Prosím o preventivní kontrolu logu! Díky :)

M4RTY · Příspěvekod **M4RTY** » 26 pro 2010 17:53

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:52:07, on 26.12.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIFDE.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\explorer.exe
C:\Users\Martin\Desktop\QIP Infium bz™Pack\inf.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Martin\Desktop\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14597&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O3 - Toolbar: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKCU\..\Run: [EPSON SX210 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFDE.EXE /FU "C:\Windows\TEMP\E_S2322.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 4446 bytes

Reklama

Příspěvekod **memphisto** » 26 pro 2010 18:21

Fix:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14597&l=dis
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

M4RTY · Příspěvekod **M4RTY** » 26 pro 2010 19:24

Dr. Web - nic nenašel.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5398

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

26.12.2010 19:23:59
mbam-log-2010-12-26 (19-23-59).txt

Typ kontroly: Rychlý test
Testované objekty: 142242
Uplynulý čas: 3 minut, 23 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Příspěvekod **memphisto** » 26 pro 2010 20:24

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

M4RTY · Příspěvekod **M4RTY** » 28 pro 2010 11:35

Úplně jsem na to zapomněl :blush:

ComboFix 10-12-26.01 - Martin 28.12.2010 11:18:42.1.3 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2047.1367 [GMT 1:00]
Spuštěný z: c:\users\Martin\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Martin\AppData\Roaming\Local
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\4.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Kajinek.avi.ddr
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\kajinek1.avi.ddr
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Post_Install_RB_HiQ_en.divx.ddr
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Kajinek.avi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\kajinek1.avi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Post_Install_RB_HiQ_en.divx
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\vlkzcssvlpej.avi.ddp
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\vsuordapedsx.avi
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\vlkzcssvlpej.avi.ddr
c:\users\Martin\AppData\Roaming\Local\Temp\DDM\Settings\vsuordapedsx.avi.ddr

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-28 do 2010-12-28 )))))))))))))))))))))))))))))))
.

