prosim o kontrolu logu Vyřešeno

[milosb]

ahoj.prepáč, včera som nijako nestíhal.tak tu je ten log z combofixu

ComboFix 10-09-24.05 - michal . 09. 2010 16:03:19.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.2047.1543 [GMT 2:00]
Running from: c:\documents and settings\michal\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-08-25 to 2010-09-25 )))))))))))))))))))))))))))))))
.

2010-09-24 19:59 . 2010-09-24 21:06 -------- d-----w- c:\program files\GameKiss
2010-09-24 14:27 . 2010-09-24 14:27 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-09-23 19:29 . 2010-09-23 19:29 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-09-23 19:29 . 2010-09-25 14:00 -------- d-----w- c:\program files\Spyware Terminator
2010-09-23 18:48 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-23 18:48 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-23 18:48 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-23 18:48 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-23 18:48 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-23 18:48 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-23 18:48 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-23 18:48 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-23 18:48 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-23 18:48 . 2010-09-23 18:48 -------- d-----w- c:\program files\Alwil Software
2010-09-23 16:58 . 2010-09-22 16:21 62976 ----a-w- c:\windows\system32\dllcache\cdrom.sys
2010-09-23 15:22 . 2010-09-23 15:22 7168 ----a-w- c:\windows\system32\drivers\utqyntk1.sys
2010-09-23 09:43 . 2010-09-23 18:26 -------- d-----w- C:\filmy
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\wbem\snmp
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\xircom
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\program files\microsoft frontpage
2010-09-22 18:16 . 2010-09-22 16:21 62976 ------w- c:\windows\system32\drivers\cdrom.sys
2010-09-21 19:39 . 2010-09-21 19:39 -------- d-----w- c:\program files\Uniblue
2010-09-21 12:20 . 2010-09-21 12:20 -------- d-----w- c:\program files\HD Tune
2010-09-21 09:02 . 2010-09-21 09:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-21 08:28 . 2008-04-14 06:52 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
2010-09-21 07:51 . 2010-09-21 07:51 -------- d-sh--w- c:\documents and settings\michal\PrivacIE
2010-09-21 06:34 . 2010-09-21 06:34 -------- d-----w- c:\program files\Winamp Detect
2010-09-21 03:43 . 2010-09-21 03:43 -------- d-sh--w- c:\documents and settings\michal\IETldCache
2010-09-20 13:37 . 2010-09-20 13:38 -------- d-----w- c:\windows\ie8updates
2010-09-20 13:35 . 2010-09-20 13:37 -------- dc-h--w- c:\windows\ie8
2010-09-20 08:44 . 2010-09-20 08:44 -------- d--h--w- c:\windows\PIF
2010-09-19 18:48 . 2010-09-20 08:05 96 ---ha-w- c:\windows\system32\HsInfo.dat
2010-09-19 16:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-19 16:06 . 2010-09-22 16:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-19 16:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-19 15:28 . 2010-09-19 15:28 -------- d-----w- c:\program files\Trend Micro
2010-09-18 19:55 . 2010-09-18 19:55 -------- d-----w- c:\program files\CCleaner
2010-09-18 17:20 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-09-18 17:20 . 2010-07-09 22:38 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-09-18 17:20 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-09-18 17:20 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-09-18 17:20 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-09-18 17:20 . 2010-07-09 22:38 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-09-18 17:20 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-09-18 17:20 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-09-18 10:19 . 2010-09-20 10:32 -------- d-----w- c:\windows\system32\Adobe
2010-09-17 18:34 . 2010-09-17 18:44 -------- d-----w- c:\windows\SxsCaPendDel
2010-09-16 17:35 . 2010-09-16 17:35 -------- d-----w- c:\program files\8BallClub
2010-09-15 18:28 . 2005-01-12 09:19 456536 ----a-w- c:\windows\system32\XCEEDZIP.DLL
2010-09-15 18:28 . 2004-09-28 09:13 526184 ----a-w- c:\windows\system32\XceedCry.dll
2010-09-15 18:21 . 2010-09-15 18:21 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-09-15 18:11 . 2010-09-18 17:21 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-09-15 18:11 . 2010-09-18 17:22 -------- d-----w- c:\program files\NVIDIA Corporation
2010-09-15 16:51 . 2004-08-11 13:55 110602 ----a-w- c:\windows\system32\xcdsfx32.bin
2010-09-15 16:51 . 2010-09-15 18:29 -------- d-----w- c:\program files\Driver Magician
2010-09-15 14:09 . 2010-09-15 14:09 -------- d-----w- c:\program files\Common Files\DirectX
2010-09-14 20:45 . 2010-09-24 19:59 -------- d-----w- C:\moje
2010-09-14 20:44 . 2010-09-14 20:44 -------- d-----w- c:\program files\Conduit
2010-09-14 19:39 . 2010-09-14 19:40 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-14 18:25 . 2009-11-18 17:33 79256 ----a-w- c:\windows\system32\npOGPPlugin.dll
2010-09-14 18:25 . 2004-01-12 15:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-14 18:25 . 2003-03-19 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-09-14 18:24 . 2010-09-19 18:28 -------- d-----w- c:\program files\Ogplanet
2010-09-14 17:41 . 2002-10-06 18:42 237568 ----a-w- c:\windows\system32\OggDS.dll
2010-09-14 17:41 . 2002-10-04 23:04 921600 ----a-w- c:\windows\system32\vorbisenc.dll
2010-09-14 17:41 . 2002-10-04 23:04 188416 ----a-w- c:\windows\system32\vorbis.dll
2010-09-14 17:41 . 2002-10-04 23:04 45056 ----a-w- c:\windows\system32\ogg.dll
2010-09-14 17:22 . 2010-06-18 11:39 16896 ------w- c:\windows\system32\dllcache\iecompat.dll
2010-09-14 17:22 . 2010-06-24 12:27 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-14 17:22 . 2010-06-24 12:27 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-09-14 17:22 . 2010-06-24 12:27 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-09-14 15:09 . 2010-09-16 18:33 -------- d-----w- C:\PCTRAN
2010-09-14 14:22 . 2010-03-10 06:17 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2010-09-14 14:20 . 2010-06-21 14:18 354304 ------w- c:\windows\system32\dllcache\srv.sys
2010-09-14 14:20 . 2009-05-21 18:49 268288 ------w- c:\windows\system32\dllcache\httpext.dll
2010-09-14 14:20 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-14 14:16 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-09-14 14:16 . 2009-03-06 14:23 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2010-09-14 14:16 . 2009-02-09 11:25 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-09-14 14:16 . 2009-02-09 10:56 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-09-14 14:16 . 2009-02-09 10:56 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-09-14 14:16 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe
2010-09-14 14:16 . 2009-02-09 10:56 684032 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-09-14 14:16 . 2009-02-09 10:56 709632 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-09-14 14:16 . 2009-02-09 10:56 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-09-14 14:15 . 2010-04-28 05:19 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-09-14 14:15 . 2010-04-28 05:19 2192256 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-09-14 14:15 . 2010-04-28 05:19 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-09-14 14:13 . 2009-03-21 14:09 988160 ------w- c:\windows\system32\dllcache\kernel32.dll
2010-09-14 14:13 . 2008-05-09 10:56 180224 ------w- c:\windows\system32\dllcache\scrobj.dll
2010-09-14 14:13 . 2008-05-09 10:56 172032 ------w- c:\windows\system32\dllcache\scrrun.dll
2010-09-14 14:13 . 2008-05-09 10:56 90112 ------w- c:\windows\system32\dllcache\wshext.dll
2010-09-14 14:13 . 2008-05-09 08:45 135168 ------w- c:\windows\system32\dllcache\cscript.exe
2010-09-14 14:13 . 2008-05-08 11:24 155648 ------w- c:\windows\system32\dllcache\wscript.exe
2010-09-14 14:10 . 2010-02-12 04:29 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll
2010-09-14 14:10 . 2010-02-11 11:36 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys
2010-09-14 14:10 . 2009-08-26 08:03 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2010-09-14 14:10 . 2009-05-07 15:33 346624 ------w- c:\windows\system32\dllcache\localspl.dll
2010-09-14 14:10 . 2010-06-24 21:30 1861120 ------w- c:\windows\system32\dllcache\win32k.sys
2010-09-14 14:05 . 2010-07-27 06:30 8466432 ------w- c:\windows\system32\dllcache\shell32.dll
2010-09-14 14:05 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-09-14 14:05 . 2008-04-21 21:15 216576 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-09-14 14:04 . 2010-04-20 05:32 285696 ------w- c:\windows\system32\dllcache\atmfd.dll
2010-09-14 14:02 . 2009-01-07 16:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-14 13:28 . 2008-06-12 14:24 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll
2010-09-14 13:28 . 2008-06-12 14:24 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll
2010-09-14 13:28 . 2008-06-12 14:24 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll
2010-09-14 13:28 . 2008-06-12 14:24 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll
2010-09-14 13:28 . 2008-06-12 14:24 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll
2010-09-14 13:27 . 2009-12-17 07:42 343552 ------w- c:\windows\system32\dllcache\mspaint.exe
2010-09-14 13:12 . 2010-09-14 13:27 -------- d-----w- c:\program files\Internet Download Manager
2010-09-14 13:08 . 2010-02-05 18:29 1294336 ------w- c:\windows\system32\dllcache\quartz.dll
2010-09-14 13:05 . 2010-02-24 11:57 457216 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-09-14 13:05 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-09-14 13:02 . 2009-10-15 16:32 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-09-14 13:02 . 2009-10-15 16:32 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-09-14 13:01 . 2008-05-01 14:37 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2010-09-14 13:00 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-09-14 13:00 . 2009-12-09 05:55 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 06:34 . 2010-09-21 06:33 -------- d-----w- c:\program files\Winamp
2010-09-20 12:28 . 2010-09-14 11:07 -------- d-----w- c:\program files\Windows Media Connect 2
2010-09-18 19:32 . 2010-09-14 11:23 -------- d-----w- c:\program files\Common Files\InstallShield
2010-09-15 15:38 . 2010-09-15 14:51 -------- d-----w- c:\program files\Crspace
2010-09-15 13:18 . 2010-09-14 11:11 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-09-15 13:18 . 2010-09-14 11:11 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-09-15 13:17 . 2010-09-14 11:11 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-09-14 20:26 . 2010-09-14 11:52 -------- d-----w- c:\program files\Webteh
2010-09-14 15:25 . 2010-09-14 12:23 -------- d-----w- c:\program files\Ashampoo
2010-09-14 13:25 . 2010-09-14 12:54 -------- d-----w- c:\program files\Futuremark
2010-09-14 12:06 . 2010-09-14 12:05 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-09-14 11:50 . 2010-09-14 11:50 -------- d-----w- c:\program files\AIMP2
2010-09-14 11:47 . 2010-09-14 11:46 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-09-14 11:46 . 2010-09-14 11:46 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-14 11:43 . 2010-09-14 11:43 -------- d-----w- c:\program files\VS Revo Group
2010-09-14 11:36 . 2010-09-14 11:34 -------- d-----w- c:\program files\Google
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----w- c:\program files\Common Files\Skype
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----r- c:\program files\Skype
2010-09-14 11:27 . 2010-09-14 11:27 0 ----a-w- c:\windows\nsreg.dat
2010-09-14 11:08 . 2010-09-14 11:08 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-12 08:00 . 2010-09-14 12:05 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-09 22:38 . 2006-06-23 14:49 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-06-23 14:49 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-06-30 12:33 . 2008-04-14 06:51 149504 ----a-w- c:\windows\system32\schannel.dll
.

------- Sigcheck -------

[-] 2009-02-14 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-09-14 26624]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-05-26 3220912]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-09-23 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-09-23 2176512]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\8BallClub\\GameDirector.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8500:TCP"= 8500:TCP:HockeyDash
"13000:UDP"= 13000:UDP:HockeyDash

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23. 9. 2010 20:48 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [23. 9. 2010 21:29 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23. 9. 2010 20:48 17744]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14. 9. 2010 13:34 136176]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [14. 9. 2010 13:43 27064]
S3 utqyntk1;AVZ Kernel Driver;c:\windows\system32\drivers\utqyntk1.sys [23. 9. 2010 17:22 7168]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14. 9. 2010 13:46 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\p9kzbdip.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\windows\system32\npOGPPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 16:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\d62ae326-5297-65e9-0032-a638e61e82d]
@Denied: (Full) (AuthenticatedUsers)
@Denied: (Full) (Administrators)
"1w3ihl1oevhiy"=hex:37,36,62,65,61,38,30,31,2d,66,30,31,33,2d,34,65,37,32,2d,
62,39,38,61,2d,33,35,38,35,35,38,66,37,30,65,32,65
"19mzum9p92zx3"=hex:65,00,00,00,f8,00,00,00,cd,8e,a2,be,36,36,36,6d,69,6c,6f,
73,00,00,00,00,00,00,00,00,01,a8,be,76,13,f0,72,4e,b9,8a,35,85,58,f7,0e,2e,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3152)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-09-25 16:07:05
ComboFix-quarantined-files.txt 2010-09-25 14:07

Pre-Run: Volných bajtů: 122 873 942 016
Post-Run: Volných bajtů: 122 908 827 648

- - End Of File - - 5E44CE6CC062EBDE9DAEBEEB5457DFF0

[Reklama]

[jaro3]

Tohle je sken Combofixu , potřebuji s tím scriptem na předešlé stránce..

[milosb]

ComboFix 10-09-25.01 - michal . 09. 2010 20:13:06.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.2047.1531 [GMT 2:00]
Running from: c:\documents and settings\michal\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\michal\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\system32\drivers\3571411.sys"
"c:\windows\system32\drivers\35714111.sys"
"c:\windows\system32\drivers\35714112.sys"
"c:\windows\system32\drivers\utqyntk1.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SxsCaPendDel
c:\windows\system32\drivers\utqyntk1.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_35714111
-------\Legacy_35714112
-------\Legacy_SETUP_9.0.0.722_23.09.2010_14-26DRV
-------\Legacy_UTQYNTK1
-------\Service_utqyntk1


((((((((((((((((((((((((( Files Created from 2010-08-25 to 2010-09-25 )))))))))))))))))))))))))))))))
.

2010-09-24 19:59 . 2010-09-24 21:06 -------- d-----w- c:\program files\GameKiss
2010-09-24 14:27 . 2010-09-24 14:27 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-09-23 19:29 . 2010-09-23 19:29 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-09-23 19:29 . 2010-09-25 14:00 -------- d-----w- c:\program files\Spyware Terminator
2010-09-23 18:48 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-23 18:48 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-23 18:48 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-23 18:48 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-23 18:48 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-23 18:48 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-23 18:48 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-23 18:48 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-23 18:48 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-23 18:48 . 2010-09-23 18:48 -------- d-----w- c:\program files\Alwil Software
2010-09-23 16:58 . 2010-09-22 16:21 62976 ----a-w- c:\windows\system32\dllcache\cdrom.sys
2010-09-23 09:43 . 2010-09-23 18:26 -------- d-----w- C:\filmy
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\wbem\snmp
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\xircom
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\program files\microsoft frontpage
2010-09-22 18:16 . 2010-09-22 16:21 62976 ------w- c:\windows\system32\drivers\cdrom.sys
2010-09-21 19:39 . 2010-09-21 19:39 -------- d-----w- c:\program files\Uniblue
2010-09-21 12:20 . 2010-09-21 12:20 -------- d-----w- c:\program files\HD Tune
2010-09-21 09:02 . 2010-09-21 09:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-21 08:28 . 2008-04-14 06:52 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
2010-09-21 07:51 . 2010-09-21 07:51 -------- d-sh--w- c:\documents and settings\michal\PrivacIE
2010-09-21 06:34 . 2010-09-21 06:34 -------- d-----w- c:\program files\Winamp Detect
2010-09-21 03:43 . 2010-09-21 03:43 -------- d-sh--w- c:\documents and settings\michal\IETldCache
2010-09-20 13:37 . 2010-09-20 13:38 -------- d-----w- c:\windows\ie8updates
2010-09-20 13:35 . 2010-09-20 13:37 -------- dc-h--w- c:\windows\ie8
2010-09-20 08:44 . 2010-09-20 08:44 -------- d--h--w- c:\windows\PIF
2010-09-19 18:48 . 2010-09-20 08:05 96 ---ha-w- c:\windows\system32\HsInfo.dat
2010-09-19 16:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-19 16:06 . 2010-09-22 16:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-19 16:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-19 15:28 . 2010-09-19 15:28 -------- d-----w- c:\program files\Trend Micro
2010-09-18 19:55 . 2010-09-18 19:55 -------- d-----w- c:\program files\CCleaner
2010-09-18 17:20 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-09-18 17:20 . 2010-07-09 22:38 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-09-18 17:20 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-09-18 17:20 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-09-18 17:20 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-09-18 17:20 . 2010-07-09 22:38 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-09-18 17:20 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-09-18 17:20 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-09-18 10:19 . 2010-09-20 10:32 -------- d-----w- c:\windows\system32\Adobe
2010-09-16 17:35 . 2010-09-16 17:35 -------- d-----w- c:\program files\8BallClub
2010-09-15 18:28 . 2005-01-12 09:19 456536 ----a-w- c:\windows\system32\XCEEDZIP.DLL
2010-09-15 18:28 . 2004-09-28 09:13 526184 ----a-w- c:\windows\system32\XceedCry.dll
2010-09-15 18:21 . 2010-09-15 18:21 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-09-15 18:11 . 2010-09-18 17:21 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-09-15 18:11 . 2010-09-18 17:22 -------- d-----w- c:\program files\NVIDIA Corporation
2010-09-15 16:51 . 2004-08-11 13:55 110602 ----a-w- c:\windows\system32\xcdsfx32.bin
2010-09-15 16:51 . 2010-09-15 18:29 -------- d-----w- c:\program files\Driver Magician
2010-09-15 14:09 . 2010-09-15 14:09 -------- d-----w- c:\program files\Common Files\DirectX
2010-09-14 20:45 . 2010-09-24 19:59 -------- d-----w- C:\moje
2010-09-14 20:44 . 2010-09-14 20:44 -------- d-----w- c:\program files\Conduit
2010-09-14 19:39 . 2010-09-14 19:40 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-14 18:25 . 2009-11-18 17:33 79256 ----a-w- c:\windows\system32\npOGPPlugin.dll
2010-09-14 18:25 . 2004-01-12 15:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-14 18:25 . 2003-03-19 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-09-14 18:24 . 2010-09-19 18:28 -------- d-----w- c:\program files\Ogplanet
2010-09-14 17:41 . 2002-10-06 18:42 237568 ----a-w- c:\windows\system32\OggDS.dll
2010-09-14 17:41 . 2002-10-04 23:04 921600 ----a-w- c:\windows\system32\vorbisenc.dll
2010-09-14 17:41 . 2002-10-04 23:04 188416 ----a-w- c:\windows\system32\vorbis.dll
2010-09-14 17:41 . 2002-10-04 23:04 45056 ----a-w- c:\windows\system32\ogg.dll
2010-09-14 17:22 . 2010-06-18 11:39 16896 ------w- c:\windows\system32\dllcache\iecompat.dll
2010-09-14 17:22 . 2010-06-24 12:27 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-14 17:22 . 2010-06-24 12:27 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-09-14 17:22 . 2010-06-24 12:27 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-09-14 15:09 . 2010-09-16 18:33 -------- d-----w- C:\PCTRAN
2010-09-14 14:22 . 2010-03-10 06:17 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2010-09-14 14:20 . 2010-06-21 14:18 354304 ------w- c:\windows\system32\dllcache\srv.sys
2010-09-14 14:20 . 2009-05-21 18:49 268288 ------w- c:\windows\system32\dllcache\httpext.dll
