Prosím o kontrolu log

[ttuky]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:14:40, on 11.2.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\TrayEverything\TrayEverything.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Toshiba TEMPRO\TemproTray.exe
C:\Program Files\IMTiger\TigerMsn\TigerMsn.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Creative\Software Update 3\SoftAuto.exe
C:\Users\Honza\Downloads\SRDownloader.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Family Toolbar\tbhelper.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: 216.107.250.194 nprotect.lineage2.com # Gameguard
O1 - Hosts: 92.240.237.20 l2authd.lineage2.com # Forbidden Lands Lineage 2 Server
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [TrayEverything] "C:\Program Files\TrayEverything\TrayEverything.exe" /windowsstartup
O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe
O4 - HKLM\..\Run: [TigerMsn] C:\Program Files\IMTiger\TigerMsn\TigerMsn.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SoftAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"
O4 - HKCU\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: O&O Defrag Agent (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TemproSvc.exe

--
End of file - 11235 bytes

[Reklama]

[Žbeky]

Ahoj. Nějaké konkrétní problémy?

Odinstaluj:
Family Toolbar
PC Tools Browser Guard
Spyware Doctor

V HJT fixni:

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Family Toolbar\tbhelper.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[ttuky]

Fixnuto,odinstalovano,vyčištěno.
Log je tady :

Malwarebytes' Anti-Malware 1.50.1.1100
http://www.malwarebytes.org

Verze databáze: 5740

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11.2.2011 15:04:33
mbam-log-2011-02-11 (15-04-26).txt

Typ kontroly: Rychlý test
Testované objekty: 160525
Uplynulý čas: 5 minut, 13 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 3
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Z30KYPG3WS (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Users\Honza\downloads\x64).portable.45193.exe (Trojan.FraudPack) -> No action taken.
c:\Windows\Pnakya.exe (Trojan.FraudPack) -> No action taken.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> No action taken.




BTW koukám že je něco špatně s nastavením bezpečnostních zón.S tím asi souvisí i nemožnost otevřít třeba v konzoli Služby ve standartním zobrazení atd....

[memphisto]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[ttuky]

LOG 1:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5740

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11.2.2011 15:16:23
mbam-log-2011-02-11 (15-16-23).txt

Typ kontroly: Rychlý test
Testované objekty: 160397
Uplynulý čas: 4 minut, 15 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 3
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Z30KYPG3WS (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Users\Honza\downloads\x64).portable.45193.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Windows\Pnakya.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.


LOG 2 :
ComboFix 11-02-10.01 - Honza 11.02.2011 15:19:39.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2046.1121 [GMT 1:00]
Spuštěný z: c:\users\Honza\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
ADS - system32: deleted 12 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\programdata\xp
c:\programdata\xp\EBLib.dll
c:\programdata\xp\TPwSav.sys
c:\windows\system32\drivers\uwpiri.sys

----- BITS: Možné infikované stránky -----

hxxp://wlxindex
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hxnh


((((((((((((((((((((((((( Soubory vytvořené od 2011-01-11 do 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\users\Honza\AppData\Roaming\Malwarebytes
2011-02-11 13:58 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\programdata\Malwarebytes
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-11 13:58 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-11 13:13 . 2011-02-11 13:13 388096 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-11 13:13 . 2011-02-11 13:13 -------- d-----w- c:\program files\Trend Micro
2011-02-11 12:34 . 2011-02-11 13:47 -------- d-----w- c:\program files\Spyware Doctor
2011-02-11 12:01 . 2011-02-11 13:25 -------- d-----w- c:\programdata\PC Tools
2011-02-11 10:47 . 2011-02-11 10:52 -------- d-----w- c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E}
2011-02-10 19:36 . 2011-02-10 19:36 -------- d-----w- c:\users\Honza\AppData\Local\ESET
2011-02-10 18:47 . 2011-02-10 18:53 -------- d-----w- c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE}
2011-02-10 05:18 . 2011-02-10 05:18 -------- d-----w- c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9}
2011-02-09 17:17 . 2011-02-09 17:17 -------- d-----w- c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D}
2011-02-09 05:17 . 2011-02-09 05:17 -------- d-----w- c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23}
2011-02-08 17:15 . 2011-02-08 17:16 -------- d-----w- c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE}
2011-02-07 17:15 . 2011-02-07 17:15 -------- d-----w- c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E}
2011-02-07 05:13 . 2011-02-07 05:15 -------- d-----w- c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D}
2011-02-06 16:56 . 2011-02-06 16:57 -------- d-----w- c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095}
2011-02-06 04:55 . 2011-02-06 04:56 -------- d-----w- c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146}
2011-02-04 13:42 . 2011-02-04 13:43 -------- d-----w- c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB}
2011-02-02 16:08 . 2011-02-02 16:08 -------- d-----w- c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0}
2011-02-01 17:11 . 2011-02-01 17:13 -------- d-----w- c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF}
2011-02-01 05:09 . 2011-02-01 05:10 -------- d-----w- c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96}
2011-01-31 17:08 . 2011-01-31 17:09 -------- d-----w- c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3}
2011-01-30 17:06 . 2011-01-30 17:06 -------- d-----w- c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF}
2011-01-30 05:04 . 2011-01-30 05:05 -------- d-----w- c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA}
2011-01-29 08:21 . 2011-01-29 08:23 -------- d-----w- c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653}
2011-01-28 20:00 . 2011-01-28 20:01 -------- d-----w- c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39}
2011-01-27 14:51 . 2011-01-27 14:53 -------- d-----w- c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1}
2011-01-26 23:34 . 2011-01-26 23:34 119808 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-01-26 23:02 . 2011-01-26 23:03 -------- d-----w- c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C}
2011-01-26 22:11 . 2011-01-26 22:11 -------- d-----w- c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF}
2011-01-26 22:07 . 2011-01-26 22:07 -------- d-----w- c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50}
2011-01-25 21:32 . 2011-01-25 21:32 -------- d-----w- c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF}
2011-01-24 17:29 . 2011-01-24 17:30 -------- d-----w- c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD}
2011-01-24 05:29 . 2011-01-24 05:29 -------- d-----w- c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C}
2011-01-23 17:28 . 2011-01-23 17:29 -------- d-----w- c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C}
2011-01-22 17:24 . 2011-01-22 17:25 -------- d-----w- c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3}
2011-01-22 05:24 . 2011-01-22 05:24 -------- d-----w- c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523}
2011-01-21 17:23 . 2011-01-21 17:24 -------- d-----w- c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4}
2011-01-21 05:20 . 2011-01-21 05:20 -------- d-----w- c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0}
2011-01-19 20:29 . 2011-01-21 14:53 -------- d-----w- c:\programdata\Soluto
2011-01-19 20:22 . 2011-01-21 05:27 -------- d-----w- c:\program files\Zrychleni Pocitace
2011-01-19 16:35 . 2011-01-19 16:35 -------- d-----w- c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41}
2011-01-19 15:27 . 2011-01-19 15:27 -------- d-----w- c:\windows\cs
2011-01-19 15:24 . 2011-01-19 15:24 -------- d-----w- c:\windows\en
2011-01-19 15:20 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2011-01-19 15:20 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-01-19 15:20 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-01-19 15:20 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-01-19 15:20 . 2011-01-19 15:20 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\60ff1cb51cbb7ec06\MeshBetaRemover.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-13 17:26 . 2010-12-13 17:26 74703 ----a-w- c:\windows\system32\mfc45.dll
2010-12-02 11:55 . 2010-12-02 11:55 1409 ----a-w- c:\windows\QTFont.for
2010-11-30 09:43 . 2010-12-20 18:19 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C773AA4F-D3B5-41D8-96CF-B14A4DB75435}\gapaengine.dll
2010-11-30 09:43 . 2010-12-20 18:18 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2010-11-25 07:44 . 2010-11-25 07:44 1629000 ----a-w- c:\windows\system32\ooscrsav.scr
2010-11-25 07:43 . 2010-11-25 07:43 275784 ----a-w- c:\windows\system32\oodbs.exe
2010-11-25 07:41 . 2010-11-25 07:41 535880 ----a-w- c:\windows\system32\oodssrs.dll
2010-11-25 07:41 . 2010-11-25 07:41 9544 ----a-w- c:\windows\system32\oodbsrs.dll
2010-11-16 11:01 . 2010-12-20 18:09 6273872 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83869308-D3B3-4E51-B8C0-56600748BFBE}\mpengine.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"TrayEverything"="c:\program files\TrayEverything\TrayEverything.exe" [2009-03-21 375808]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-11-05 480608]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2007-06-01 53248]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-05-11 1050072]
"TigerMsn"="c:\program files\IMTiger\TigerMsn\TigerMsn.exe" [2006-01-11 364544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-08-13 521528]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2010-11-25 2781000]
"ooccctrl.exe"="c:\program files\OO Software\CleverCache\ooccctrl.exe" [2006-06-20 763392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2009-04-10 417792]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\startupfolder\C:^Users^Honza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JP595IR86O