2010-12-28 08:58 . 2010-12-28 08:59 -------- d-----w- c:\program files\ICQ7.2
2010-12-28 08:41 . 2010-11-16 11:01 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{653D27EE-88FF-464A-9E92-9024BD76EB92}\mpengine.dll
2010-12-27 20:14 . 2010-12-27 20:14 -------- d-----w- c:\program files\SopCast
2010-12-27 12:35 . 2010-12-27 12:35 -------- d-----w- c:\programdata\ATI
2010-12-27 12:35 . 2010-12-27 12:35 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-12-27 12:34 . 2010-02-18 08:18 37944 ----a-w- c:\windows\system32\drivers\amdiox86.sys
2010-12-27 12:32 . 2010-12-27 12:32 -------- d-----w- C:\AMD
2010-12-26 18:20 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-26 18:20 . 2010-12-26 18:20 -------- d-----w- c:\programdata\Malwarebytes
2010-12-26 18:20 . 2010-12-26 18:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-26 18:20 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-25 14:24 . 2010-12-25 14:24 -------- d-----w- c:\program files\FreeTime
2010-12-24 09:47 . 2010-12-24 09:47 -------- d-----w- c:\program files\Activision
2010-12-24 09:22 . 2010-12-24 09:22 -------- d-----w- c:\program files\Lavalys
2010-12-23 19:52 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-12-23 19:52 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-12-23 19:52 . 2010-12-23 19:52 -------- d-----w- c:\windows\PCHEALTH
2010-12-23 19:52 . 2010-12-23 19:52 -------- d-----w- c:\program files\Microsoft.NET
2010-12-23 19:50 . 2010-12-23 19:50 -------- d-----r- C:\MSOCache
2010-12-23 18:17 . 2010-12-23 18:17 -------- d-----w- c:\program files\Zoner
2010-12-23 17:57 . 2008-11-16 23:00 342016 ----a-w- c:\windows\system32\eswiaud.dll
2010-12-23 17:57 . 2006-08-25 08:00 9216 ----a-w- c:\windows\system32\escdev.dll
2010-12-23 17:57 . 2010-12-23 17:57 -------- d-----w- c:\program files\epson
2010-12-23 17:54 . 2007-04-10 09:06 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-12-23 17:54 . 2008-08-08 10:09 86528 ----a-w- c:\windows\system32\E_FLBFDE.DLL
2010-12-23 17:54 . 2007-12-07 10:01 78848 ----a-w- c:\windows\system32\E_FD4BFDE.DLL
2010-12-23 17:54 . 2010-12-23 17:56 -------- d-----w- c:\programdata\EPSON
2010-12-23 16:46 . 2010-12-23 16:46 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-12-23 16:46 . 2010-12-23 16:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-12-23 16:44 . 2010-12-23 16:48 -------- d-----w- c:\program files\DivX
2010-12-23 16:43 . 2010-12-23 16:49 -------- d-----w- c:\programdata\DivX
2010-12-23 13:45 . 2010-12-23 13:45 -------- d-----w- c:\program files\VideoLAN
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\windows\system32\QuickTime
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\QuickTime
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\Common Files\TechSmith Shared
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\TechSmith
2010-12-23 12:30 . 2010-12-23 12:30 -------- d-----w- c:\program files\CCleaner
2010-12-23 12:25 . 2010-12-23 12:32 -------- d-----w- c:\programdata\TechSmith
2010-12-23 11:57 . 2010-12-26 10:53 -------- d-----w- C:\Fraps
2010-12-23 10:12 . 2010-12-23 10:12 -------- d-----w- C:\DirectX
2010-12-23 10:02 . 2010-12-23 10:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-12-23 10:02 . 2010-12-23 10:02 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-12-23 10:01 . 2010-12-23 10:02 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-12-22 20:56 . 2010-12-22 20:56 -------- d-----w- C:\PFiles
2010-12-22 15:23 . 2010-12-22 15:23 -------- d-----w- c:\windows\system32\RTCOM
2010-12-22 15:11 . 2010-12-22 15:11 -------- d-----w- c:\program files\Free Audio Editor
2010-12-22 11:08 . 2010-12-22 11:08 -------- d-----w- c:\users\Ostatní
2010-12-22 07:48 . 2010-12-22 07:48 176488 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10136.bin
2010-12-22 07:20 . 2010-12-22 07:20 -------- d-----w- c:\windows\system32\Wat
2010-12-21 22:16 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-12-21 22:15 . 2009-11-25 11:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-12-21 22:15 . 2009-11-25 11:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-12-21 22:15 . 2009-11-25 11:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-12-21 22:15 . 2009-11-25 11:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-12-21 22:15 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-12-21 22:11 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-12-21 22:10 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
2010-12-21 16:59 . 2010-12-21 16:59 -------- d-----w- C:\totalcmd
2010-12-21 08:56 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2010-12-21 08:56 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-12-21 08:56 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-12-21 08:54 . 2010-03-05 07:42 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-12-21 08:50 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-12-21 08:50 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-12-20 21:18 . 2010-12-20 21:18 -------- d-----w- c:\program files\Common Files\Adobe
2010-12-20 20:49 . 2010-12-20 20:49 -------- d-----w- c:\program files\ESET
2010-12-20 19:53 . 2010-12-28 08:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-12-20 19:53 . 2010-12-22 14:20 -------- d-----w- c:\program files\Valve
2010-12-20 19:53 . 2010-12-24 09:46 -------- d-----w- c:\program files\Common Files\InstallShield
2010-12-20 19:44 . 2010-10-19 09:41 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-12-20 19:37 . 2010-12-20 19:37 -------- d-----w- c:\windows\system32\Macromed
2010-12-20 19:26 . 2010-12-20 19:26 0 ----a-w- c:\windows\ativpsrm.bin
2010-12-20 19:22 . 2010-12-27 12:35 -------- d-sh--w- c:\windows\Installer
2010-12-20 19:22 . 2010-11-26 02:58 550400 ----a-w- c:\windows\system32\aticfx32.dll
2010-12-20 19:22 . 2010-11-26 02:49 4066816 ----a-w- c:\windows\system32\atidxx32.dll
2010-12-20 19:22 . 2010-11-26 02:30 4122624 ----a-w- c:\windows\system32\atiumdag.dll
2010-12-20 19:22 . 2010-11-26 02:24 52736 ----a-w- c:\windows\system32\coinst.dll
2010-12-20 19:22 . 2010-11-26 02:22 3460096 ----a-w- c:\windows\system32\atiumdva.dll
2010-12-20 19:22 . 2010-11-26 02:15 30720 ----a-w- c:\windows\system32\atiuxpag.dll
2010-12-20 19:22 . 2010-11-26 02:15 28672 ----a-w- c:\windows\system32\atiu9pag.dll
2010-12-20 19:22 . 2009-05-11 21:35 118784 ----a-w- c:\windows\system32\atibtmon.exe
2010-12-20 19:22 . 2010-12-20 19:22 -------- d-----w- c:\program files\ATI
2010-12-20 19:21 . 2010-12-27 12:35 -------- d-----w- c:\program files\ATI Technologies
2010-12-20 19:19 . 2010-12-28 08:43 -------- d-----w- c:\windows\system32\wbem\Performance
2010-12-20 18:58 . 2010-12-20 19:18 -------- d-----w- c:\windows\Panther
2010-12-02 08:25 . 2010-12-02 08:25 86016 ----a-w- c:\windows\system32\frapsvid.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-26 04:19 . 2010-11-26 04:19 6650368 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-11-26 03:02 . 2010-11-26 03:02 16702976 ----a-w- c:\windows\system32\atioglxx.dll
2010-11-26 02:58 . 2010-11-26 02:58 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-11-26 02:54 . 2010-11-26 02:54 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-11-26 02:54 . 2010-11-26 02:54 393216 ----a-w- c:\windows\system32\atieclxx.exe
2010-11-26 02:54 . 2010-11-26 02:54 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-11-26 02:52 . 2010-11-26 02:52 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-11-26 02:52 . 2010-11-26 02:52 15872 ----a-w- c:\windows\system32\atimuixx.dll
2010-11-26 02:52 . 2010-11-26 02:52 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-11-26 02:30 . 2010-11-26 02:30 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-11-26 02:30 . 2010-11-26 02:30 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-11-26 02:28 . 2010-11-26 02:28 5441024 ----a-w- c:\windows\system32\aticaldd.dll
2010-11-26 02:17 . 2010-11-26 02:17 249856 ----a-w- c:\windows\system32\atiadlxx.dll
2010-11-26 02:17 . 2010-11-26 02:17 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 27136 ----a-w- c:\windows\system32\atigktxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 231936 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-11-26 02:15 . 2010-11-26 02:15 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-02 04:39 . 2010-12-21 08:55 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 04:34 . 2010-12-21 08:55 179712 ----a-w- c:\windows\system32\schtasks.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2010-12-28 133432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-18 2219184]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-30 9914984]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-21 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-23 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 140224]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-09-03 137144]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-18 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: {26A0AE98-9276-4FBB-AA80-3214767AE065} = 10.10.10.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\730ycoe2.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2010-12-28 11:26:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-28 10:26

