:\windows\system32\gdiplus.dll
2010-07-03 08:25 . 2010-07-03 08:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-29 10:40 . 2010-06-29 10:42 -------- d-----w- C:\uprava fotiek
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\windows\SHELLNEW
2010-06-29 10:35 . 2010-06-29 10:35 -------- d-----w- c:\program files\Microsoft.NET
2010-06-29 10:33 . 2010-06-29 10:33 -------- d-----r- C:\MSOCache
2010-06-28 18:19 . 2010-07-20 13:00 -------- d-----w- c:\program files\BSplayerPro

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 09:48 . 2010-06-02 17:50 -------- d-----r- c:\program files\Skype
2010-07-26 19:06 . 2010-06-05 20:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-07-24 17:33 . 2010-07-24 17:33 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-07-09 22:38 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\nvudisp.exe
2010-07-09 22:38 . 2010-06-02 10:16 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 22:38 . 2010-06-02 10:16 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-07-09 22:38 . 2006-10-22 10:22 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-07-09 22:38 . 2006-10-22 10:22 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-07-09 22:38 . 2006-10-22 10:22 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-07-07 11:46 . 2010-06-02 17:14 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-07-04 13:06 . 2010-06-03 18:11 -------- d-----w- c:\program files\Internet Download Manager
2010-06-29 09:55 . 2010-06-28 10:21 -------- d-----w- c:\program files\VS Revo Group
2010-06-28 08:55 . 2010-06-02 17:40 -------- d-----w- c:\program files\ESET
2010-06-28 08:42 . 2010-06-28 08:42 -------- d-----w- c:\program files\Common Files\Java
2010-06-28 08:41 . 2010-06-28 08:41 -------- d-----w- c:\program files\Java
2010-06-26 17:20 . 2010-06-26 17:18 -------- d-----w- c:\program files\LEGO Company
2010-06-20 16:52 . 2010-06-20 16:52 -------- d-----w- c:\program files\AIMP2
2010-06-19 17:10 . 2010-06-19 17:10 -------- d-----w- c:\program files\Intel
2010-06-19 17:08 . 2010-06-19 17:08 -------- d-----w- c:\program files\Uniblue
2010-06-19 14:56 . 2010-06-19 14:56 1324940 ----a-w- C:\netstumblerinstaller_0_4_0.exe
2010-06-18 16:21 . 2010-06-18 16:19 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-06-18 16:20 . 2010-06-18 16:19 -------- d-----w- c:\program files\DVDVideoSoft
2010-06-18 14:43 . 2010-06-18 14:33 -------- d-----w- c:\program files\CD to MP3 Freeware
2010-06-17 18:48 . 2010-06-17 18:47 -------- d-----w- c:\program files\iTunes
2010-06-17 18:47 . 2010-06-17 18:47 -------- d-----w- c:\program files\iPod
2010-06-17 18:47 . 2010-06-17 18:46 -------- d-----w- c:\program files\Common Files\Apple
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Apple Software Update
2010-06-17 18:46 . 2010-06-17 18:46 -------- d-----w- c:\program files\Bonjour
2010-06-14 17:02 . 2010-06-13 14:45 -------- d-----w- c:\program files\nLite
2010-06-13 14:44 . 2001-10-25 12:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-06-13 14:44 . 2001-10-25 12:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 18:14 . 2010-06-07 18:14 -------- d-----w- c:\program files\Redsystem
2010-06-07 18:10 . 2010-06-07 18:05 -------- d-----w- c:\program files\radioPlayer
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Conduit
2010-06-07 12:26 . 2010-06-07 12:26 -------- d-----w- c:\program files\Ashampoo
2010-06-07 11:24 . 2010-06-07 11:24 -------- d-----w- c:\program files\Elaborate Bytes
2010-06-07 09:08 . 2010-06-07 09:08 -------- d-----w- c:\program files\iMesh Applications
2010-06-05 20:48 . 2010-06-05 20:48 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-06-05 20:48 . 2010-06-05 20:48 737280 ----a-w- c:\windows\iun6002.exe
2010-06-05 20:47 . 2010-06-05 20:47 -------- d-----w- c:\program files\CyberLink
2010-06-02 19:34 . 2010-06-02 19:34 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-02 17:50 . 2010-06-02 17:50 -------- d-----w- c:\program files\Common Files\Skype
