prosím o kontrolu logu.. děkuji Vyřešeno

[neotek]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:02:58, on 6.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Documents and Settings\Neo\Local Settings\Data aplikací\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Neo\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Neo\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Neo\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Neo\Plocha\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: Centrum.cz Toolbar - {D5D47440-0750-463D-BAEF-A47D02414806} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Bing Bar] "C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Neo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... 2010082109
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8714281109
O18 - Protocol: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10707 bytes

[Reklama]

[memphisto]

Odinstaluj:

Centrumcz Toolbar
ICQ Toolbar
Daemon Tools Toolbar
MyWebSearch
MSN Toolbar

---

v logu fixni:

R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... 2010082109
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8714281109

---

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

---

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat

---

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[neotek]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4764

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

7.10.2010 10:52:31
mbam-log-2010-10-07 (10-52-31).txt

Typ skenu: Rychlý sken
Skenované objekty: 135153
Uplynulý čas: 4 minuta(y), 14 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 23
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 10
Infikované soubory: 10

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\chrome (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> No action taken.

Infikované soubory:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Uninstall Fun Web Products.dll (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\Neo\Local Settings\Temp\7ZipSfx.000\Pack\Keygen\Keygen.exe (RiskWare.Tool.CK) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.

[memphisto]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[neotek]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4764

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

7.10.2010 11:30:12
mbam-log-2010-10-07 (11-30-12).txt

Typ skenu: Rychlý sken
Skenované objekty: 135076
Uplynulý čas: 4 minuta(y), 20 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 23
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 10
Infikované soubory: 10

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\chrome (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infikované soubory:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\Uninstall Fun Web Products.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Neo\Local Settings\Temp\7ZipSfx.000\Pack\Keygen\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

[neotek]

ComboFix 10-10-06.02 - Neo 07.10.2010 11:55:10.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1642 [GMT 2:00]
Spuštěný z: c:\documents and settings\Neo\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-09-07 do 2010-10-07 )))))))))))))))))))))))))))))))
.

2010-10-07 08:55 . 2010-10-07 08:55 -------- d-----w- c:\program files\OCCT
2010-10-07 08:46 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-07 08:46 . 2010-10-07 08:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-07 08:46 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-07 08:34 . 2010-10-07 08:34 -------- d-----w- c:\documents and settings\Neo\DoctorWeb
2010-10-06 11:22 . 2010-10-06 11:22 -------- d-----w- c:\program files\CPUID
2010-10-06 11:22 . 2009-03-26 23:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:17 -------- d-----w- c:\program files\SMS posílač Treca
2010-10-01 10:03 . 2003-06-18 23:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-10-01 10:03 . 2003-06-18 23:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-10-01 10:02 . 2010-10-01 10:02 -------- d-----w- c:\windows\SHELLNEW
2010-09-29 09:55 . 2010-09-29 09:56 -------- d-----w- c:\program files\Zrychleni Pocitace
2010-09-27 10:38 . 2010-09-27 10:48 -------- d-----w- c:\program files\Lara Croft and the Guardian of Light
2010-09-27 07:57 . 2010-09-27 10:18 -------- d-----w- C:\JDownloaderPortable
2010-09-22 16:31 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-09-22 16:31 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-09-22 16:31 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-09-22 16:31 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-09-22 16:15 . 2010-09-23 11:37 -------- d-----w- c:\program files\Darksiders
2010-09-21 18:37 . 2010-09-21 18:37 932288 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AdobeARM.exe
2010-09-21 18:37 . 2010-09-21 18:37 70584 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AdobeExtractFiles.dll
2010-09-21 18:37 . 2010-09-21 18:37 338856 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\ReaderUpdater.exe
2010-09-21 18:37 . 2010-09-21 18:37 338856 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AcrobatUpdater.exe
2010-09-16 12:34 . 2010-09-16 12:41 -------- d-----w- c:\program files\Ubisoft
2010-09-14 07:22 . 2008-04-14 06:52 152064 -c--a-w- c:\windows\system32\dllcache\irftp.exe
2010-09-14 07:22 . 2008-04-14 06:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-09-14 07:22 . 2008-04-14 06:51 27648 -c--a-w- c:\windows\system32\dllcache\irmon.dll
2010-09-14 07:22 . 2008-04-14 06:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-09-14 07:22 . 2008-04-13 22:24 88192 -c--a-w- c:\windows\system32\dllcache\irda.sys
2010-09-14 07:22 . 2008-04-13 22:24 88192 ----a-w- c:\windows\system32\drivers\irda.sys
2010-09-14 07:22 . 2001-08-17 19:51 19584 -c--a-w- c:\windows\system32\dllcache\rasirda.sys
2010-09-14 07:22 . 2001-08-17 19:51 19584 ----a-w- c:\windows\system32\drivers\rasirda.sys
2010-09-14 07:22 . 2008-04-14 06:52 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2010-09-14 07:22 . 2008-04-14 06:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-09-14 07:22 . 2001-08-17 19:49 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys
2010-09-14 07:22 . 2001-08-17 19:49 26624 ----a-w- c:\windows\system32\drivers\irstusb.sys
2010-09-13 13:57 . 2010-09-16 07:24 -------- d-----w- c:\program files\Amnesia - The Dark Descent
2010-09-09 13:05 . 2010-09-09 13:05 -------- d-----w- c:\program files\FastStone Capture
2010-09-09 10:33 . 2010-09-09 10:34 -------- d-----w- C:\TDdownload
2010-09-09 10:29 . 2006-01-09 13:01 86016 ----a-w- c:\windows\system32\gigagetbho_v10.dll
2010-09-09 10:29 . 2010-09-09 10:29 -------- d-----w- c:\program files\Giganology
2010-09-08 09:14 . 2010-09-09 05:42 -------- d-----w- c:\program files\Steam
2010-09-07 13:42 . 2010-09-07 13:42 -------- d-sh--w- c:\documents and settings\Neo\PrivacIE
2010-09-07 13:36 . 2010-09-07 13:36 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-07 13:36 . 2010-09-07 13:36 -------- d-sh--w- c:\documents and settings\Neo\IETldCache
2010-09-07 13:33 . 2010-09-07 13:44 -------- d-----w- c:\windows\ie8updates
2010-09-07 13:33 . 2010-06-24 12:19 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-09-07 13:33 . 2010-06-24 12:19 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\MSN Toolbar
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Microsoft
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Bing Bar Installer
2010-09-07 13:32 . 2010-09-22 16:34 -------- d--h--w- c:\windows\msdownld.tmp
2010-09-07 13:30 . 2010-06-18 11:39 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-09-07 13:30 . 2010-06-24 12:27 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-09-07 13:30 . 2010-06-24 12:27 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-07 13:30 . 2010-06-24 12:27 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-07 08:22 . 2010-07-09 21:56 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-10-04 20:04 . 2010-07-09 18:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-01 10:02 . 2010-07-13 10:25 -------- d-----w- c:\program files\Microsoft.NET
2010-09-29 09:43 . 2010-07-09 19:26 -------- d-----w- c:\program files\ESET
2010-09-29 08:27 . 2010-07-13 10:25 -------- d-----w- c:\program files\MSBuild
2010-09-25 13:18 . 2010-07-09 19:23 -------- d-----w- c:\program files\uTorrent
2010-09-13 08:13 . 2010-08-20 14:04 -------- d-----w- c:\program files\Ashampoo
2010-09-08 16:34 . 2003-04-16 12:00 500372 ----a-w- c:\windows\system32\perfh005.dat
2010-09-08 16:34 . 2003-04-16 12:00 103976 ----a-w- c:\windows\system32\perfc005.dat
2010-09-03 11:04 . 2010-09-03 11:04 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-28 10:47 . 2010-08-02 11:55 -------- d-----w- c:\program files\MAGIX
2010-08-26 03:33 . 2010-07-09 18:15 5386752 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2010-08-26 02:12 . 2010-07-09 19:38 57344 ----a-w- c:\windows\system32\aticalrt.dll
2010-08-26 02:11 . 2010-07-09 19:38 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-08-26 02:10 . 2010-07-09 19:38 4390912 ----a-w- c:\windows\system32\aticaldd.dll
2010-08-26 02:03 . 2010-07-09 19:46 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-08-26 02:01 . 2010-07-09 19:38 15876096 ----a-w- c:\windows\system32\atioglxx.dll
2010-08-26 01:57 . 2010-07-09 19:46 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-26 01:56 . 2010-07-09 18:15 300544 ----a-w- c:\windows\system32\ati2dvag.dll
2010-08-26 01:52 . 2010-07-09 18:15 3927936 ----a-w- c:\windows\system32\ati3duag.dll
2010-08-26 01:39 . 2007-10-17 01:56 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2010-08-26 01:39 . 2007-10-17 01:56 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-08-26 01:38 . 2007-10-17 01:56 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-08-26 01:38 . 2007-10-17 01:55 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-08-26 01:38 . 2007-10-17 01:55 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-08-26 01:37 . 2010-07-09 18:15 2603520 ----a-w- c:\windows\system32\ativvaxx.dll
2010-08-26 01:37 . 2007-10-17 01:54 606208 ----a-w- c:\windows\system32\ati2evxx.exe
2010-08-26 01:36 . 2010-07-09 19:46 887724 ----a-w- c:\windows\system32\ativva6x.dat
2010-08-26 01:36 . 2010-07-09 19:46 3 ----a-w- c:\windows\system32\ativva5x.dat
2010-08-26 01:35 . 2007-10-17 01:53 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-08-26 01:34 . 2010-07-09 19:38 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-26 01:30 . 2007-10-17 01:19 626688 ----a-w- c:\windows\system32\atikvmag.dll
2010-08-26 01:30 . 2007-10-17 01:15 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-08-26 01:29 . 2010-07-09 19:38 188416 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-26 01:28 . 2007-10-17 01:17 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-08-26 01:23 . 2010-07-09 18:15 688128 ----a-w- c:\windows\system32\ati2cqag.dll
2010-08-26 01:22 . 2010-07-09 19:38 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-08-26 01:22 . 2010-07-09 19:38 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-08-26 01:21 . 2007-10-17 01:16 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-25 14:44 . 2010-08-25 14:44 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-25 14:44 . 2010-08-17 17:07 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-08-25 14:37 . 2010-08-25 14:37 -------- d-----w- c:\program files\2K Games
2010-08-23 16:57 . 2010-07-09 19:12 -------- d-----w- c:\program files\ICQ7.1
2010-08-23 08:53 . 2010-08-23 08:43 -------- d-----w- c:\program files\AutoMacroRecorder
2010-08-23 08:46 . 2010-08-23 08:46 109440 ----a-w- c:\windows\system32\drivers\KbdCap.sys
2010-08-09 13:23 . 2010-08-09 13:22 -------- d-----w- c:\program files\Video Convert Master
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-04 14:43 . 2010-08-04 10:31 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-28 16:03 . 2010-07-28 16:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-28 12:16 . 2010-07-28 12:16 47364 ----a-w- c:\documents and settings\All Users\Data aplikací\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-07-23 12:06 . 2010-07-23 12:05 57344 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-23 12:06 . 2010-07-23 12:06 56765 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54128 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Converter\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54644 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\TranscodeEngine\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54101 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\MPEG2Plugin\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 1062184 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Setup\Resource.dll
2010-07-23 12:05 . 2010-07-23 12:05 57054 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSDesktopComponents\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54166 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSAVCDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 53600 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Update\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 57532 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSASPDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 56458 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54174 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSAACDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 57409 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\ControlPanel\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 52963 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54073 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Qt4.5\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 56969 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\ASPEncoder\Uninstaller.exe
2010-07-23 12:04 . 2010-07-23 12:05 895256 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Setup\DivXSetup.exe
2010-07-21 15:03 . 2010-07-21 15:04 737280 ----a-w- c:\windows\iun6002.exe
2010-07-13 10:55 . 2010-07-13 10:55 95232 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-07-13 10:55 . 2010-07-13 10:55 8192 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-07-13 10:55 . 2010-07-13 10:55 61440 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-07-13 10:55 . 2010-07-13 10:55 10240 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe
2010-07-13 10:55 . 2010-07-13 10:55 36684048 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_cze_web.exe
2010-07-13 10:05 . 2010-07-09 18:05 76487 ----a-w- c:\windows\pchealth\HelpCtr\OfflineCache\index.dat
2010-07-13 10:05 . 2010-07-09 18:05 2982 ----a-w- c:\windows\pchealth\HelpCtr\PackageStore\SkuStore.bin
2010-07-09 21:56 . 2010-07-09 21:56 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-09 19:41 . 2010-07-09 19:41 0 ----a-w- c:\windows\ativpsrm.bin
2010-07-09 19:09 . 2010-07-09 19:09 0 ----a-w- c:\windows\nsreg.dat
2010-07-09 18:58 . 2010-07-09 18:54 14656 ----a-w- c:\windows\gdrv.sys
2010-07-09 18:15 . 2010-07-09 18:05 8972 ----a-w- c:\windows\pchealth\HelpCtr\Config\Cntstore.bin
2010-07-09 18:03 . 2010-07-09 18:03 21812 ----a-w- c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
"Google Update"="c:\documents and settings\Neo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-07-15 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.1\\ICQ.exe"=
"c:\\Program Files\\ICQ7.1\\aolload.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Disney Interactive Studios\\Split Second\\SplitSecond.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\Prince of Persia.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\GameSettings.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\gu.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\UPlayBrowser.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R3 kbdcap;kbdcap;c:\windows\system32\drivers\KbdCap.sys [23.8.2010 10:46 109440]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [28.8.2010 12:47 1527900]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9.7.2010 23:56 691696]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\documents and settings\Neo\Data aplikací\Mozilla\Firefox\Profiles\vbyw68eq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=B8MS&PC=B8MS&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=B8MS&PC=B8MS&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

SafeBoot-WudfPf
SafeBoot-WudfRd


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2010-10-07 11:58:23
ComboFix-quarantined-files.txt 2010-10-07 09:58

Před spuštěním: Volných bajtů: 112 991 678 464
Po spuštění: Volných bajtů: 114 813 378 560

- - End Of File - - 6F3AA541BE7D27991D36F0D9E95ECF3F

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\perfh005.dat
c:\windows\system32\perfc005.dat
c:\windows\system32\ezsidmv.dat
c:\windows\iun6002.exe
c:\windows\ativpsrm.bin

Folder::
c:\windows\msdownld.tmp
c:\program files\DAEMON Tools Toolbar

DDS::
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\mdimon.dll
c:\windows\system32\drivers\KbdCap.sys

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Budu až později večer , pomůže memphisto nebo bledulka..

[neotek]

ComboFix 10-10-06.02 - Neo 07.10.2010 14:22:19.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1546 [GMT 2:00]
Spuštěný z: c:\documents and settings\Neo\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Neo\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
"c:\windows\ativpsrm.bin"
"c:\windows\iun6002.exe"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\perfc005.dat"
"c:\windows\system32\perfh005.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\_DTLite.xml
c:\windows\ativpsrm.bin
c:\windows\iun6002.exe
c:\windows\msdownld.tmp
c:\windows\system32\ezsidmv.dat
c:\windows\system32\perfc005.dat
c:\windows\system32\perfh005.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-07 do 2010-10-07 )))))))))))))))))))))))))))))))
.

2010-10-07 08:55 . 2010-10-07 08:55 -------- d-----w- c:\program files\OCCT
2010-10-07 08:46 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-07 08:46 . 2010-10-07 08:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-07 08:46 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-07 08:34 . 2010-10-07 08:34 -------- d-----w- c:\documents and settings\Neo\DoctorWeb
2010-10-06 11:22 . 2010-10-06 11:22 -------- d-----w- c:\program files\CPUID
2010-10-06 11:22 . 2009-03-26 23:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:15 0 ----a-w- c:\documents and settings\Neo\Data aplikací\SMS posílač Treca\SMSposilac.exe
2010-10-03 13:15 . 2010-10-03 13:17 -------- d-----w- c:\program files\SMS posílač Treca
2010-10-01 10:03 . 2003-06-18 23:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-10-01 10:03 . 2003-06-18 23:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-10-01 10:02 . 2010-10-01 10:02 -------- d-----w- c:\windows\SHELLNEW
2010-09-29 09:55 . 2010-09-29 09:56 -------- d-----w- c:\program files\Zrychleni Pocitace
2010-09-27 10:38 . 2010-09-27 10:48 -------- d-----w- c:\program files\Lara Croft and the Guardian of Light
2010-09-27 07:57 . 2010-09-27 10:18 -------- d-----w- C:\JDownloaderPortable
2010-09-22 16:31 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-09-22 16:31 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-09-22 16:31 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-09-22 16:31 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-09-22 16:31 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-09-22 16:15 . 2010-09-23 11:37 -------- d-----w- c:\program files\Darksiders
2010-09-21 18:37 . 2010-09-21 18:37 932288 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AdobeARM.exe
2010-09-21 18:37 . 2010-09-21 18:37 70584 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AdobeExtractFiles.dll
2010-09-21 18:37 . 2010-09-21 18:37 338856 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\ReaderUpdater.exe
2010-09-21 18:37 . 2010-09-21 18:37 338856 ----a-w- c:\documents and settings\All Users\Data aplikací\Adobe\Reader\9.3\ARM\13014\AcrobatUpdater.exe
2010-09-16 12:34 . 2010-09-16 12:41 -------- d-----w- c:\program files\Ubisoft
2010-09-14 07:22 . 2008-04-14 06:52 152064 -c--a-w- c:\windows\system32\dllcache\irftp.exe
2010-09-14 07:22 . 2008-04-14 06:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-09-14 07:22 . 2008-04-14 06:51 27648 -c--a-w- c:\windows\system32\dllcache\irmon.dll
2010-09-14 07:22 . 2008-04-14 06:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-09-14 07:22 . 2008-04-13 22:24 88192 -c--a-w- c:\windows\system32\dllcache\irda.sys
2010-09-14 07:22 . 2008-04-13 22:24 88192 ----a-w- c:\windows\system32\drivers\irda.sys
2010-09-14 07:22 . 2001-08-17 19:51 19584 -c--a-w- c:\windows\system32\dllcache\rasirda.sys
2010-09-14 07:22 . 2001-08-17 19:51 19584 ----a-w- c:\windows\system32\drivers\rasirda.sys
2010-09-14 07:22 . 2008-04-14 06:52 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2010-09-14 07:22 . 2008-04-14 06:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-09-14 07:22 . 2001-08-17 19:49 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys
2010-09-14 07:22 . 2001-08-17 19:49 26624 ----a-w- c:\windows\system32\drivers\irstusb.sys
2010-09-13 13:57 . 2010-09-16 07:24 -------- d-----w- c:\program files\Amnesia - The Dark Descent
2010-09-09 13:05 . 2010-09-09 13:05 -------- d-----w- c:\program files\FastStone Capture
2010-09-09 10:33 . 2010-09-09 10:34 -------- d-----w- C:\TDdownload
2010-09-09 10:29 . 2006-01-09 13:01 86016 ----a-w- c:\windows\system32\gigagetbho_v10.dll
2010-09-09 10:29 . 2010-09-09 10:29 -------- d-----w- c:\program files\Giganology
2010-09-08 09:14 . 2010-09-09 05:42 -------- d-----w- c:\program files\Steam
2010-09-07 13:42 . 2010-09-07 13:42 -------- d-sh--w- c:\documents and settings\Neo\PrivacIE
2010-09-07 13:36 . 2010-09-07 13:36 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-07 13:36 . 2010-09-07 13:36 -------- d-sh--w- c:\documents and settings\Neo\IETldCache
2010-09-07 13:33 . 2010-09-07 13:44 -------- d-----w- c:\windows\ie8updates
2010-09-07 13:33 . 2010-06-24 12:19 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-09-07 13:33 . 2010-06-24 12:19 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\MSN Toolbar
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Microsoft
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-07 13:32 . 2010-09-07 13:32 -------- d-----w- c:\program files\Bing Bar Installer
2010-09-07 13:30 . 2010-06-18 11:39 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-09-07 13:30 . 2010-06-24 12:27 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-09-07 13:30 . 2010-06-24 12:27 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-07 13:30 . 2010-06-24 12:27 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-04 20:04 . 2010-07-09 18:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-01 10:02 . 2010-07-13 10:25 -------- d-----w- c:\program files\Microsoft.NET
2010-09-29 09:43 . 2010-07-09 19:26 -------- d-----w- c:\program files\ESET
2010-09-29 08:27 . 2010-07-13 10:25 -------- d-----w- c:\program files\MSBuild
2010-09-25 13:18 . 2010-07-09 19:23 -------- d-----w- c:\program files\uTorrent
2010-09-13 08:13 . 2010-08-20 14:04 -------- d-----w- c:\program files\Ashampoo
2010-09-03 11:04 . 2010-09-03 11:04 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-28 10:47 . 2010-08-02 11:55 -------- d-----w- c:\program files\MAGIX
2010-08-26 03:33 . 2010-07-09 18:15 5386752 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2010-08-26 02:12 . 2010-07-09 19:38 57344 ----a-w- c:\windows\system32\aticalrt.dll
2010-08-26 02:11 . 2010-07-09 19:38 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-08-26 02:10 . 2010-07-09 19:38 4390912 ----a-w- c:\windows\system32\aticaldd.dll
2010-08-26 02:03 . 2010-07-09 19:46 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-08-26 02:01 . 2010-07-09 19:38 15876096 ----a-w- c:\windows\system32\atioglxx.dll
2010-08-26 01:57 . 2010-07-09 19:46 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-26 01:56 . 2010-07-09 18:15 300544 ----a-w- c:\windows\system32\ati2dvag.dll
2010-08-26 01:52 . 2010-07-09 18:15 3927936 ----a-w- c:\windows\system32\ati3duag.dll
2010-08-26 01:39 . 2007-10-17 01:56 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2010-08-26 01:39 . 2007-10-17 01:56 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-08-26 01:38 . 2007-10-17 01:56 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-08-26 01:38 . 2007-10-17 01:55 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-08-26 01:38 . 2007-10-17 01:55 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-08-26 01:37 . 2010-07-09 18:15 2603520 ----a-w- c:\windows\system32\ativvaxx.dll
2010-08-26 01:37 . 2007-10-17 01:54 606208 ----a-w- c:\windows\system32\ati2evxx.exe
2010-08-26 01:36 . 2010-07-09 19:46 887724 ----a-w- c:\windows\system32\ativva6x.dat
2010-08-26 01:36 . 2010-07-09 19:46 3 ----a-w- c:\windows\system32\ativva5x.dat
2010-08-26 01:35 . 2007-10-17 01:53 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-08-26 01:34 . 2010-07-09 19:38 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-26 01:30 . 2007-10-17 01:19 626688 ----a-w- c:\windows\system32\atikvmag.dll
2010-08-26 01:30 . 2007-10-17 01:15 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-08-26 01:29 . 2010-07-09 19:38 188416 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-26 01:28 . 2007-10-17 01:17 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-08-26 01:23 . 2010-07-09 18:15 688128 ----a-w- c:\windows\system32\ati2cqag.dll
2010-08-26 01:22 . 2010-07-09 19:38 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-08-26 01:22 . 2010-07-09 19:38 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-08-26 01:21 . 2007-10-17 01:16 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-25 14:44 . 2010-08-25 14:44 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-25 14:44 . 2010-08-17 17:07 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-08-25 14:37 . 2010-08-25 14:37 -------- d-----w- c:\program files\2K Games
2010-08-23 16:57 . 2010-07-09 19:12 -------- d-----w- c:\program files\ICQ7.1
2010-08-23 08:53 . 2010-08-23 08:43 -------- d-----w- c:\program files\AutoMacroRecorder
2010-08-23 08:46 . 2010-08-23 08:46 109440 ----a-w- c:\windows\system32\drivers\KbdCap.sys
2010-08-09 13:23 . 2010-08-09 13:22 -------- d-----w- c:\program files\Video Convert Master
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 81920 ----a-w- c:\documents and settings\Neo\Data aplikací\ezpinst.exe
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-09 13:22 . 2010-08-09 13:22 47360 ----a-w- c:\documents and settings\Neo\Data aplikací\pcouffin.sys
2010-08-04 14:43 . 2010-08-04 10:31 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-28 12:16 . 2010-07-28 12:16 47364 ----a-w- c:\documents and settings\All Users\Data aplikací\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-07-23 12:06 . 2010-07-23 12:05 57344 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-23 12:06 . 2010-07-23 12:06 56765 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54128 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Converter\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54644 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\TranscodeEngine\Uninstaller.exe
2010-07-23 12:06 . 2010-07-23 12:06 54101 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\MPEG2Plugin\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 1062184 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Setup\Resource.dll
2010-07-23 12:05 . 2010-07-23 12:05 57054 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSDesktopComponents\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54166 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSAVCDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 53600 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Update\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 57532 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSASPDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 56458 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54174 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\DSAACDecoder\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 57409 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\ControlPanel\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 52963 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 54073 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Qt4.5\Uninstaller.exe
2010-07-23 12:05 . 2010-07-23 12:05 56969 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\ASPEncoder\Uninstaller.exe
2010-07-23 12:04 . 2010-07-23 12:05 895256 ----a-w- c:\documents and settings\All Users\Data aplikací\DivX\Setup\DivXSetup.exe
2010-07-13 10:55 . 2010-07-13 10:55 95232 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-07-13 10:55 . 2010-07-13 10:55 8192 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-07-13 10:55 . 2010-07-13 10:55 61440 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-07-13 10:55 . 2010-07-13 10:55 10240 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe
2010-07-13 10:55 . 2010-07-13 10:55 36684048 ----a-w- c:\documents and settings\All Users\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_cze_web.exe
2010-07-13 10:05 . 2010-07-09 18:05 76487 ----a-w- c:\windows\pchealth\HelpCtr\OfflineCache\index.dat
2010-07-13 10:05 . 2010-07-09 18:05 2982 ----a-w- c:\windows\pchealth\HelpCtr\PackageStore\SkuStore.bin
2010-07-09 21:56 . 2010-07-09 21:56 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-09 19:09 . 2010-07-09 19:09 0 ----a-w- c:\windows\nsreg.dat
2010-07-09 18:58 . 2010-07-09 18:54 14656 ----a-w- c:\windows\gdrv.sys
2010-07-09 18:15 . 2010-07-09 18:05 8972 ----a-w- c:\windows\pchealth\HelpCtr\Config\Cntstore.bin
2010-07-09 18:03 . 2010-07-09 18:03 21812 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-10-07_09.57.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-07 12:11 . 2010-10-07 12:11 16384 c:\windows\Temp\Perflib_Perfdata_720.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
"Google Update"="c:\documents and settings\Neo\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-07-15 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.1\\ICQ.exe"=
"c:\\Program Files\\ICQ7.1\\aolload.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Disney Interactive Studios\\Split Second\\SplitSecond.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\Prince of Persia.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\GameSettings.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\gu.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia The Forgotten Sands\\UPlayBrowser.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R3 kbdcap;kbdcap;c:\windows\system32\drivers\KbdCap.sys [23.8.2010 10:46 109440]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [28.8.2010 12:47 1527900]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9.7.2010 23:56 691696]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\documents and settings\Neo\Data aplikací\Mozilla\Firefox\Profiles\vbyw68eq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=B8MS&PC=B8MS&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=B8MS&PC=B8MS&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe


.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2010-10-07 14:26:37
ComboFix-quarantined-files.txt 2010-10-07 12:26
ComboFix2.txt 2010-10-07 09:58

Před spuštěním: Volných bajtů: 114 813 829 120
Po spuštění: Volných bajtů: 114 805 456 896

- - End Of File - - ED67D5F3C87CE112003ED6897D919188

[neotek]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4764

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

7.10.2010 14:35:14
mbam-log-2010-10-07 (14-35-14).txt

Typ skenu: Rychlý sken
Skenované objekty: 132240
Uplynulý čas: 2 minuta(y), 54 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[jaro3]

Ještě ty soubory na Virustotal , právě odjíždím , napsal jsem memphistovi..

[neotek]

http://www.virustotal.com/file-scan/rep ... 1286455155

http://www.virustotal.com/file-scan/rep ... 1286455465

[memphisto]

Ten soubor KbdCap.sys najdi s smaž.

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials


Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.