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=

R3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SRS_HDAL_Service;HD Audio Lab;c:\windows\system32\drivers\SRS_HDAL_i386.sys [2010-07-02 384752]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]
S2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2010-05-11 124368]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Honza\AppData\Roaming\Mozilla\Firefox\Profiles\2seuwlq4.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SmartFaceVWatcher - %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
HKLM-Run-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
SafeBoot-SolutoService


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOCC06.00.00.01WSSV"="763A1283D6E93EC73F661FA23DBDBCA4DA5B6D3E2F70EF7A8FF536AA431F6113DBCCA5B32AE135B1D1F9DD0900E65F07D303553565211B2F1348FE9DEBF8C43BE80DBDA2522275D77681343F937071751DECD53F3F3EF00740D8558CAA72A6565DDD587DE97EA65BE9E905BF9E0214AD11AC554E906E25062F84C4F6A0C8EEC72C8343F3FE6C87A09D00030D3C6C79B9BCB90D5222F701F3290AACE162DB9BB67CA6A33C9305EBD0B5F5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6A0AC4980AC79339DB7CE019D40AA5C527C0E6B0B0D9583D043AD710CFD4F70E4746A9FECE2C6F3208262AA56D2F1DFDCD9E28CBDD70B8F7A2DE30BC147F5B0DCE7D8CEDEB0712E509947986DDE9E1E260437EC72E754C4362C6F6CC1C5C2A9A4870025EB0A6937F62B9F8200985B6D0417DAC39E7BD025228B0B0855BA93653BEEA76CD2CF28409B45612DE4225CC8A0330E6DCC9615952D9C6475DB2AF75276418A9166A95B6216F9728282630D937BFC046C9981E6E09BB31CEB48DF34C3FD2357AA0F80631995E0300B55078B11671AE7E435C7443204A94ACA9EE5C26E50BEB1EC4803D7C21B95E8796E7CABE80BB7561F663B591CD3DA77157A8F4EED3C42B0B3202400237CB4629FF1F7F2A7E184600985ED8C1549A8A36F8AF0B7C0685E5E7C3998DB61E3E1D377966E9C3E3A358AB301BA74F379F7BEA2106314484C493AECCD5A9A894EC36A9B2B1C9601B5814DD2D7BBDB784BAF2F9E6384ABCBB53CB7C9262A230A0E05C44C0E0082A7CB239640A1D043C27A3E50F4EBB57AF54475BD0024878E374954776CB45E38CF48DAC7F8861FDED81813EE5AA81AB2D36EB5A79BB839A94879E38A85A53DC27849ECB59DC48F932406A34DA92E9DB659FAC3C3516C4AF7586CEBF8C27FE7DE07C02129722D4C7FF17D6821E0A06B20DB87E755775907ADE7C2A4B5F3706D01C47742DDE0A447F07389DD15213A76BB9685F013093104B4D874CE210D3E21CDDB062007F524336CBD8A0447B04A718827B9312926B4162973C9AB16A6C01BA0DE5C8EC9633909284B33E0C9F9B2D7BD903B7C35103CD65E62E003DE7B64B489BF3DE43DFB068510F78DFC220A69E441B8F7ADCAAE33265936AA1E3C6BA90EC7D93F006FBA3FA7C38672E34A94781BB1E93121710C1924D3606FCC627C230BD4674C3EE0BB2EB3979B93A7306CFE3FDD53FA3AA3D77FB8BABAC56179537BD05909A40407BEAF32124173DAB68EAF5BCA87BE5D5065908CAF7F9D321C3E6DCCB5C35BB74BAA36EFEF646B9833964F3AB1FB3875DB2A050F094E381BDCACC92DFA80D4C50B87457B9E57267B6F48386FFE8AF9EE1A41ADF14F2AAB793DB2F3E3EF8A4E1F150277AA"
"OODEFRAG14.00.00.01PROFESSIONAL"="515B8CF3C488F3B8A3125B966AC05D9926954B91E2396E1C952C04040E9B4B6C1287B389AA0789FB3A6D247E7B9B8473DCAA581B7E5ACD6F31D5C16234CDA1182B6786CD740B77F7D898CB5FD3F716B64E9E1EF99EEF449127A9E2025B28FD2D923D5A5F62F1C4BCF3533141064271E811CDA535C4942A984EC03513959152F9FE8267B3BA8D9AE9459296F9A7589AA0FDCA582CF8D27BB1C0E96F977CE0315F6C61CC914526C63849FDA2B8510DB609B45C870FC4AAD79E5E28A867AAE4D5D29B3A8A94CE73BC70C1735FFB23A892E1957865E5B71104B14A315CABBFDD9C5D119F862DA72490F034033B1A3D659BFDC850FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3D9DB7CE019D40AA5C43BFF1253B02117EB74C487C3951C287662CB72304D696A467A89E4833E33E59009A7F41B3646CABB133A31C1E4B089E5F14D2F7A1D9E573FBB69D377FA91ABF50262C721512D650CD082B4FF6555ADFEFF4C29799A06A19AA1E15250F62696D7449609FCC626DB6D4989A0B8A39F5B007212FA12C8C23B7AB56C1FE3AA28B600CC008A2EA3F92DB70842CB444D7DEAAF83EC6293D1254269BAAE227FD94244C1E9A95C92827696DACC0A4283324D99B7CC6BDB7D439836D7A393B71FBF49B1A133CFAD5DC2CDBD27F16483389A571832D0849471E1EFCCD2DF593A778169E6238DC34FD077417233DA1DF9B9FF6F41A0B23264AE970CFB9FC253785DD5B9DF73F88BB6CC83A8DABA0D43A15ED4774C6788F90242B75CE571463753D3640CCDB3C9E12BE68CC726CC873A94C155B47A8BD154D2C7A051080059F2274B4502247AAD23D87CE8C401AB6958260588887900552202E138B7044429C15C1AD2DDC25682E454B8A71339CD1A91FE31D3B93045FB8576AD60A0FE52670AAB4990DFA15B48AB585CC854D91646F5C5EEF718CBB3E0F3F16C6924E59EA8541CD96B7C069351920A46DE5D3C81D7C1D4AFEC05A277B6E2A588C4F554D339C3C80648CB82B745C9A88E346CEC78D3945969B4E26E7D044704CF3FB8F9C82468437E6FAAB96DEAD3C0950EB8BC42D61C0A6BFD6DDD0DD53EB046C692CDBC06A06CEA9092C9947B72170F1321CAE5508FBD184A8336D2631FA028AFB9D50BAC2AF19D7CF8CD7617BEAFAB1865526C58F68E2A8A79DFA1147013E062A1C7621DFF359C2FC6729484ABDDB976ACFFC1F32FA198F4BD66BE9526326398223FA0823CC495FD09699F6CEC23A51F5E93E697C3027409D5CE260E58E1826A3704067C33416C6223B67D183A6AD325244A60D4E02B3E4BF713D87E6EEE870C2085D9CCC2A6135D839879C3799C52F3E43A45B5E755A4DE29A05578F79DFDE27B09DE61DB33F0CF2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3764)
c:\program files\IMTiger\TigerMsn\hookDll0.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\rundll32.exe
c:\program files\Creative\Shared Files\CTDevSrv.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\OO Software\CleverCache\ooccag.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-02-11 15:44:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-11 14:44