2010-09-14 14:20 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-14 14:16 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-09-14 14:16 . 2009-03-06 14:23 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2010-09-14 14:16 . 2009-02-09 11:25 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-09-14 14:16 . 2009-02-09 10:56 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-09-14 14:16 . 2009-02-09 10:56 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-09-14 14:16 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe
2010-09-14 14:16 . 2009-02-09 10:56 684032 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-09-14 14:16 . 2009-02-09 10:56 709632 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-09-14 14:16 . 2009-02-09 10:56 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-09-14 14:15 . 2010-04-28 05:19 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-09-14 14:15 . 2010-04-28 05:19 2192256 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-09-14 14:15 . 2010-04-28 05:19 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-09-14 14:13 . 2009-03-21 14:09 988160 ------w- c:\windows\system32\dllcache\kernel32.dll
2010-09-14 14:13 . 2008-05-09 10:56 180224 ------w- c:\windows\system32\dllcache\scrobj.dll
2010-09-14 14:13 . 2008-05-09 10:56 172032 ------w- c:\windows\system32\dllcache\scrrun.dll
2010-09-14 14:13 . 2008-05-09 10:56 90112 ------w- c:\windows\system32\dllcache\wshext.dll
2010-09-14 14:13 . 2008-05-09 08:45 135168 ------w- c:\windows\system32\dllcache\cscript.exe
2010-09-14 14:13 . 2008-05-08 11:24 155648 ------w- c:\windows\system32\dllcache\wscript.exe
2010-09-14 14:10 . 2010-02-12 04:29 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll
2010-09-14 14:10 . 2010-02-11 11:36 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys
2010-09-14 14:10 . 2009-08-26 08:03 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2010-09-14 14:10 . 2009-05-07 15:33 346624 ------w- c:\windows\system32\dllcache\localspl.dll
2010-09-14 14:10 . 2010-06-24 21:30 1861120 ------w- c:\windows\system32\dllcache\win32k.sys
2010-09-14 14:05 . 2010-07-27 06:30 8466432 ------w- c:\windows\system32\dllcache\shell32.dll
2010-09-14 14:05 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-09-14 14:05 . 2008-04-21 21:15 216576 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-09-14 14:04 . 2010-04-20 05:32 285696 ------w- c:\windows\system32\dllcache\atmfd.dll
2010-09-14 14:02 . 2009-01-07 16:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-14 13:28 . 2008-06-12 14:24 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll
2010-09-14 13:28 . 2008-06-12 14:24 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll
2010-09-14 13:28 . 2008-06-12 14:24 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll
2010-09-14 13:28 . 2008-06-12 14:24 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll
2010-09-14 13:28 . 2008-06-12 14:24 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll
2010-09-14 13:27 . 2009-12-17 07:42 343552 ------w- c:\windows\system32\dllcache\mspaint.exe
2010-09-14 13:12 . 2010-09-14 13:27 -------- d-----w- c:\program files\Internet Download Manager
2010-09-14 13:08 . 2010-02-05 18:29 1294336 ------w- c:\windows\system32\dllcache\quartz.dll
2010-09-14 13:05 . 2010-02-24 11:57 457216 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-09-14 13:05 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-09-14 13:02 . 2009-10-15 16:32 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-09-14 13:02 . 2009-10-15 16:32 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-09-14 13:01 . 2008-05-01 14:37 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2010-09-14 13:00 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-09-14 13:00 . 2009-12-09 05:55 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 06:34 . 2010-09-21 06:33 -------- d-----w- c:\program files\Winamp
2010-09-20 12:28 . 2010-09-14 11:07 -------- d-----w- c:\program files\Windows Media Connect 2
2010-09-18 19:32 . 2010-09-14 11:23 -------- d-----w- c:\program files\Common Files\InstallShield
2010-09-15 15:38 . 2010-09-15 14:51 -------- d-----w- c:\program files\Crspace
2010-09-15 13:18 . 2010-09-14 11:11 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-09-15 13:18 . 2010-09-14 11:11 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-09-15 13:17 . 2010-09-14 11:11 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-09-14 20:26 . 2010-09-14 11:52 -------- d-----w- c:\program files\Webteh
2010-09-14 15:25 . 2010-09-14 12:23 -------- d-----w- c:\program files\Ashampoo
2010-09-14 13:25 . 2010-09-14 12:54 -------- d-----w- c:\program files\Futuremark
2010-09-14 12:06 . 2010-09-14 12:05 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-09-14 11:50 . 2010-09-14 11:50 -------- d-----w- c:\program files\AIMP2
2010-09-14 11:47 . 2010-09-14 11:46 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-09-14 11:46 . 2010-09-14 11:46 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-14 11:43 . 2010-09-14 11:43 -------- d-----w- c:\program files\VS Revo Group
2010-09-14 11:36 . 2010-09-14 11:34 -------- d-----w- c:\program files\Google
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----w- c:\program files\Common Files\Skype
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----r- c:\program files\Skype
2010-09-14 11:27 . 2010-09-14 11:27 0 ----a-w- c:\windows\nsreg.dat
2010-09-14 11:08 . 2010-09-14 11:08 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-12 08:00 . 2010-09-14 12:05 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-09 22:38 . 2006-06-23 14:49 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-06-23 14:49 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-06-30 12:33 . 2008-04-14 06:51 149504 ----a-w- c:\windows\system32\schannel.dll
.

------- Sigcheck -------

[-] 2009-02-14 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-09-25_14.06.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-15 16:33 . 2010-09-25 18:15 202061 c:\windows\system32\inetsrv\MetaBase.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-09-14 26624]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-05-26 3220912]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-09-23 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-09-23 2176512]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\8BallClub\\GameDirector.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8500:TCP"= 8500:TCP:HockeyDash
"13000:UDP"= 13000:UDP:HockeyDash

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23. 9. 2010 20:48 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [23. 9. 2010 21:29 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23. 9. 2010 20:48 17744]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14. 9. 2010 13:34 136176]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [14. 9. 2010 13:43 27064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14. 9. 2010 13:46 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\p9kzbdip.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\windows\system32\npOGPPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 20:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\d62ae326-5297-65e9-0032-a638e61e82d]
@Denied: (Full) (AuthenticatedUsers)
@Denied: (Full) (Administrators)
"1w3ihl1oevhiy"=hex:37,36,62,65,61,38,30,31,2d,66,30,31,33,2d,34,65,37,32,2d,
62,39,38,61,2d,33,35,38,35,35,38,66,37,30,65,32,65
"19mzum9p92zx3"=hex:65,00,00,00,f8,00,00,00,d1,1a,ca,92,36,36,36,6d,69,6c,6f,
73,00,00,00,00,00,00,00,00,01,a8,be,76,13,f0,72,4e,b9,8a,35,85,58,f7,0e,2e,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2548)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\devldr32.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2010-09-25 20:18:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-25 18:18
ComboFix2.txt 2010-09-25 14:07

Pre-Run: Volných bajtů: 122 873 892 864
Post-Run: Volných bajtů: 122 877 378 560

- - End Of File - - 952CFACD3346A4692BCDB647ADA0DC29

[jaro3]

odinstaluj :
Spyware Terminator

Toto otestuj na Virustotal
c:\windows\system32\dllcache\cdrom.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\dllcache\user32.dll
c:\windows\system32\drivers\sptd.sys
c:\windows\system32\sfcfiles.dll

A zkus si udělat ten sken s AVP Tool ( viz předešlá stránka).

[milosb]

http://www.virustotal.com/file-scan/rep ... 1285493609
http://www.virustotal.com/file-scan/rep ... 1285493543
http://www.virustotal.com/file-scan/rep ... 1285493480
http://www.virustotal.com/file-scan/rep ... 1285493424
http://www.virustotal.com/file-scan/rep ... 1285493380


urobil som aj ten avp tool nič nenaslo,ale nevyhodilo to nijaký log.iba dokončilo skenovanie.

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast, či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast či Microsoft Security Essentials



Vlož nový log z HJT+ info o chování PC.

[milosb]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:12:54, on 26. 9. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: setup_9.0.0.722_26.09.2010_12-29.lnk = C:\moje\kontrola logu\Virus Removal Tool\setup_9.0.0.722_26.09.2010_12-29\startup.exe
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6262 bytes




teraz ide všetko super.naozaj ti ďakujem,len by ma zaujímalo kde som to pochytal/ten bordel/hry nesťahujem,na porno nechodim,nod bol nainštalovaný aj terminator.

[jaro3]

Těžko posoudit , přes internet , někdy se něco vyskytne i na tzv. bezpečných stránkách , přes flešku , CD atd..

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)



Nemáš zač!

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.

[milosb]

ešte raz vďaka