prosim o kontrolu logu.

[jaboos]

Logfile of HijackThis v1.99.1
Scan saved at 18:25:03, on 26.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avast4\aswUpdSv.exe
I:\Program Files\Avast4\ashServ.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
H:\WINDOWS\System32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
I:\Program Files\Avast4\ashWebSv.exe
H:\WINDOWS\Explorer.EXE
I:\Program Files\Avast4\ashMaiSv.exe
H:\WINDOWS\System32\RUNDLL32.EXE
H:\WINDOWS\System32\rundll32.exe
I:\Program Files\Winamp\winampa.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
I:\PROGRA~1\Avast4\ashDisp.exe
I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
H:\WINDOWS\SOUNDMAN.EXE
I:\Program Files\ICQLite\ICQLite.exe
H:\Program Files\Common Files\Real\Update_OB\realsched.exe
I:\Program Files\TopDesk\topdesk.exe
H:\WINDOWS\System32\ctfmon.exe
H:\Program Files\Internet Explorer\iexplore.exe
h:\progra~1\intern~1\iexplore.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
H:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
I:\Program Files\GetRight\getright.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Documents and Settings\Dušan.JABOOS\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - I:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - H:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - H:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - H:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - H:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - H:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] I:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "H:\WINDOWS\TEMP\E_S8A.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ICQ Lite] "I:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [TkBellExe] "H:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TopDesk] I:\Program Files\TopDesk\topdesk.exe
O4 - HKLM\..\Run: [proc setup bows burn] H:\Documents and Settings\All Users\Data aplikací\ace dale proc setup\TestExtra.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "H:\DOCUME~1\DUŠAN~1.JAB\LOCALS~1\Temp\E_SD.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "I:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RealPlayer] "I:\PROGRA~1\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Dash Live] H:\DOCUME~1\DUŠAN~1.JAB\DATAAP~1\MAGSSO~1\INTERNETCHINTOOL.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = I:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://I:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight Pro - I:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://I:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Pro Browser - I:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - I:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - I:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - I:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - I:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - I:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe

[Reklama]

[sakiri]

ok takže si stáhni Avenger a spusť ho pod účtem administrátora.
Zvol možnost - Input script manuall.

A klikni na ikonku lupy vyskočí prázdné okno kam zkopíruj ten tučně označený text:
Folders to delete:
H:\Documents and Settings\All Users\Data aplikací\ace dale proc setup
H:\DOCUME~1\DUŠAN~1.JAB\DATAAP~1\MAGSSO~1
H:\Documents and Settings\Dušan.JABOOS\DATAAP~1\NetPumper
Pak klikni na Done.
Poté klikni na ikonku lupy.Vyskočí ti hláška kde odklikni Yes poté další hláška kde odklikni opět Yes.
PC se restartuje po restartu by se ti měl objevit výpis z Avengeru tak ho sem zkopíruj
+ sem dej nový log z HJT + poté bych znovu poprosil log z LopFind.

[jaboos]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\kmqqrrsw

*******************

Script file located at: \??\H:\Program Files\uaejqybf.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at H:\Avenger

*******************

Beginning to process script file:

Folder H:\Documents and Settings\All Users\Data aplikací\ace dale proc setup deleted successfully.
Folder H:\DOCUME~1\DUŠAN~1.JAB\DATAAP~1\MAGSSO~1 deleted successfully.
Folder H:\Documents and Settings\Dušan.JABOOS\DATAAP~1\NetPumper deleted successfully.

Completed script processing.

*******************

Finished! Terminate.



Logfile of HijackThis v1.99.1
Scan saved at 20:09:48, on 26.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avast4\aswUpdSv.exe
I:\Program Files\Avast4\ashServ.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
H:\WINDOWS\System32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\System32\RUNDLL32.EXE
I:\Program Files\Winamp\winampa.exe
H:\WINDOWS\System32\rundll32.exe
I:\Program Files\Avast4\ashWebSv.exe
I:\PROGRA~1\Avast4\ashDisp.exe
I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
H:\WINDOWS\SOUNDMAN.EXE
I:\Program Files\Avast4\ashMaiSv.exe
I:\Program Files\ICQLite\ICQLite.exe
H:\Program Files\Common Files\Real\Update_OB\realsched.exe
I:\Program Files\TopDesk\topdesk.exe
H:\WINDOWS\System32\ctfmon.exe
I:\Program Files\Skype\Phone\Skype.exe
H:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
I:\Program Files\GetRight\getright.exe
H:\WINDOWS\system32\notepad.exe
I:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
I:\Program Files\Skype\Plugin Manager\SkypePM.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Documents and Settings\Dušan.JABOOS\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - I:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - H:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - H:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - H:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - H:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - H:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] I:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "H:\WINDOWS\TEMP\E_S8A.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ICQ Lite] "I:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [TkBellExe] "H:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TopDesk] I:\Program Files\TopDesk\topdesk.exe
O4 - HKLM\..\Run: [proc setup bows burn] H:\Documents and Settings\All Users\Data aplikací\ace dale proc setup\TestExtra.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "H:\DOCUME~1\DUŠAN~1.JAB\LOCALS~1\Temp\E_SD.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "I:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RealPlayer] "I:\PROGRA~1\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Dash Live] H:\DOCUME~1\DUŠAN~1.JAB\DATAAP~1\MAGSSO~1\INTERNETCHINTOOL.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] I:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: GetRight - Tray Icon.lnk = I:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://I:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight Pro - I:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://I:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Pro Browser - I:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - I:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - I:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - I:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - I:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - I:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe




******************************************

1) Výpis obsahů Application Data složek pro zjištění podezřelých adresářů:

Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\All Users\DATAAP~1

17.02.2007 18:20 <DIR> Google
11.02.2007 10:05 <DIR> Skype
04.02.2007 14:35 <DIR> nView_Profiles
03.02.2007 13:22 <DIR> Martau
01.02.2007 18:09 <DIR> CyberLink
30.01.2007 15:12 <DIR> UDL
26.01.2007 17:28 <DIR> QuickTime
28.12.2006 16:10 62 desktop.ini
28.12.2006 16:09 <DIR> Microsoft
28.12.2006 16:09 <DIR> .
28.12.2006 16:09 <DIR> ..
1 soubor…, 62 bajt…
Adres ý…: 10, Volněch bajt…: 151973888
Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\Duçan.JABOOS\DATAAP~1

24.03.2007 12:40 34 pcouffin.log
24.03.2007 12:40 1074 pcouffin.cat
24.03.2007 12:40 47360 pcouffin.sys
24.03.2007 12:40 1144 pcouffin.inf
24.03.2007 12:40 87608 ezpinst.exe
24.03.2007 12:40 <DIR> Vso
21.02.2007 19:34 <DIR> RapidGet
20.02.2007 14:01 <DIR> WNR
14.02.2007 19:14 <DIR> Google
14.02.2007 13:41 <DIR> Help
13.02.2007 19:21 <DIR> Sun
13.02.2007 11:26 <DIR> Mozilla
12.02.2007 22:01 <DIR> MegauploadToolbar
12.02.2007 16:25 <DIR> Adobe
12.02.2007 13:17 <DIR> ICQLite
12.02.2007 13:15 <DIR> Macromedia
12.02.2007 12:58 <DIR> Mikrotik
11.02.2007 10:12 <DIR> XnView
11.02.2007 10:05 <DIR> Skype
11.02.2007 10:01 <DIR> ACD Systems
11.02.2007 09:59 <DIR> uTorrent
10.02.2007 18:57 <DIR> Lavasoft
07.02.2007 17:09 <DIR> Talkback
01.02.2007 18:10 <DIR> CyberLink
30.01.2007 15:31 <DIR> EPSON
23.01.2007 16:24 <DIR> Real
23.01.2007 16:23 <DIR> Identities
23.01.2007 16:23 62 desktop.ini
23.01.2007 16:23 <DIR> ..
23.01.2007 16:23 <DIR> .
23.01.2007 16:23 <DIR> Microsoft
6 soubor…, 137282 bajt…
Adres ý…: 25, Volněch bajt…: 151973888
Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\Duçan.JABOOS\DATAAP~1

24.03.2007 12:40 34 pcouffin.log
24.03.2007 12:40 1074 pcouffin.cat
24.03.2007 12:40 47360 pcouffin.sys
24.03.2007 12:40 1144 pcouffin.inf
24.03.2007 12:40 87608 ezpinst.exe
24.03.2007 12:40 <DIR> Vso
21.02.2007 19:34 <DIR> RapidGet
20.02.2007 14:01 <DIR> WNR
14.02.2007 19:14 <DIR> Google
14.02.2007 13:41 <DIR> Help
13.02.2007 19:21 <DIR> Sun
13.02.2007 11:26 <DIR> Mozilla
12.02.2007 22:01 <DIR> MegauploadToolbar
12.02.2007 16:25 <DIR> Adobe
12.02.2007 13:17 <DIR> ICQLite
12.02.2007 13:15 <DIR> Macromedia
12.02.2007 12:58 <DIR> Mikrotik
11.02.2007 10:12 <DIR> XnView
11.02.2007 10:05 <DIR> Skype
11.02.2007 10:01 <DIR> ACD Systems
11.02.2007 09:59 <DIR> uTorrent
10.02.2007 18:57 <DIR> Lavasoft
07.02.2007 17:09 <DIR> Talkback
01.02.2007 18:10 <DIR> CyberLink
30.01.2007 15:31 <DIR> EPSON
23.01.2007 16:24 <DIR> Real
23.01.2007 16:23 <DIR> Identities
23.01.2007 16:23 62 desktop.ini
23.01.2007 16:23 <DIR> ..
23.01.2007 16:23 <DIR> .
23.01.2007 16:23 <DIR> Microsoft
6 soubor…, 137282 bajt…
Adres ý…: 25, Volněch bajt…: 151842816
Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\Default User\DATAAP~1

28.12.2006 16:10 62 desktop.ini
28.12.2006 16:09 <DIR> Microsoft
28.12.2006 16:09 <DIR> ..
28.12.2006 16:09 <DIR> .
1 soubor…, 62 bajt…
Adres ý…: 3, Volněch bajt…: 151969792
Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\LocalService\DATAAP~1

28.12.2006 16:19 <DIR> ..
28.12.2006 16:19 <DIR> Microsoft
28.12.2006 16:19 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 3, Volněch bajt…: 151969792
Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\Documents and Settings\NetworkService\DATAAP~1

28.12.2006 16:19 <DIR> ..
28.12.2006 16:19 <DIR> Microsoft
28.12.2006 16:19 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 3, Volněch bajt…: 151969792

******************************************

2) Vyhledávání a odstranění podezřelých .job souborů:

a) Soubory přítomné v H:\WINDOWS\tasks\ adresáři:

Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\WINDOWS\Tasks

28.12.2006 16:16 6 SA.DAT
28.12.2006 16:15 65 desktop.ini
28.12.2006 16:15 <DIR> ..
28.12.2006 16:15 <DIR> .
2 soubor…, 71 bajt…
Adres ý…: 2, Volněch bajt…: 151˙969˙792

––––––––––––––––––––––––––––––––––––––––––

b) Nalezené a odstraněné nežádoucí soubory:


––––––––––––––––––––––––––––––––––––––––––

c) Soubory přítomné v adresáři po vymazání:

Svazek v jednotce H nem § dnou jmenovku.
S‚riov‚ źˇslo svazku je 1801-C356.

Věpis adres ýe H:\WINDOWS\Tasks

28.12.2006 16:16 6 SA.DAT
28.12.2006 16:15 65 desktop.ini
28.12.2006 16:15 <DIR> ..
28.12.2006 16:15 <DIR> .
2 soubor…, 71 bajt…
Adres ý…: 2, Volněch bajt…: 151˙977˙984

******************************************

3) Vyhledávání podvodných programů ve složce Program files:


Adresář H:\Program Files\Adv Nepřítomen !

Adresář H:\Program Files\Adverts Nepřítomen !

Adresář H:\Program Files\BitGrabber Nepřítomen !

Adresář H:\Program Files\BitRoll Nepřítomen !

Adresář H:\Program Files\C2Media Nepřítomen !

Adresář H:\Program Files\Download Plugin Nepřítomen !

Adresář H:\Program Files\Messenger Plus! 3 Nepřítomen !

Adresář H:\Program Files\NetPumper Nepřítomen !

Adresář H:\Program Files\Proxy download Nepřítomen !

Adresář H:\Program Files\SuperTorrent Nepřítomen !

Adresář H:\Program Files\Torrent101 Nepřítomen !

[sakiri]

takže jo v HJT už jenom fixni tyto položky:
O4 - HKLM\..\Run: [proc setup bows burn] H:\Documents and Settings\All Users\Data aplikací\ace dale proc setup\TestExtra.exe
O4 - HKCU\..\Run: [Dash Live] H:\DOCUME~1\DUŠAN~1.JAB\DATAAP~1\MAGSSO~1\INTERNETCHINTOOL.exe

A to je vše.

Jinak bych také odinstaloval ten Megaupload Toolbar pokud ho nutně nepotřebuješ.