Před spuštěním: 8 554 737 664
Po spuštění: 9 414 443 008

- - End Of File - - 44A2E0665D80EAB20DDD51E220403C1B

[Žbeky]

Odinstaluj Spyware doctora.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Folder::
c:\users\Honza\AppData\Local\ESET

Driver::
ehdrv
epfwwfp

File::
c:\windows\system32\DRIVERS\ehdrv.sys
c:\windows\system32\DRIVERS\epfwwfp.sys

DirLook::
c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E}
c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE}
c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9}
c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D}
c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23}
c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE}
c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E}
c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D}
c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095}
c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146}
c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB}
c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0}
c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF}
c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96}
c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3}
c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF}
c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA}
c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653}
c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39}
c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1}
c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C}
c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF}
c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50}
c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF}
c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD}
c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C}
c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C}
c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3}
c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523}
c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4}
c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0}
c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41}

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=-
"ConsentPromptBehaviorUser"=-
"EnableLUA"=-
"EnableUIADesktopToggle"=-
"PromptOnSecureDesktop"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

RegNull::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[ttuky]

Script spuštěný

LOG:

ComboFix 11-02-10.01 - Honza 11.02.2011 17:51:14.2.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2046.1323 [GMT 1:00]
Spuštěný z: c:\users\Honza\Desktop\Údržba\ComboFix.exe
Použité ovládací přepínače :: c:\users\Honza\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení

FILE ::
"c:\windows\system32\DRIVERS\ehdrv.sys"
"c:\windows\system32\DRIVERS\epfwwfp.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Honza\AppData\Local\ESET
c:\windows\system32\DRIVERS\ehdrv.sys . . . . nemohl být smazán
c:\windows\system32\DRIVERS\epfwwfp.sys . . . . nemohl být smazán

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EHDRV
-------\Legacy_EPFWWFP
-------\Service_ehdrv
-------\Service_epfwwfp


((((((((((((((((((((((((( Soubory vytvořené od 2011-01-11 do 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-11 16:58 . 2011-02-11 17:00 -------- d-----w- c:\users\Honza\AppData\Local\temp
2011-02-11 16:58 . 2011-02-11 16:58 -------- d-----w- c:\users\Ostatní\AppData\Local\temp
2011-02-11 16:58 . 2011-02-11 16:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-11 16:18 . 2011-02-11 16:18 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBE0CA6D-4450-4482-AAC1-E944A59C931E}\MpKsla5425177.sys
2011-02-11 16:17 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBE0CA6D-4450-4482-AAC1-E944A59C931E}\mpengine.dll
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\users\Honza\AppData\Roaming\Malwarebytes
2011-02-11 13:58 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\programdata\Malwarebytes
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-11 13:58 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-11 13:13 . 2011-02-11 13:13 388096 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-11 13:13 . 2011-02-11 13:13 -------- d-----w- c:\program files\Trend Micro
2011-02-11 12:34 . 2011-02-11 13:47 -------- d-----w- c:\program files\Spyware Doctor
2011-02-11 12:01 . 2011-02-11 13:25 -------- d-----w- c:\programdata\PC Tools
2011-02-11 10:47 . 2011-02-11 10:52 -------- d-----w- c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E}
2011-02-10 18:47 . 2011-02-10 18:53 -------- d-----w- c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE}
2011-02-10 05:18 . 2011-02-10 05:18 -------- d-----w- c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9}
2011-02-09 17:17 . 2011-02-09 17:17 -------- d-----w- c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D}
2011-02-09 05:17 . 2011-02-09 05:17 -------- d-----w- c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23}
2011-02-08 17:15 . 2011-02-08 17:16 -------- d-----w- c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE}
2011-02-07 17:15 . 2011-02-07 17:15 -------- d-----w- c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E}
2011-02-07 05:13 . 2011-02-07 05:15 -------- d-----w- c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D}
2011-02-06 16:56 . 2011-02-06 16:57 -------- d-----w- c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095}
2011-02-06 04:55 . 2011-02-06 04:56 -------- d-----w- c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146}
2011-02-04 13:42 . 2011-02-04 13:43 -------- d-----w- c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB}
2011-02-02 16:08 . 2011-02-02 16:08 -------- d-----w- c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0}
2011-02-01 17:11 . 2011-02-01 17:13 -------- d-----w- c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF}
2011-02-01 05:09 . 2011-02-01 05:10 -------- d-----w- c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96}
2011-01-31 17:08 . 2011-01-31 17:09 -------- d-----w- c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3}
2011-01-30 17:06 . 2011-01-30 17:06 -------- d-----w- c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF}
2011-01-30 05:04 . 2011-01-30 05:05 -------- d-----w- c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA}
2011-01-29 08:21 . 2011-01-29 08:23 -------- d-----w- c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653}
2011-01-28 20:00 . 2011-01-28 20:01 -------- d-----w- c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39}
2011-01-27 14:51 . 2011-01-27 14:53 -------- d-----w- c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1}
2011-01-26 23:34 . 2011-01-26 23:34 119808 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-01-26 23:02 . 2011-01-26 23:03 -------- d-----w- c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C}
2011-01-26 22:11 . 2011-01-26 22:11 -------- d-----w- c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF}
2011-01-26 22:07 . 2011-01-26 22:07 -------- d-----w- c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50}
2011-01-25 21:32 . 2011-01-25 21:32 -------- d-----w- c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF}
2011-01-24 17:29 . 2011-01-24 17:30 -------- d-----w- c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD}
2011-01-24 05:29 . 2011-01-24 05:29 -------- d-----w- c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C}
2011-01-23 17:28 . 2011-01-23 17:29 -------- d-----w- c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C}
2011-01-22 17:24 . 2011-01-22 17:25 -------- d-----w- c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3}
2011-01-22 05:24 . 2011-01-22 05:24 -------- d-----w- c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523}
2011-01-21 17:23 . 2011-01-21 17:24 -------- d-----w- c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4}
2011-01-21 05:20 . 2011-01-21 05:20 -------- d-----w- c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0}
2011-01-19 20:29 . 2011-01-21 14:53 -------- d-----w- c:\programdata\Soluto
2011-01-19 20:22 . 2011-01-21 05:27 -------- d-----w- c:\program files\Zrychleni Pocitace
2011-01-19 16:35 . 2011-01-19 16:35 -------- d-----w- c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41}
2011-01-19 15:27 . 2011-01-19 15:27 -------- d-----w- c:\windows\cs
2011-01-19 15:24 . 2011-01-19 15:24 -------- d-----w- c:\windows\en
2011-01-19 15:20 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2011-01-19 15:20 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-01-19 15:20 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-01-19 15:20 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-01-19 15:20 . 2011-01-19 15:20 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\60ff1cb51cbb7ec06\MeshBetaRemover.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-11 16:57 . 2009-02-06 13:24 38240 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-02-11 16:57 . 2009-02-06 13:23 106208 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-01-13 09:41 . 2010-12-22 14:08 5890896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-12-13 17:26 . 2010-12-13 17:26 74703 ----a-w- c:\windows\system32\mfc45.dll
2010-12-02 11:55 . 2010-12-02 11:55 1409 ----a-w- c:\windows\QTFont.for
2010-11-30 09:43 . 2010-12-20 18:19 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C773AA4F-D3B5-41D8-96CF-B14A4DB75435}\gapaengine.dll
2010-11-30 09:43 . 2010-12-20 18:18 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2010-11-25 07:44 . 2010-11-25 07:44 1629000 ----a-w- c:\windows\system32\ooscrsav.scr
2010-11-25 07:43 . 2010-11-25 07:43 275784 ----a-w- c:\windows\system32\oodbs.exe
2010-11-25 07:41 . 2010-11-25 07:41 535880 ----a-w- c:\windows\system32\oodssrs.dll
2010-11-25 07:41 . 2010-11-25 07:41 9544 ----a-w- c:\windows\system32\oodbsrs.dll
2010-11-16 11:01 . 2010-12-20 18:09 6273872 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83869308-D3B3-4E51-B8C0-56600748BFBE}\mpengine.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD} ----


---- Directory of c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF} ----


---- Directory of c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095} ----


---- Directory of c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E} ----


---- Directory of c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523} ----


---- Directory of c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146} ----


---- Directory of c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50} ----


---- Directory of c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3} ----


---- Directory of c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D} ----


---- Directory of c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF} ----


---- Directory of c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE} ----


---- Directory of c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4} ----


---- Directory of c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1} ----


---- Directory of c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0} ----


---- Directory of c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB} ----


---- Directory of c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3} ----


---- Directory of c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF} ----


---- Directory of c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E} ----


---- Directory of c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41} ----


---- Directory of c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C} ----


---- Directory of c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9} ----


---- Directory of c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23} ----


---- Directory of c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C} ----


---- Directory of c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39} ----


---- Directory of c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653} ----


---- Directory of c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96} ----


---- Directory of c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA} ----


---- Directory of c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C} ----


---- Directory of c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0} ----


---- Directory of c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF} ----


---- Directory of c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D} ----


---- Directory of c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE} ----



(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"TrayEverything"="c:\program files\TrayEverything\TrayEverything.exe" [2009-03-21 375808]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-11-05 480608]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2007-06-01 53248]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-05-11 1050072]
"TigerMsn"="c:\program files\IMTiger\TigerMsn\TigerMsn.exe" [2006-01-11 364544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-08-13 521528]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2010-11-25 2781000]
"ooccctrl.exe"="c:\program files\OO Software\CleverCache\ooccctrl.exe" [2006-06-20 763392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2009-04-10 417792]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\startupfolder\C:^Users^Honza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=

R3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SRS_HDAL_Service;HD Audio Lab;c:\windows\system32\drivers\SRS_HDAL_i386.sys [2010-07-02 384752]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 MpKsla5425177;MpKsla5425177;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBE0CA6D-4450-4482-AAC1-E944A59C931E}\MpKsla5425177.sys [2011-02-11 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2010-05-11 124368]
S3 CFcatchme;CFcatchme;c:\users\Honza\AppData\Local\Temp\CFcatchme.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Honza\AppData\Roaming\Mozilla\Firefox\Profiles\2seuwlq4.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOCC06.00.00.01WSSV"="763A1283D6E93EC73F661FA23DBDBCA4DA5B6D3E2F70EF7A8FF536AA431F6113DBCCA5B32AE135B1D1F9DD0900E65F07D303553565211B2F1348FE9DEBF8C43BE80DBDA2522275D77681343F937071751DECD53F3F3EF00740D8558CAA72A6565DDD587DE97EA65BE9E905BF9E0214AD11AC554E906E25062F84C4F6A0C8EEC72C8343F3FE6C87A09D00030D3C6C79B9BCB90D5222F701F3290AACE162DB9BB67CA6A33C9305EBD0B5F5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6A0AC4980AC79339DB7CE019D40AA5C527C0E6B0B0D9583D043AD710CFD4F70E4746A9FECE2C6F3208262AA56D2F1DFDCD9E28CBDD70B8F7A2DE30BC147F5B0DCE7D8CEDEB0712E509947986DDE9E1E260437EC72E754C4362C6F6CC1C5C2A9A4870025EB0A6937F62B9F8200985B6D0417DAC39E7BD025228B0B0855BA93653BEEA76CD2CF28409B45612DE4225CC8A0330E6DCC9615952D9C6475DB2AF75276418A9166A95B6216F9728282630D937BFC046C9981E6E09BB31CEB48DF34C3FD2357AA0F80631995E0300B55078B11671AE7E435C7443204A94ACA9EE5C26E50BEB1EC4803D7C21B95E8796E7CABE80BB7561F663B591CD3DA77157A8F4EED3C42B0B3202400237CB4629FF1F7F2A7E184600985ED8C1549A8A36F8AF0B7C0685E5E7C3998DB61E3E1D377966E9C3E3A358AB301BA74F379F7BEA2106314484C493AECCD5A9A894EC36A9B2B1C9601B5814DD2D7BBDB784BAF2F9E6384ABCBB53CB7C9262A230A0E05C44C0E0082A7CB239640A1D043C27A3E50F4EBB57AF54475BD0024878E374954776CB45E38CF48DAC7F8861FDED81813EE5AA81AB2D36EB5A79BB839A94879E38A85A53DC27849ECB59DC48F932406A34DA92E9DB659FAC3C3516C4AF7586CEBF8C27FE7DE07C02129722D4C7FF17D6821E0A06B20DB87E755775907ADE7C2A4B5F3706D01C47742DDE0A447F07389DD15213A76BB9685F013093104B4D874CE210D3E21CDDB062007F524336CBD8A0447B04A718827B9312926B4162973C9AB16A6C01BA0DE5C8EC9633909284B33E0C9F9B2D7BD903B7C35103CD65E62E003DE7B64B489BF3DE43DFB068510F78DFC220A69E441B8F7ADCAAE33265936AA1E3C6BA90EC7D93F006FBA3FA7C38672E34A94781BB1E93121710C1924D3606FCC627C230BD4674C3EE0BB2EB3979B93A7306CFE3FDD53FA3AA3D77FB8BABAC56179537BD05909A40407BEAF32124173DAB68EAF5BCA87BE5D5065908CAF7F9D321C3E6DCCB5C35BB74BAA36EFEF646B9833964F3AB1FB3875DB2A050F094E381BDCACC92DFA80D4C50B87457B9E57267B6F48386FFE8AF9EE1A41ADF14F2AAB793DB2F3E3EF8A4E1F150277AA"
"OODEFRAG14.00.00.01PROFESSIONAL"="515B8CF3C488F3B8A3125B966AC05D9926954B91E2396E1C952C04040E9B4B6C1287B389AA0789FB3A6D247E7B9B8473DCAA581B7E5ACD6F31D5C16234CDA1182B6786CD740B77F7D898CB5FD3F716B64E9E1EF99EEF449127A9E2025B28FD2D923D5A5F62F1C4BCF3533141064271E811CDA535C4942A984EC03513959152F9FE8267B3BA8D9AE9459296F9A7589AA0FDCA582CF8D27BB1C0E96F977CE0315F6C61CC914526C63849FDA2B8510DB609B45C870FC4AAD79E5E28A867AAE4D5D29B3A8A94CE73BC70C1735FFB23A892E1957865E5B71104B14A315CABBFDD9C5D119F862DA72490F034033B1A3D659BFDC850FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3D9DB7CE019D40AA5C43BFF1253B02117EB74C487C3951C287662CB72304D696A467A89E4833E33E59009A7F41B3646CABB133A31C1E4B089E5F14D2F7A1D9E573FBB69D377FA91ABF50262C721512D650CD082B4FF6555ADFEFF4C29799A06A19AA1E15250F62696D7449609FCC626DB6D4989A0B8A39F5B007212FA12C8C23B7AB56C1FE3AA28B600CC008A2EA3F92DB70842CB444D7DEAAF83EC6293D1254269BAAE227FD94244C1E9A95C92827696DACC0A4283324D99B7CC6BDB7D439836D7A393B71FBF49B1A133CFAD5DC2CDBD27F16483389A571832D0849471E1EFCCD2DF593A778169E6238DC34FD077417233DA1DF9B9FF6F41A0B23264AE970CFB9FC253785DD5B9DF73F88BB6CC83A8DABA0D43A15ED4774C6788F90242B75CE571463753D3640CCDB3C9E12BE68CC726CC873A94C155B47A8BD154D2C7A051080059F2274B4502247AAD23D87CE8C401AB6958260588887900552202E138B7044429C15C1AD2DDC25682E454B8A71339CD1A91FE31D3B93045FB8576AD60A0FE52670AAB4990DFA15B48AB585CC854D91646F5C5EEF718CBB3E0F3F16C6924E59EA8541CD96B7C069351920A46DE5D3C81D7C1D4AFEC05A277B6E2A588C4F554D339C3C80648CB82B745C9A88E346CEC78D3945969B4E26E7D044704CF3FB8F9C82468437E6FAAB96DEAD3C0950EB8BC42D61C0A6BFD6DDD0DD53EB046C692CDBC06A06CEA9092C9947B72170F1321CAE5508FBD184A8336D2631FA028AFB9D50BAC2AF19D7CF8CD7617BEAFAB1865526C58F68E2A8A79DFA1147013E062A1C7621DFF359C2FC6729484ABDDB976ACFFC1F32FA198F4BD66BE9526326398223FA0823CC495FD09699F6CEC23A51F5E93E697C3027409D5CE260E58E1826A3704067C33416C6223B67D183A6AD325244A60D4E02B3E4BF713D87E6EEE870C2085D9CCC2A6135D839879C3799C52F3E43A45B5E755A4DE29A05578F79DFDE27B09DE61DB33F0CF2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3984)
c:\program files\IMTiger\TigerMsn\hookDll0.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Creative\Shared Files\CTDevSrv.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\OO Software\CleverCache\ooccag.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2011-02-11 18:05:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-11 17:05
ComboFix2.txt 2011-02-11 14:44

Před spuštěním: Volných bajtů: 15 659 388 928
Po spuštění: Volných bajtů: 15 678 447 616

- - End Of File - - B5FA4FC216F8D7377BB73F4B23F7D828

[Žbeky]

Takže ještě jednou
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Folder::
c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E}
c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE}
c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9}
c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D}
c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23}
c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE}
c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E}
c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D}
c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095}
c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146}
c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB}
c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0}
c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF}
c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96}
c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3}
c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF}
c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA}
c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653}
c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39}
c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1}
c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C}
c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF}
c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50}
c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF}
c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD}
c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C}
c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C}
c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3}
c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523}
c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4}
c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0}
c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41}

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[ttuky]

jdu na to

EDIT LOG :

ComboFix 11-02-10.01 - Honza 11.02.2011 18:44:52.3.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2046.1288 [GMT 1:00]
Spuštěný z: c:\users\Honza\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Honza\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Honza\AppData\Local\{09DBA737-1BD9-4B28-83DF-3217A88FD9DD}
c:\users\Honza\AppData\Local\{0C1F4A5D-6B7A-473F-9605-D8A4E8D77AEF}
c:\users\Honza\AppData\Local\{103B030A-E703-4785-9E3B-F2F1F6EF7095}
c:\users\Honza\AppData\Local\{1A86E4ED-B28C-4AFA-9BAF-165C28D8196E}
c:\users\Honza\AppData\Local\{1EB75712-96FE-4A6D-9DF2-4A8472647523}
c:\users\Honza\AppData\Local\{22553ACD-62BF-4781-8C1A-0A59F6264146}
c:\users\Honza\AppData\Local\{24BE774E-6215-45B3-8829-6B70A0796B50}
c:\users\Honza\AppData\Local\{26529FAD-A446-4C2E-BF42-E64A7AA78BA3}
c:\users\Honza\AppData\Local\{2B7DA6C6-74EF-4DCC-9634-F603BFAB411D}
c:\users\Honza\AppData\Local\{3892746C-664A-4BFC-B623-699866864CDF}
c:\users\Honza\AppData\Local\{3E04A013-B829-40E9-90D9-CF1B413647DE}
c:\users\Honza\AppData\Local\{3F1A2AAF-77CB-4732-8738-835238F769B4}
c:\users\Honza\AppData\Local\{465DE971-4FB4-4124-BA64-54FBB348DDE1}
c:\users\Honza\AppData\Local\{4B82B72D-2EA9-487E-B42D-65B3904CECE0}
c:\users\Honza\AppData\Local\{509203B9-1354-4EDB-8FBD-22F6A51AFADB}
c:\users\Honza\AppData\Local\{51883FA2-14EC-49EE-8F18-22B28B7EB3B3}
c:\users\Honza\AppData\Local\{6379F7F5-0F8F-49AF-ADE3-3F87FF5FECBF}
c:\users\Honza\AppData\Local\{72CD7294-A598-45C1-81E2-D2A544AD2A4E}
c:\users\Honza\AppData\Local\{828D0FB1-F51C-47DF-8935-D139F2C8ED41}
c:\users\Honza\AppData\Local\{8A2836EB-F227-4A30-A041-6EC9F221AA0C}
c:\users\Honza\AppData\Local\{9B7230C5-9F68-4831-A8CC-8FDF541801A9}
c:\users\Honza\AppData\Local\{9C5A01D1-0FE5-4865-B431-E4CEEDD8CA23}
c:\users\Honza\AppData\Local\{9D834D04-6DFF-4F7A-80AA-EE4FFC98A87C}
c:\users\Honza\AppData\Local\{A3FA4757-6C74-4B78-857E-155E452E4D39}
c:\users\Honza\AppData\Local\{A5C07026-724C-4C14-9D98-C81A1414E653}
c:\users\Honza\AppData\Local\{AA8E942F-4C8B-4860-84F2-4B21D51FFF96}
c:\users\Honza\AppData\Local\{B9551C5D-D335-4E17-8FF0-7B58729771FA}
c:\users\Honza\AppData\Local\{BDDCFC01-EB4B-45D6-8A8B-BF98C3DD226C}
c:\users\Honza\AppData\Local\{E1AECAB5-921C-41FF-AF26-37FCABAA09D0}
c:\users\Honza\AppData\Local\{E1E6EB73-E168-4426-B73B-7388C7A93BCF}
c:\users\Honza\AppData\Local\{F4DF40E2-F17A-45BC-92FA-EAB8A9058E0D}
c:\users\Honza\AppData\Local\{FB7C7470-7844-41E0-81C5-9085E05C3DAE}

.
((((((((((((((((((((((((( Soubory vytvořené od 2011-01-11 do 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-11 17:54 . 2011-02-11 17:54 -------- d-----w- c:\users\Ostatní\AppData\Local\temp
2011-02-11 17:54 . 2011-02-11 17:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-11 16:58 . 2011-02-11 17:56 -------- d-----w- c:\users\Honza\AppData\Local\temp
2011-02-11 16:17 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBE0CA6D-4450-4482-AAC1-E944A59C931E}\mpengine.dll
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\users\Honza\AppData\Roaming\Malwarebytes
2011-02-11 13:58 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\programdata\Malwarebytes
2011-02-11 13:58 . 2011-02-11 13:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-11 13:58 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-11 13:13 . 2011-02-11 13:13 388096 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-11 13:13 . 2011-02-11 13:13 -------- d-----w- c:\program files\Trend Micro
2011-02-11 12:34 . 2011-02-11 13:47 -------- d-----w- c:\program files\Spyware Doctor
2011-02-11 12:01 . 2011-02-11 13:25 -------- d-----w- c:\programdata\PC Tools
2011-01-26 23:34 . 2011-01-26 23:34 119808 ----a-r- c:\users\Honza\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-01-19 20:29 . 2011-01-21 14:53 -------- d-----w- c:\programdata\Soluto
2011-01-19 20:22 . 2011-01-21 05:27 -------- d-----w- c:\program files\Zrychleni Pocitace
2011-01-19 15:27 . 2011-01-19 15:27 -------- d-----w- c:\windows\cs
2011-01-19 15:24 . 2011-01-19 15:24 -------- d-----w- c:\windows\en
2011-01-19 15:20 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2011-01-19 15:20 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-01-19 15:20 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-01-19 15:20 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-01-19 15:20 . 2011-01-19 15:20 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\60ff1cb51cbb7ec06\MeshBetaRemover.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-11 16:57 . 2009-02-06 13:24 38240 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2011-02-11 16:57 . 2009-02-06 13:23 106208 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2011-01-13 09:41 . 2010-12-22 14:08 5890896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-12-13 17:26 . 2010-12-13 17:26 74703 ----a-w- c:\windows\system32\mfc45.dll
2010-12-02 11:55 . 2010-12-02 11:55 1409 ----a-w- c:\windows\QTFont.for
2010-11-30 09:43 . 2010-12-20 18:19 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C773AA4F-D3B5-41D8-96CF-B14A4DB75435}\gapaengine.dll
2010-11-30 09:43 . 2010-12-20 18:18 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2010-11-25 07:44 . 2010-11-25 07:44 1629000 ----a-w- c:\windows\system32\ooscrsav.scr
2010-11-25 07:43 . 2010-11-25 07:43 275784 ----a-w- c:\windows\system32\oodbs.exe
2010-11-25 07:41 . 2010-11-25 07:41 535880 ----a-w- c:\windows\system32\oodssrs.dll
2010-11-25 07:41 . 2010-11-25 07:41 9544 ----a-w- c:\windows\system32\oodbsrs.dll
2010-11-16 11:01 . 2010-12-20 18:09 6273872 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83869308-D3B3-4E51-B8C0-56600748BFBE}\mpengine.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"TrayEverything"="c:\program files\TrayEverything\TrayEverything.exe" [2009-03-21 375808]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-11-05 480608]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2007-06-01 53248]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-05-11 1050072]
"TigerMsn"="c:\program files\IMTiger\TigerMsn\TigerMsn.exe" [2006-01-11 364544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-08-13 521528]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2010-11-25 2781000]
"ooccctrl.exe"="c:\program files\OO Software\CleverCache\ooccctrl.exe" [2006-06-20 763392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2009-04-10 417792]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\startupfolder\C:^Users^Honza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=

R3 CFcatchme;CFcatchme;c:\users\Honza\AppData\Local\Temp\CFcatchme.sys [x]
R3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SRS_HDAL_Service;HD Audio Lab;c:\windows\system32\drivers\SRS_HDAL_i386.sys [2010-07-02 384752]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2010-05-11 124368]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Honza\AppData\Roaming\Mozilla\Firefox\Profiles\2seuwlq4.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOCC06.00.00.01WSSV"="763A1283D6E93EC73F661FA23DBDBCA4DA5B6D3E2F70EF7A8FF536AA431F6113DBCCA5B32AE135B1D1F9DD0900E65F07D303553565211B2F1348FE9DEBF8C43BE80DBDA2522275D77681343F937071751DECD53F3F3EF00740D8558CAA72A6565DDD587DE97EA65BE9E905BF9E0214AD11AC554E906E25062F84C4F6A0C8EEC72C8343F3FE6C87A09D00030D3C6C79B9BCB90D5222F701F3290AACE162DB9BB67CA6A33C9305EBD0B5F5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6A0AC4980AC79339DB7CE019D40AA5C527C0E6B0B0D9583D043AD710CFD4F70E4746A9FECE2C6F3208262AA56D2F1DFDCD9E28CBDD70B8F7A2DE30BC147F5B0DCE7D8CEDEB0712E509947986DDE9E1E260437EC72E754C4362C6F6CC1C5C2A9A4870025EB0A6937F62B9F8200985B6D0417DAC39E7BD025228B0B0855BA93653BEEA76CD2CF28409B45612DE4225CC8A0330E6DCC9615952D9C6475DB2AF75276418A9166A95B6216F9728282630D937BFC046C9981E6E09BB31CEB48DF34C3FD2357AA0F80631995E0300B55078B11671AE7E435C7443204A94ACA9EE5C26E50BEB1EC4803D7C21B95E8796E7CABE80BB7561F663B591CD3DA77157A8F4EED3C42B0B3202400237CB4629FF1F7F2A7E184600985ED8C1549A8A36F8AF0B7C0685E5E7C3998DB61E3E1D377966E9C3E3A358AB301BA74F379F7BEA2106314484C493AECCD5A9A894EC36A9B2B1C9601B5814DD2D7BBDB784BAF2F9E6384ABCBB53CB7C9262A230A0E05C44C0E0082A7CB239640A1D043C27A3E50F4EBB57AF54475BD0024878E374954776CB45E38CF48DAC7F8861FDED81813EE5AA81AB2D36EB5A79BB839A94879E38A85A53DC27849ECB59DC48F932406A34DA92E9DB659FAC3C3516C4AF7586CEBF8C27FE7DE07C02129722D4C7FF17D6821E0A06B20DB87E755775907ADE7C2A4B5F3706D01C47742DDE0A447F07389DD15213A76BB9685F013093104B4D874CE210D3E21CDDB062007F524336CBD8A0447B04A718827B9312926B4162973C9AB16A6C01BA0DE5C8EC9633909284B33E0C9F9B2D7BD903B7C35103CD65E62E003DE7B64B489BF3DE43DFB068510F78DFC220A69E441B8F7ADCAAE33265936AA1E3C6BA90EC7D93F006FBA3FA7C38672E34A94781BB1E93121710C1924D3606FCC627C230BD4674C3EE0BB2EB3979B93A7306CFE3FDD53FA3AA3D77FB8BABAC56179537BD05909A40407BEAF32124173DAB68EAF5BCA87BE5D5065908CAF7F9D321C3E6DCCB5C35BB74BAA36EFEF646B9833964F3AB1FB3875DB2A050F094E381BDCACC92DFA80D4C50B87457B9E57267B6F48386FFE8AF9EE1A41ADF14F2AAB793DB2F3E3EF8A4E1F150277AA"
"OODEFRAG14.00.00.01PROFESSIONAL"="515B8CF3C488F3B8A3125B966AC05D9926954B91E2396E1C952C04040E9B4B6C1287B389AA0789FB3A6D247E7B9B8473DCAA581B7E5ACD6F31D5C16234CDA1182B6786CD740B77F7D898CB5FD3F716B64E9E1EF99EEF449127A9E2025B28FD2D923D5A5F62F1C4BCF3533141064271E811CDA535C4942A984EC03513959152F9FE8267B3BA8D9AE9459296F9A7589AA0FDCA582CF8D27BB1C0E96F977CE0315F6C61CC914526C63849FDA2B8510DB609B45C870FC4AAD79E5E28A867AAE4D5D29B3A8A94CE73BC70C1735FFB23A892E1957865E5B71104B14A315CABBFDD9C5D119F862DA72490F034033B1A3D659BFDC850FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3D9DB7CE019D40AA5C43BFF1253B02117EB74C487C3951C287662CB72304D696A467A89E4833E33E59009A7F41B3646CABB133A31C1E4B089E5F14D2F7A1D9E573FBB69D377FA91ABF50262C721512D650CD082B4FF6555ADFEFF4C29799A06A19AA1E15250F62696D7449609FCC626DB6D4989A0B8A39F5B007212FA12C8C23B7AB56C1FE3AA28B600CC008A2EA3F92DB70842CB444D7DEAAF83EC6293D1254269BAAE227FD94244C1E9A95C92827696DACC0A4283324D99B7CC6BDB7D439836D7A393B71FBF49B1A133CFAD5DC2CDBD27F16483389A571832D0849471E1EFCCD2DF593A778169E6238DC34FD077417233DA1DF9B9FF6F41A0B23264AE970CFB9FC253785DD5B9DF73F88BB6CC83A8DABA0D43A15ED4774C6788F90242B75CE571463753D3640CCDB3C9E12BE68CC726CC873A94C155B47A8BD154D2C7A051080059F2274B4502247AAD23D87CE8C401AB6958260588887900552202E138B7044429C15C1AD2DDC25682E454B8A71339CD1A91FE31D3B93045FB8576AD60A0FE52670AAB4990DFA15B48AB585CC854D91646F5C5EEF718CBB3E0F3F16C6924E59EA8541CD96B7C069351920A46DE5D3C81D7C1D4AFEC05A277B6E2A588C4F554D339C3C80648CB82B745C9A88E346CEC78D3945969B4E26E7D044704CF3FB8F9C82468437E6FAAB96DEAD3C0950EB8BC42D61C0A6BFD6DDD0DD53EB046C692CDBC06A06CEA9092C9947B72170F1321CAE5508FBD184A8336D2631FA028AFB9D50BAC2AF19D7CF8CD7617BEAFAB1865526C58F68E2A8A79DFA1147013E062A1C7621DFF359C2FC6729484ABDDB976ACFFC1F32FA198F4BD66BE9526326398223FA0823CC495FD09699F6CEC23A51F5E93E697C3027409D5CE260E58E1826A3704067C33416C6223B67D183A6AD325244A60D4E02B3E4BF713D87E6EEE870C2085D9CCC2A6135D839879C3799C52F3E43A45B5E755A4DE29A05578F79DFDE27B09DE61DB33F0CF2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(2620)
c:\program files\IMTiger\TigerMsn\hookDll0.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Creative\Shared Files\CTDevSrv.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\OO Software\CleverCache\ooccag.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-02-11 19:08:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-11 18:08
ComboFix2.txt 2011-02-11 17:05
ComboFix3.txt 2011-02-11 14:44

Před spuštěním: Volných bajtů: 13 845 057 536
Po spuštění: Volných bajtů: 13 772 390 400

- - End Of File - - B6CF5FDF431B2BCD708D94FB67E6FCD6

[ttuky]

snad už to ted bude v poradku :)

[bledulka]

Ahoj, záskok za kolegu
Stahni Rsit http://images.malwareremoval.com/random/RSIT.exe
-spusť, klikni na tlačítko Continue
-po skenu na tebe vyběhne log.txt,obsah vlož zde

[ttuky]

Ahoj :) Šmarjá Vás tam je

LOG:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Honza at 2011-02-11 19:23:54
Microsoft Windows 7 Professional
System drive C: has 12 GB (16%) free of 76 GB
Total RAM: 2046 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:24:29, on 11.2.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\TrayEverything\TrayEverything.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Toshiba TEMPRO\TemproTray.exe
C:\Program Files\IMTiger\TigerMsn\TigerMsn.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\Explorer.exe
C:\Program Files\Opera\opera.exe
C:\Users\Honza\Downloads\SRDownloader.exe
C:\Users\Honza\AppData\Local\Opera\Opera\temporary_downloads\RSIT.exe
C:\Program Files\trend micro\Honza.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [TrayEverything] "C:\Program Files\TrayEverything\TrayEverything.exe" /windowsstartup
O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe
O4 - HKLM\..\Run: [TigerMsn] C:\Program Files\IMTiger\TigerMsn\TigerMsn.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKCU\..\Run: [SoftAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Creative Centrale Media Server (CTUPnPSv) - Creative Technology Ltd - C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: O&O Defrag Agent (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

--
End of file - 8103 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-06-01 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"TrayEverything"=C:\Program Files\TrayEverything\TrayEverything.exe [2009-03-21 375808]
"TPwrMain"=C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [2009-11-05 480608]
"TPNF"=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe [2007-06-01 53248]
"Toshiba TEMPRO"=C:\Program Files\Toshiba TEMPRO\TemproTray.exe [2010-05-11 1050072]
"TigerMsn"=C:\Program Files\IMTiger\TigerMsn\TigerMsn.exe [2006-01-11 364544]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"SmoothView"=C:\Program Files\Toshiba\SmoothView\SmoothView.exe [2009-08-13 521528]
"OODefragTray"=C:\Program Files\OO Software\Defrag\oodtray.exe [2010-11-25 2781000]
"ooccctrl.exe"=C:\Program Files\OO Software\CleverCache\ooccctrl.exe [2006-06-20 763392]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408]
"Microsoft Default Manager"=C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [2010-05-10 439568]
"HSON"=C:\Program Files\TOSHIBA\TBS\HSON.exe [2009-03-09 55160]
"fssui"=C:\Program Files\Windows Live\Family Safety\fsui.exe [2010-09-22 884584]
"Camera Assistant Software"=C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [2009-04-10 417792]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SoftAuto.exe"=C:\Program Files\Creative\Software Update 3\SoftAuto.exe [2008-08-13 405504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Honza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\xchat\xchat.exe"="C:\Program Files\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-02-11 19:23:54 ----D---- C:\rsit
2011-02-11 19:08:35 ----D---- C:\Windows\temp
2011-02-11 19:08:28 ----A---- C:\ComboFix.txt
2011-02-11 19:06:19 ----SHD---- C:\$RECYCLE.BIN
2011-02-11 18:42:42 ----A---- C:\Windows\SWXCACLS.exe
2011-02-11 15:17:33 ----A---- C:\Windows\zip.exe
2011-02-11 15:17:33 ----A---- C:\Windows\SWSC.exe
2011-02-11 15:17:33 ----A---- C:\Windows\SWREG.exe
2011-02-11 15:17:33 ----A---- C:\Windows\sed.exe
2011-02-11 15:17:33 ----A---- C:\Windows\PEV.exe
2011-02-11 15:17:33 ----A---- C:\Windows\NIRCMD.exe
2011-02-11 15:17:33 ----A---- C:\Windows\MBR.exe
2011-02-11 15:17:33 ----A---- C:\Windows\grep.exe
2011-02-11 15:17:26 ----D---- C:\Windows\ERDNT
2011-02-11 15:17:18 ----D---- C:\Qoobox
2011-02-11 14:58:22 ----D---- C:\Users\Honza\AppData\Roaming\Malwarebytes
2011-02-11 14:58:17 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2011-02-11 14:58:16 ----D---- C:\ProgramData\Malwarebytes
2011-02-11 14:58:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-02-11 14:58:12 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-02-11 14:13:10 ----D---- C:\Program Files\Trend Micro
2011-02-11 13:34:31 ----D---- C:\Program Files\Spyware Doctor
2011-02-11 13:01:04 ----D---- C:\ProgramData\PC Tools
2011-02-10 23:20:37 ----A---- C:\Windows\ntbtlog.txt
2011-02-10 20:05:49 ----D---- C:\Users\Honza\AppData\Roaming\ESET
2011-02-10 19:55:24 ----D---- C:\ProgramData\ESET
2011-01-21 06:19:43 ----A---- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2011-01-19 21:29:25 ----D---- C:\ProgramData\Soluto
2011-01-19 21:22:02 ----D---- C:\Program Files\Zrychleni Pocitace
2011-01-19 16:27:34 ----D---- C:\Windows\cs
2011-01-19 16:24:41 ----D---- C:\Windows\en
2011-01-19 16:20:29 ----A---- C:\Windows\system32\XAudio2_5.dll
2011-01-19 16:20:29 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2011-01-19 16:20:29 ----A---- C:\Windows\system32\d3dx10_42.dll
2011-01-19 16:20:24 ----A---- C:\Windows\system32\d3dx9_32.dll

======List of files/folders modified in the last 1 months======

2011-02-11 19:08:39 ----D---- C:\Windows\system32\drivers
2011-02-11 19:08:35 ----D---- C:\Windows
2011-02-11 18:56:45 ----A---- C:\Windows\system.ini
2011-02-11 18:56:12 ----D---- C:\Windows\system32\drivers\etc
2011-02-11 18:48:16 ----D---- C:\Windows\AppPatch
2011-02-11 18:48:16 ----AD---- C:\Windows\System32
2011-02-11 18:48:15 ----D---- C:\Program Files\Common Files
2011-02-11 18:33:38 ----D---- C:\AiroWizard
2011-02-11 17:58:57 ----D---- C:\Windows\system32\config
2011-02-11 17:30:12 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-02-11 15:42:24 ----D---- C:\Windows\Tasks
2011-02-11 15:42:24 ----D---- C:\Windows\system32\Tasks
2011-02-11 15:26:48 ----D---- C:\ProgramData
2011-02-11 15:16:45 ----D---- C:\Windows\Prefetch
2011-02-11 14:58:12 ----RD---- C:\Program Files
2011-02-11 14:55:42 ----D---- C:\Windows\Downloaded Program Files
2011-02-11 14:51:19 ----D---- C:\Program Files\Family Toolbar
2011-02-11 14:49:23 ----D---- C:\Program Files\MacroGamer
2011-02-11 14:48:35 ----SHD---- C:\Windows\Installer
2011-02-11 14:48:35 ----D---- C:\Config.Msi
2011-02-11 14:47:46 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-02-11 14:33:13 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-02-11 14:25:51 ----AD---- C:\ProgramData\TEMP
2011-02-11 12:57:28 ----D---- C:\Program Files\Ask.com
2011-02-11 11:47:01 ----D---- C:\Windows\system32\LogFiles
2011-02-11 10:56:44 ----D---- C:\Windows\pss
2011-02-10 23:26:34 ----D---- C:\Windows\Minidump
2011-02-10 23:12:03 ----D---- C:\Windows\system32\catroot2
2011-02-10 21:27:09 ----D---- C:\Windows\system32\DriverStore
2011-02-10 21:27:09 ----D---- C:\Windows\system32\catroot
2011-02-10 21:27:09 ----D---- C:\Windows\inf
2011-02-01 19:32:41 ----D---- C:\Program Files\CommViewWiFi
2011-02-01 05:30:42 ----D---- C:\Windows\Microsoft.NET
2011-02-01 05:30:41 ----RSD---- C:\Windows\assembly
2011-01-30 17:30:48 ----D---- C:\Users\Honza\AppData\Roaming\Opera
2011-01-30 17:30:44 ----D---- C:\Program Files\Opera
2011-01-26 23:19:27 ----D---- C:\Windows\system32\NDF
2011-01-21 10:36:34 ----DC---- C:\Windows\system32\DRVSTORE
2011-01-21 06:40:01 ----D---- C:\Windows\system32\oodag
2011-01-21 06:31:56 ----SHD---- C:\System Volume Information
2011-01-19 16:20:39 ----D---- C:\Program Files\Windows Live

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-06-04 330264]
R0 LPCFilter;LPC Lower Filter Driver; C:\Windows\system32\DRIVERS\LPCFilter.sys [2009-07-30 36208]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2009-07-14 23512]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2010-01-01 26024]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys [2010-01-29 82320]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-10-24 165264]
R1 MpKsle7177930;MpKsle7177930; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C598E5D2-F3B1-4FF9-AD89-48213C27128C}\MpKsle7177930.sys [2011-02-11 28752]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-08-09 39264]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-13 1035776]
R3 AR5211;[CommView] Atheros Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\ar5211.sys [2008-01-21 558624]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-11-01 3170304]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-01-24 290304]
R3 tosrfec;Bluetooth ACPI; C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 9216]
R3 UVCFTR;UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [2009-04-10 17960]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 61883;61883 Unit Device; C:\Windows\system32\DRIVERS\61883.sys [2009-07-14 46976]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-09-21 1218048]
S3 Avc;Zařízení AVC; C:\Windows\system32\DRIVERS\avc.sys [2009-07-14 40320]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 catchme;catchme; \??\C:\Users\Honza\AppData\Local\Temp\catchme.sys []
S3 CFcatchme;CFcatchme; \??\C:\Users\Honza\AppData\Local\Temp\CFcatchme.sys []
S3 mbr;mbr; \??\C:\Users\Honza\AppData\Local\Temp\mbr.sys []
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2009-07-14 52608]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SRS_HDAL_Service;HD Audio Lab; C:\Windows\system32\drivers\SRS_HDAL_i386.sys [2010-07-02 384752]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S3 WinUsb;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-11-01 626688]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 CTDevice_Srv;CT Device Query service; C:\Program Files\Creative\Shared Files\CTDevSrv.exe [2007-04-02 61440]
R2 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2010-09-22 1493352]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 11736]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 OOCleverCacheAgent;O&O CleverCache Agent; C:\Program Files\OO Software\CleverCache\ooccag.exe [2006-06-20 162304]
R2 OODefragAgent;O&O Defrag Agent; C:\Program Files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO); C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [2010-05-11 124368]
R2 TosCoSrv;TOSHIBA Power Saver; C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe [2009-11-05 468320]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2010-04-25 72704]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CTUPnPSv;Creative Centrale Media Server; C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------