Před spuštěním: Volných bajtů: 103 577 182 208
Po spuštění: Volných bajtů: 103 350 345 728

- - End Of File - - 70BFCA157F4BC79456B083AA9F83A9AF

Příspěvekod **memphisto** » 28 pro 2010 12:42

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=-
"ConsentPromptBehaviorUser"=-
"EnableLUA"=-
"EnableUIADesktopToggle"=-
"PromptOnSecureDesktop"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix

M4RTY · Příspěvekod **M4RTY** » 28 pro 2010 20:31

ComboFix 10-12-26.01 - Martin 28.12.2010 20:16:25.2.3 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2047.1316 [GMT 1:00]
Spuštěný z: c:\users\Martin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Martin\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-11-28 do 2010-12-28 )))))))))))))))))))))))))))))))
.

2010-12-28 19:19 . 2010-12-28 19:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-28 17:17 . 2010-12-28 17:25 -------- d-----w- c:\program files\PhotoScape
2010-12-28 08:58 . 2010-12-28 08:59 -------- d-----w- c:\program files\ICQ7.2
2010-12-28 08:41 . 2010-11-16 11:01 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{653D27EE-88FF-464A-9E92-9024BD76EB92}\mpengine.dll
2010-12-27 20:14 . 2010-12-27 20:14 -------- d-----w- c:\program files\SopCast
2010-12-27 12:35 . 2010-12-27 12:35 -------- d-----w- c:\programdata\ATI
2010-12-27 12:35 . 2010-12-27 12:35 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-12-27 12:34 . 2010-02-18 08:18 37944 ----a-w- c:\windows\system32\drivers\amdiox86.sys
2010-12-27 12:32 . 2010-12-27 12:32 -------- d-----w- C:\AMD
2010-12-26 18:20 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-26 18:20 . 2010-12-26 18:20 -------- d-----w- c:\programdata\Malwarebytes
2010-12-26 18:20 . 2010-12-26 18:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-26 18:20 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-25 14:24 . 2010-12-25 14:24 -------- d-----w- c:\program files\FreeTime
2010-12-24 09:47 . 2010-12-24 09:47 -------- d-----w- c:\program files\Activision
2010-12-24 09:22 . 2010-12-24 09:22 -------- d-----w- c:\program files\Lavalys
2010-12-23 19:52 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-12-23 19:52 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-12-23 19:52 . 2010-12-23 19:52 -------- d-----w- c:\windows\PCHEALTH
2010-12-23 19:52 . 2010-12-23 19:52 -------- d-----w- c:\program files\Microsoft.NET
2010-12-23 19:50 . 2010-12-23 19:50 -------- d-----r- C:\MSOCache
2010-12-23 18:17 . 2010-12-23 18:17 -------- d-----w- c:\program files\Zoner
2010-12-23 17:57 . 2008-11-16 23:00 342016 ----a-w- c:\windows\system32\eswiaud.dll
2010-12-23 17:57 . 2006-08-25 08:00 9216 ----a-w- c:\windows\system32\escdev.dll
2010-12-23 17:57 . 2010-12-23 17:57 -------- d-----w- c:\program files\epson
2010-12-23 17:54 . 2007-04-10 09:06 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-12-23 17:54 . 2008-08-08 10:09 86528 ----a-w- c:\windows\system32\E_FLBFDE.DLL
2010-12-23 17:54 . 2007-12-07 10:01 78848 ----a-w- c:\windows\system32\E_FD4BFDE.DLL
2010-12-23 17:54 . 2010-12-23 17:56 -------- d-----w- c:\programdata\EPSON
2010-12-23 16:46 . 2010-12-23 16:46 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-12-23 16:46 . 2010-12-23 16:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-12-23 16:44 . 2010-12-23 16:48 -------- d-----w- c:\program files\DivX
2010-12-23 16:43 . 2010-12-23 16:49 -------- d-----w- c:\programdata\DivX
2010-12-23 13:45 . 2010-12-23 13:45 -------- d-----w- c:\program files\VideoLAN
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\windows\system32\QuickTime
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\QuickTime
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\Common Files\TechSmith Shared
2010-12-23 12:32 . 2010-12-23 12:32 -------- d-----w- c:\program files\TechSmith
2010-12-23 12:30 . 2010-12-23 12:30 -------- d-----w- c:\program files\CCleaner
2010-12-23 12:25 . 2010-12-23 12:32 -------- d-----w- c:\programdata\TechSmith
2010-12-23 11:57 . 2010-12-26 10:53 -------- d-----w- C:\Fraps
2010-12-23 10:12 . 2010-12-23 10:12 -------- d-----w- C:\DirectX
2010-12-23 10:02 . 2010-12-23 10:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-12-23 10:02 . 2010-12-23 10:02 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-12-23 10:01 . 2010-12-23 10:02 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-12-22 20:56 . 2010-12-22 20:56 -------- d-----w- C:\PFiles
2010-12-22 15:23 . 2010-12-22 15:23 -------- d-----w- c:\windows\system32\RTCOM
2010-12-22 15:11 . 2010-12-22 15:11 -------- d-----w- c:\program files\Free Audio Editor
2010-12-22 11:08 . 2010-12-22 11:08 -------- d-----w- c:\users\Ostatní
2010-12-22 07:48 . 2010-12-22 07:48 176488 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10136.bin
2010-12-22 07:20 . 2010-12-22 07:20 -------- d-----w- c:\windows\system32\Wat
2010-12-21 22:16 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-12-21 22:15 . 2009-11-25 11:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-12-21 22:15 . 2009-11-25 11:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-12-21 22:15 . 2009-11-25 11:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-12-21 22:15 . 2009-11-25 11:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-12-21 22:15 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-12-21 22:11 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-12-21 22:10 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2010-12-21 16:59 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
2010-12-21 16:59 . 2010-12-21 16:59 -------- d-----w- C:\totalcmd
2010-12-21 08:56 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2010-12-21 08:56 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-12-21 08:56 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-12-21 08:54 . 2010-03-05 07:42 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-12-21 08:50 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-12-21 08:50 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-12-20 21:18 . 2010-12-20 21:18 -------- d-----w- c:\program files\Common Files\Adobe
2010-12-20 20:49 . 2010-12-20 20:49 -------- d-----w- c:\program files\ESET
2010-12-20 19:53 . 2010-12-28 08:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-12-20 19:53 . 2010-12-22 14:20 -------- d-----w- c:\program files\Valve
2010-12-20 19:53 . 2010-12-24 09:46 -------- d-----w- c:\program files\Common Files\InstallShield
2010-12-20 19:44 . 2010-10-19 09:41 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-12-20 19:37 . 2010-12-20 19:37 -------- d-----w- c:\windows\system32\Macromed
2010-12-20 19:26 . 2010-12-20 19:26 0 ----a-w- c:\windows\ativpsrm.bin
2010-12-20 19:22 . 2010-12-27 12:35 -------- d-sh--w- c:\windows\Installer
2010-12-20 19:22 . 2010-11-26 02:58 550400 ----a-w- c:\windows\system32\aticfx32.dll
2010-12-20 19:22 . 2010-11-26 02:49 4066816 ----a-w- c:\windows\system32\atidxx32.dll
2010-12-20 19:22 . 2010-11-26 02:30 4122624 ----a-w- c:\windows\system32\atiumdag.dll
2010-12-20 19:22 . 2010-11-26 02:24 52736 ----a-w- c:\windows\system32\coinst.dll
2010-12-20 19:22 . 2010-11-26 02:22 3460096 ----a-w- c:\windows\system32\atiumdva.dll
2010-12-20 19:22 . 2010-11-26 02:15 30720 ----a-w- c:\windows\system32\atiuxpag.dll
2010-12-20 19:22 . 2010-11-26 02:15 28672 ----a-w- c:\windows\system32\atiu9pag.dll
2010-12-20 19:22 . 2009-05-11 21:35 118784 ----a-w- c:\windows\system32\atibtmon.exe
2010-12-20 19:22 . 2010-12-20 19:22 -------- d-----w- c:\program files\ATI
2010-12-20 19:21 . 2010-12-27 12:35 -------- d-----w- c:\program files\ATI Technologies
2010-12-20 19:19 . 2010-12-28 16:38 -------- d-----w- c:\windows\system32\wbem\Performance
2010-12-20 18:58 . 2010-12-20 19:18 -------- d-----w- c:\windows\Panther
2010-12-02 08:25 . 2010-12-02 08:25 86016 ----a-w- c:\windows\system32\frapsvid.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-26 04:19 . 2010-11-26 04:19 6650368 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-11-26 03:02 . 2010-11-26 03:02 16702976 ----a-w- c:\windows\system32\atioglxx.dll
2010-11-26 02:58 . 2010-11-26 02:58 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-11-26 02:54 . 2010-11-26 02:54 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-11-26 02:54 . 2010-11-26 02:54 393216 ----a-w- c:\windows\system32\atieclxx.exe
2010-11-26 02:54 . 2010-11-26 02:54 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-11-26 02:52 . 2010-11-26 02:52 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-11-26 02:52 . 2010-11-26 02:52 15872 ----a-w- c:\windows\system32\atimuixx.dll
2010-11-26 02:52 . 2010-11-26 02:52 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-11-26 02:30 . 2010-11-26 02:30 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-11-26 02:30 . 2010-11-26 02:30 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-11-26 02:28 . 2010-11-26 02:28 5441024 ----a-w- c:\windows\system32\aticaldd.dll
2010-11-26 02:17 . 2010-11-26 02:17 249856 ----a-w- c:\windows\system32\atiadlxx.dll
2010-11-26 02:17 . 2010-11-26 02:17 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 27136 ----a-w- c:\windows\system32\atigktxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 231936 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-11-26 02:15 . 2010-11-26 02:15 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-02 04:39 . 2010-12-21 08:55 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 04:34 . 2010-12-21 08:55 179712 ----a-w- c:\windows\system32\schtasks.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-18 2219184]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-30 9914984]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-21 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-23 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 140224]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-09-03 137144]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-18 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: {26A0AE98-9276-4FBB-AA80-3214767AE065} = 10.10.10.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\730ycoe2.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Celkový čas: 2010-12-28 20:23:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-28 19:23
ComboFix2.txt 2010-12-28 10:26

Před spuštěním: Volných bajtů: 102 212 911 104
Po spuštění: Volných bajtů: 102 131 941 376

- - End Of File - - D64134E07261C09224267D71F7BBFF25

Příspěvekod **memphisto** » 28 pro 2010 22:11

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+HJT

Jak se chová PC?

M4RTY · Příspěvekod **M4RTY** » 29 pro 2010 11:19

Ještě ten Ccleaner a bude hotovo :)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:18:14, on 29.12.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Martin\Desktop\QIP Infium bz™Pack\inf.exe
C:\Users\Martin\Desktop\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3478 bytes

PC se chová normálně, před kontrolou, když jsem něco napsal v chrome (iron), tak se to tam zobrazilo až po chvilce a teď už je to dobrý.

Příspěvekod **memphisto** » 29 pro 2010 13:48

fixni:
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)

Vše, dál už víš,co bude následovat :smile:

M4RTY · Příspěvekod **M4RTY** » 29 pro 2010 16:21

OK, díky moc za čas

.
Tady ještě pro jistotu HJT log. Kdyby tam něco bylo, tak SZ :smile:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:19:58, on 29.12.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Martin\Desktop\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{26A0AE98-9276-4FBB-AA80-3214767AE065}: NameServer = 10.10.10.1
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3426 bytes

Vidím tam, že se zase objevilo O3 .. jakto ?

Prosím o preventivní kontrolu logu! Díky :) Vyřešeno

Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :)

Re: Prosím o preventivní kontrolu logu! Díky :) Vyřešeno

Kdo je online