2010-06-02 17:14 . 2010-06-02 17:14 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-02 10:18 . 2010-06-02 09:36 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-06-02 10:18 . 2010-06-02 09:36 2426 ----a-w- c:\windows\PCHEALTH\HELPCTR\PackageStore\SkuStore.bin
2010-06-02 10:17 . 2010-06-02 09:36 8972 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cntstore.bin
2010-06-02 09:55 . 2010-06-02 09:55 -------- d-----w- c:\program files\Common Files\LightScribe
2010-06-02 09:45 . 2010-06-02 09:45 0 ----a-w- c:\windows\nsreg.dat
2010-06-02 09:37 . 2010-06-02 09:37 -------- d-----w- c:\program files\microsoft frontpage
2010-06-02 09:34 . 2010-06-02 09:34 21812 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-07-28_08.10.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-28 12:07 . 2010-07-28 12:07 16384 c:\windows\temp\Perflib_Perfdata_5ac.dat
+ 2010-07-28 09:12 . 2010-07-28 09:12 8192 c:\windows\ERDNT\subs(2)\Users(2)\00000004(2)\UsrClass.dat
+ 2010-07-28 09:12 . 2010-07-28 09:12 8192 c:\windows\ERDNT\subs(2)\Users(2)\00000002(2)\UsrClass.dat
+ 2010-06-28 09:01 . 2010-07-28 10:02 405852 c:\windows\system32\Restore\rstrlog.dat
+ 2010-07-28 09:12 . 2010-07-28 09:12 229376 c:\windows\ERDNT\subs(2)\Users(2)\00000006(2)\UsrClass.dat
+ 2010-07-28 09:12 . 2010-07-28 09:12 241664 c:\windows\ERDNT\subs(2)\Users(2)\00000003(2)\NTUSER.DAT
+ 2010-07-28 09:12 . 2010-07-28 09:12 241664 c:\windows\ERDNT\subs(2)\Users(2)\00000001(2)\NTUSER.DAT
+ 2010-07-28 09:12 . 2010-07-28 09:12 4104192 c:\windows\ERDNT\subs(2)\Users(2)\00000005(2)\ntuser.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-06-26 26624]
"Google Update"="c:\documents and settings\michal\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-06-29 136176]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-07-04 3037696]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-07-29 2610608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-04-09 2029640]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online\\NFE.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Panzer Elite Action\\pea.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9.4.2009 15:18 107256]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.7.2010 13:50 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 731840]
S1 EterlogicVirtualSerialDriver;EterlogicVirtualSerialDriver;\??\c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys --> c:\docume~1\michal\LOCALS~1\Temp\VSPE.sys [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [28.6.2010 12:21 27064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.6.2010 21:34 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-28 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-03 20:18]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\michal\Data aplikací\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Prevziať cez IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Prevziať cez IDM všetky prepojenia - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Prevziať obsah FLV cez IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\t9uih8of.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-28 14:22
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3164)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\windows\system32\msi.dll
.
Celkový čas: 2010-07-28 14:24:25
ComboFix-quarantined-files.txt 2010-07-28 12:24

Před spuštěním: Volných bajtů: 77 227 245 568
Po spuštění: Volných bajtů: 77 217 878 016

- - End Of File - - 29521555B625BF273D0DA9AB25BEC81F

[jaro3]

Tuto složku (program) znáš:
c:\program files\hj ??


Odinstaluj:
Spyware Terminator


Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\temp\Perflib_Perfdata_5ac.dat

Driver::
EterlogicVirtualSerialDriver

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000

DDS::
uInternet Settings,ProxyOverride = *.local

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT