Prosím o kontrolu logu HijackThis Vyřešeno

[martin krok]

Results of screen317's Security Check version 0.99.73
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
ESET NOD32 Antivirus
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Adobe Flash Player 11.8.800.94
Google Chrome 29.0.1547.57
Google Chrome 29.0.1547.62
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C::
````````````````````End of Log``````````````````````

[Reklama]

[MiliNess]

http://leteckaposta.cz/659116185
a ten CDI je co a jak mam to udělat

V ptotokolu událostí to neukládej jako txt soubor, ale jako evt soubor.
CDI == CrystalDiskInfo == to co jsi dělal na minulé stránce.

[jaro3]

Použij tohle:

Stáhni si rkill
a spusť ho . Spustí se sken .Po skenu se program sám ukončí.
Pozn.: NERESTARTUJ PC !

Uninstall NOD32:
http://www.nod32.nl/download/tool/nod32removal.exe

http://kb.eset.com/esetkb/index?page=co ... raft=false

[martin krok]

Rkill 2.6.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 09/09/2013 07:03:15 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Reparse Point/Junctions Found (Most likely legitimate)!

* C:\WINDOWS\assembly\GAC_MSIL\CCC\2.0.0.0__90ba9c70f846762e => C:\WINDOWS\WinSxS\MSIL_CCC_90ba9c70f846762e_2.0.0.0_x-ww_c7ed2bb0 [Dir]
* C:\WINDOWS\assembly\GAC_MSIL\CLI\2.0.0.0__90ba9c70f846762e => C:\WINDOWS\WinSxS\MSIL_CLI_90ba9c70f846762e_2.0.0.0_x-ww_42656733 [Dir]
* C:\WINDOWS\assembly\GAC_MSIL\LOG\2.0.3693.42530__90ba9c70f846762e => C:\WINDOWS\WinSxS\MSIL_LOG_90ba9c70f846762e_2.0.3693.42530_x-ww_47e32df4 [Dir]
* C:\WINDOWS\assembly\GAC_MSIL\MOM\2.0.0.0__90ba9c70f846762e => C:\WINDOWS\WinSxS\MSIL_MOM_90ba9c70f846762e_2.0.0.0_x-ww_a60193a8 [Dir]
* C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a => C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 [Dir]

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 09/09/2013 07:04:28 PM
Execution time: 0 hours(s), 1 minute(s), and 12 seconds(s)

[jaro3]

Odinstaloval si ten NOD?

[martin krok]

skoušel jsem to ale furt mi ukazuje že je nainstalovanej

[martin krok]

to jsou všechny nainstalované programy



Adobe Flash Player 11 Plugin Adobe Systems Incorporated 6.9.2013 11.8.800.94
ATI Catalyst Control Center 2.010.0210.2338
ATI Display Driver 1.9.2013 8.593.100-100210a-095952E-ATI
avast! Free Antivirus AVAST Software 8.9.2013 8.0.1497.0
BS.Player FREE AB Team, d.o.o. 8.9.2013 2.64.1073
CCleaner Piriform 21.8.2013 4.05
Dream Aquarium 9.9.2013
ESET NOD32 Antiviru ESET, spol s r. o. 11.8.2013 60,45MB 6.0.316.2
Google Chrome Google Inc. 22.8.2013 29.0.1547.62
Intel Application Accelerator 31.5.2013
MadOnion.com/3DMark2001 SE 31.5.2013
Malwarebytes Anti-Malware verze 1.75.0.1300 Malwarebytes Corporation 1.9.2013 1.75.0.1300
Microsoft .NET Framework 1.1 9.7.2013
Microsoft .NET Framework 1.1 Czech Language Pack Microsoft 1.6.2013 2,92MB 1.1.4322
Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 14.8.2013 539,00MB 2.2.30729
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - CSY Microsoft Corporation 22.8.2013 6,05MB 2.2.30729
Microsoft .NET Framework 3.0 Service Pack 2 Microsoft Corporation 9.7.2013 286,00MB 3.2.30729
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - CSY Microsoft Corporation 22.8.2013 9,88MB 3.2.30729
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 9.7.2013
Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY Microsoft Corporation 22.8.2013
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 22.8.2013 4.0.30319
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 7.9.2013 10,20MB 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2.7.2013 15,00MB 10.0.40219
Mortyr 2 v 1.350 Mirage Interactive 1.9.2013
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2.7.2013 1,42MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2.7.2013 2,77MB 4.20.9876.0
Nokia Connectivity Cable Driver 7.1.32.69
Realtek AC'97 Audio Realtek Semiconductor Corp. 31.5.2013 5.34
Skype™ 6.7 Skype Technologies S.A. 3.8.2013 22,90MB 6.7.102
Softarová utilita ATI - Odinstalovat 31.5.2013 6.14.10.1022
Windows Genuine Advantage Validation Tool (KB892130) Microsoft Corporation 31.5.2013
Windows Internet Explorer 8 Microsoft Corporation 1.6.2013 20090308.140743
Windows Media Player 11 1.9.2013
YTD Video Downloader 4.5.1 GreenTree Applications SRL 8.9.2013 4.5.1

[jaro3]

A normálně odinstalovat přes přidat/odebrat programy nejde?

Tak ho smažeme ručně:

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

jinak si myslím , že když si ho tam už měl a čas uplynul , tak ho tam asi znovu nedáš , pokud ho nemáš placený.

[peposlowak@gmail.com]

Prosim o kontrolu logu Pc mi nejde vypnout pres start. Diki.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:52:01, on 10.9.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\IObit\Advanced SystemCare 6\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mysearchresults.com/?c=3513&t=07
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: SimilarWeb - {74198672-5F7D-4FE9-A611-4AC1D5A66A15} - C:\Program Files\SimilarWeb\SimilarWeb.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BBroowseu2save - {31580BBD-6A44-663F-A6D7-F820FCC48B37} - (no file)
O2 - BHO: Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~1\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Data Manager - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL
O2 - BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\OnlineBanking\online_banking_bho.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~1\IObit\ADVANC~2\BROWER~1\ASCPLU~1.DLL
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
O3 - Toolbar: SimilarWeb - {74198672-5F7D-4FE9-A611-4AC1D5A66A15} - C:\Program Files\SimilarWeb\SimilarWeb.dll
O3 - Toolbar: Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~1\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe"
O4 - HKLM\..\Run: [IObit Malware Fighter] "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstall ... QBNAEIAUgA"&"inst=NwA2AC0AMQA1ADEAOAA1ADcAMAA1ADYAMAAtAFYATwBQADkAKwAxAC0ARABEAFQAKwAwAC0ARAAzADgAMQBMACsANQA"&"prod=54"&"ver=9.0.914
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Advanced SystemCare 6] "C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart
O4 - HKCU\..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\ie_banner_deny.htm
O9 - Extra button: Virtuální klávesnice - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: SimilarWeb - {5D06ED6E-DA78-4486-A246-B131A2C39807} - C:\Program Files\SimilarWeb\SimilarWeb.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Kontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - (no CLSID) - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\DATAAP~1\Wincert\WIN32C~1.DLL C:\PROGRA~1\SEARCH~1\Datamngr\mgrldr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
O23 - Service: Datamngr Coordinator (DatamngrCoordinator) - Unknown owner - C:\Program Files\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe (file missing)
O23 - Service: DefaultTabUpdate - Unknown owner - C:\Documents and Settings\pito\Data aplikací\DefaultTab\DefaultTab\DTUpdate.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 10685 bytes

[jaro3]

peposlowak@gmail.com --založ si prosím vlastní téma..a pak to tu smažu.

[martin krok]

ComboFix 13-09-10.01 - SMCeleron 10.09.2013 19:03:25.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.580 [GMT 2:00]
Spuštěný z: D:\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-10 do 2013-09-10 )))))))))))))))))))))))))))))))
.
.
2013-09-09 19:26 . 2013-09-09 19:26 -------- d--h--w- c:\windows\PIF
2013-09-09 18:46 . 2013-09-10 03:07 -------- d-----w- c:\program files\Unlocker
2013-09-09 18:46 . 2013-09-09 18:46 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\Babylon
2013-09-09 18:46 . 2013-09-09 18:46 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Babylon
2013-09-08 22:20 . 2013-09-08 22:23 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\Dream Aquarium
2013-09-08 22:20 . 2013-09-08 22:20 -------- d-----w- c:\program files\Dream Aquarium
2013-09-08 11:49 . 2013-09-08 11:51 -------- d-----w- c:\documents and settings\All Users\Data aplikací\YTD Video Downloader
2013-09-08 11:49 . 2013-09-08 11:49 -------- d-----w- c:\program files\GreenTree Applications
2013-09-08 09:51 . 2013-09-08 09:51 -------- d-----w- c:\windows\system32\wbem\Repository
2013-09-08 01:09 . 2013-09-08 01:09 -------- d-----w- c:\program files\TeamViewer
2013-09-07 21:36 . 2013-09-08 02:24 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\AIMP3
2013-09-07 21:36 . 2013-09-07 21:42 -------- d-----w- c:\program files\AIMP3
2013-09-07 09:25 . 2013-09-07 09:25 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\OpenCandy
2013-09-07 09:10 . 2013-08-30 07:48 369584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-09-07 09:10 . 2013-08-30 07:48 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-09-07 09:10 . 2013-08-30 07:48 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-09-07 09:10 . 2013-08-30 07:48 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-09-07 09:10 . 2013-08-30 07:48 177864 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-09-07 09:10 . 2013-08-30 07:48 770344 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-09-07 09:10 . 2013-08-30 07:48 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-09-07 09:10 . 2013-08-30 07:48 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-09-07 09:10 . 2013-08-30 07:47 229648 ----a-w- c:\windows\system32\aswBoot.exe
2013-09-07 09:09 . 2013-08-30 07:47 41664 ----a-w- c:\windows\avastSS.scr
2013-09-07 09:08 . 2013-09-07 09:08 -------- d-----w- c:\program files\AVAST Software
2013-09-07 09:07 . 2013-09-08 09:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2013-09-06 17:58 . 2013-09-06 17:58 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-06 17:58 . 2013-09-06 17:58 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-06 17:57 . 2013-09-06 18:00 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Adobe
2013-09-05 17:38 . 2013-09-09 18:24 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-09-02 18:16 . 2013-09-02 18:16 -------- d-sh--w- c:\documents and settings\SMCeleron\IECompatCache
2013-09-01 15:26 . 2013-09-08 11:09 -------- d-----w- c:\program files\Trend Micro
2013-09-01 09:01 . 2013-09-01 12:44 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\BSplayer
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\VS Revo Group
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\VS Revo Group
2013-08-31 18:07 . 2013-08-31 18:07 170752 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-08-31 18:07 . 2013-08-31 18:07 76768 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-08-31 17:24 . 2013-08-31 17:46 -------- d-----w- c:\program files\Free Windows Cleanup Tool
2013-08-28 21:46 . 2013-08-28 21:47 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Facebook
2013-08-28 18:57 . 2013-08-28 18:57 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 18:55 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 19:20 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\AnVir
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\good
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\bad
2013-08-27 15:51 . 2013-08-27 15:51 -------- d-----w- c:\program files\CCleaner
2013-08-25 13:28 . 2013-08-25 13:28 -------- d-----w- c:\windows\system32\config\systemprofile\Data aplikací\IObit
2013-08-25 12:50 . 2013-08-25 12:50 -------- d-----w- c:\windows\system32\GroupPolicy
2013-08-25 12:50 . 2013-08-25 19:09 -------- dc----w- c:\windows\$968930Uinstall_KB968930$
2013-08-25 12:35 . 2013-08-25 19:09 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\Apple Computer
2013-08-25 12:35 . 2013-08-25 12:35 -------- d-----w- c:\documents and settings\SMCeleron\AppData
2013-08-25 12:03 . 2013-08-25 19:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
2013-08-25 12:03 . 2013-08-25 19:09 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\IObit
2013-08-24 16:27 . 2013-08-24 16:27 -------- d-----w- c:\documents and settings\SMCeleron\SyncFolder
2013-08-24 16:24 . 2013-08-24 16:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PC1Data
2013-08-22 21:51 . 2013-08-25 19:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\clp
2013-08-22 21:36 . 2013-08-22 21:36 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Fighters
2013-08-22 21:04 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2013-08-22 20:35 . 2013-08-22 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Common Toolkit Suite
2013-08-22 20:21 . 2013-08-22 20:21 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Fighters
2013-08-22 20:20 . 2013-08-22 22:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Fighters
2013-08-22 20:14 . 2013-08-22 20:14 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-08-22 20:14 . 2013-08-22 20:14 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\eSupport.com
2013-08-22 19:27 . 2013-09-07 09:10 -------- d-----w- c:\program files\Google
2013-08-18 21:42 . 2013-08-18 21:42 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Anthropics
2013-08-14 05:46 . 2013-08-15 16:08 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Unity
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-07 17:02 . 2013-08-07 17:02 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys
2013-08-02 23:48 . 2006-10-18 19:47 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-29 17:49 . 2013-07-29 17:49 16048 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2013-07-26 02:49 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:48 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:48 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-10 10:37 . 2008-04-14 12:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 07:34 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-04 07:34 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-08-30 07:47 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-08-30 4858968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner]
2013-08-21 18:22 3676952 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-07-25 06:58 20684656 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-r- c:\windows\soundman.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MadOnion.com\\3DMark2001 SE\\3DMark2001SE.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [7.9.2013 11:10 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [7.9.2013 11:10 177864]
R0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\drivers\fltsrv.sys [31.8.2013 20:07 76768]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7.9.2013 11:10 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7.9.2013 11:10 369584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.9.2013 11:10 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [7.9.2013 11:10 66336]
S2 ekrn;ESET Service;d:\programy\eset\ekrn.exe --> d:\programy\eset\ekrn.exe [?]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [22.8.2013 22:14 23456]
S3 LMIRescue_391ac7ff-9f90-4cad-b200-d1ea20cd8371;LogMeIn Rescue (391ac7ff-9f90-4cad-b200-d1ea20cd8371);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000B.tmp\LMI_Rescue_srv.exe [28.7.2013 16:31 2570592]
S3 LMIRescue_796396c6-ef97-4e85-a52a-782c471ee2ce;LogMeIn Rescue (796396c6-ef97-4e85-a52a-782c471ee2ce);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000A.tmp\LMI_Rescue_srv.exe [28.7.2013 16:17 2570592]
S3 LMIRescue_b27ea1d2-3851-4c29-b5b2-00bfaf75611a;LogMeIn Rescue (b27ea1d2-3851-4c29-b5b2-00bfaf75611a);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000C.tmp\LMI_Rescue_srv.exe [20.8.2013 17:43 2570592]
S3 LMIRescue_eb30bad3-8f1c-44a7-8b74-10db35342de0;LogMeIn Rescue (eb30bad3-8f1c-44a7-8b74-10db35342de0);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0009.tmp\LMI_Rescue_srv.exe [20.7.2013 15:02 2570592]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6.7.2013 23:31 22856]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [5.9.2013 19:38 40776]
S4 LMIRescue_25b8023e-94c1-4a98-9c08-04bc13b20828;LogMeIn Rescue (25b8023e-94c1-4a98-9c08-04bc13b20828);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0005.tmp\LMI_Rescue_srv.exe [19.7.2013 20:23 2570592]
S4 LMIRescue_2a132eac-b3f6-4401-ad4d-57df7118dbc9;LogMeIn Rescue (2a132eac-b3f6-4401-ad4d-57df7118dbc9);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [19.7.2013 20:03 2570592]
S4 LMIRescue_3f210bad-2787-4c38-96c1-fa9d220e8150;LogMeIn Rescue (3f210bad-2787-4c38-96c1-fa9d220e8150);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0006.tmp\LMI_Rescue_srv.exe [19.7.2013 20:36 2570592]
S4 LMIRescue_9cb5ae85-6c76-4fb0-ab82-956d017a0c28;LogMeIn Rescue (9cb5ae85-6c76-4fb0-ab82-956d017a0c28);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0008.tmp\LMI_Rescue_srv.exe [20.7.2013 10:58 2570592]
S4 LMIRescue_de44e4bb-4696-477e-92f3-b3a718683581;LogMeIn Rescue (de44e4bb-4696-477e-92f3-b3a718683581);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0004.tmp\LMI_Rescue_srv.exe [19.7.2013 20:18 2570592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-30 18:56 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-09-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-06 17:58]
.
2013-09-09 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-09-07 07:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www2.delta-search.com/?babsrc=HP ... l&tsp=5000
TCP: DhcpNameServer = 10.0.0.138
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-egui - d:\programy\eset\egui.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-10 19:11
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="96BF69B2A24B8A8C4FD51275A18331D1D524B2404EACB0D5D92CB78429CA5535F99CC7974DB43C2B4F5557FA2EB772B27D28CEDDFA072202CFF041FE06FD5146720235DB3DABB13EB35D76A4B73AFD9D52B580134F19673FE652F5FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5556EC7FDE352371EFB5FE124C9F066F9100A1A2F9EFDEDEEBD493530FD2927BE5ACC98AA443B2ABF8B2C7C01BBFE2358DA94E474A32BFD00A983FAB0866CDE59EB0E2772D974E75733428528FA1BD5750B8AA240E9146378282B12E96430874E61CB457D482FF86B0116C5E4C7218A47DB57329EEE5ECFE13F468B46F5019955B1C3D83A68813B05F8BB99C51AD025CB7D8A015E658FCB466E7D0CF649CF612C46575C5AC765DE31136F6F9B984CD9FC93D716133416B0B6251ECD6FA3727E92FC8DDFD1253AE8813911C97C231BB3E0B719879475C22D45C8189F687AA1E3CD280F825AF5C2318DC92140C4C9AA8F7DF34781FB7748450B33025F5E7AFBD9A60E2AFCF0E1A5E4EB18C9FE8F52C89FDD4983C6293EC0CD243092059002027DE868D019D647EA06BD6B5245C13628E80F2C91A8407E28F32E81A89782A619BCE5E4993491B50368217F2DE4002461C6A483DA1228A35DB44D5C43B67E2E0C5BF1A63D4169F13FB43F83EAC6347DEF65352CE87D8C4CA663AB6989910F940672E5C29AC6EBF2D6683F98C2650DD5B247DB76ED7BD9C92C27F045C2EE058A996C1E43B2DEEAE6E4D24F5790CF7CF86DC1B6A53C304625797A5001DC2874F1BC0AFB27ACB7F92FE51AA14A52293AE2C67F68F14BD4C7957F2BFB2367A936E2475FE35FD113745D3E36EB712BAABD464B7D9787B8B4988C925EAAA298F3E429F853BD528EC7F4BC32F4E6BE629DC687698E6F86C3B0BA2BEA0919EE481EE0447022775A77BFDE49ED755198626157C074571E82CF3D6D4925F587E674514F67B5DA0045417A56B17F2F6B5B3A6AB63FA4D056846462BA6E41C4B860BCC9187AB0E1CD54450944DCD8E77CD51EBE6C85154BCF86AE3B6D5CA5E673246758E698AEEE583E029156E1CF3E4E4A627948C7C567437BFDFA14849725066F5D64AC91E08E9CAD19CEFD0E2022AC71034CDBEF981AF0C4C762020CC598BC73A9651C695E9F1BBFD090EEE1E758E97320777E9C56AD1A3CA04C4DCF3FB06ED47FE82FD51F56D8079235A49029FA5DF1FAD3C89D294086ACC624D25DF930F02DB111A0458039DE886D37D904C975DD00FBCC9A79224380D619E831F5CB2D20893B927154C525B8C0919E11D89588CB22AB6114E9337CD66E1DB1CA127414DB69B63766D8914A789A558910DEBAC907D53C249CDBB4855B9BF8A4485C"
"OODEFRAG16.00.00.01PROFESSIONAL"="D178F64B240F4B49E312A8E921AE3FADD1DB511A56EB544A95429920B6B2FD2E4435279E29E3D5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5552ADF412764FAB7044731249BCC9ADA55C7DA7B8A4E9606129352F4C4EE8D50113C13F67ECFD5F75326BAD82F1AC315CAB6EE25BEF9B6726C1995F57FA3F568148D60D2FC776949BBD1A23018A212E17E0C7971F3DE61886B55C57F2F3FD13BAF44756E7581E04B81969A385784C6A0705F51FCF8390C076F497F5F9131EB073EEA53E82FB97BDE20AA28FCDE8434F5D8ACA2E50E6242718A5AAF66D0902055D370CEE1658E8B2B43242512970B45C522D56AD0E8DE201285521DE79198E26C3126907F46127999CCFDC08EDCA2743F6B1EFB64B151D5725C5F5EBD68A4B9DA51C2956CF5FC41D85398FA0D00FCD1CE06AEFECD85832A653D90DE44DF39BF7060E1ACD50B29705B9F37292B44EB02A778136D3BF56175FB0CDC5EDB767A2242BD7FFCEC8F95AA562F80770DE069BE42FEBB95E087FBA512609E71E89C32232CFE807EE6836528C3B20161D70390525905FD9B76B309BAC006117F543B4F19C8ECA97E7FDADE336491A6BAB7CA9F9D6B3111F43866E24BE87B57C48B29E36FF882A61CF17A6DAC36644627D94C7D95BB56926D65820381AFF6764FFDB6A423E372044E02BF9F8583F81721F10E304253010223C0DB0C977C5C5684A1A46CC7701F365CF377A8C6D3CF3377B60EE33FF9EEC38813BBC2617B4AC61C6DAAB881CE2313E311E65F8A751F1BCBE13BE83E4292A1E5A75E10449D0EF721DFF02B8CECC854D428C2BF817BD1B21233F9B281FC9346544E760237952DFE74F7950AB7819219F30BB7666D3C82BF166C2159E2C14BC343D9A847C9DC5ED5483B2B3FE1063463DB0EE398A65105EFF4D47E1A4EEBC80CF5230C379C2F0C59263338D885379619778CDA3B1898DECF1F3652D1C21CCEF90285AFC7648C56CB68EA3689AA15D5858762A35A4134C7555DDF4E8657B2D24954DF94196B381251BFF31325EE6742D622723924348B2FD646A51D60B159801929162EE90E3C4575AF62B12686B460202F210AEC1BC6358FC9DBD8A90F79366F1590671F3EE3AC230F4FE6AC364C69D56BD9792AADD5319E29DD925440430534FDBA9BC280BE36AC8AD6FC78593D49D3670A5F77BD6AAA88F90B4CF1A82936B31F839D81EEA186C8239A33EEDD5DA0D889A18693ADF960B3264602BCC0E2C19E86DFB0ABB525F50FAA3F3A1C45C7C40688172C61F3BFC26CEA751C8F16EBD78898C60F3697A30EFDC8EB382CA6573D63716506671EB878615A837CE9C682D96A8A3364BA68BF8F76FA4FC7F02C2DC6D9A608B8514928DA27"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(572)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2013-09-10 19:14:18
ComboFix-quarantined-files.txt 2013-09-10 17:14
.
Před spuštěním: Volných bajtů: 32 620 417 024
Po spuštění: Volných bajtů: 32 617 775 104
.
- - End Of File - - 9631125B492BFE11806118441CB74DF3
413FC2A0C716421B3158746D63736515

[jaro3]

eset na D: a avast na C: to jsou věci.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

KillAll::
SecCenter::
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

File::
d:\programy\eset\ekrn.exe

Folder::
c:\documents and settings\SMCeleron\Data aplikací\Babylon
c:\documents and settings\All Users\Data aplikací\Babylon

Driver::
ekrn

DDS::
uStart Page = hxxp://www2.delta-search.com/?babsrc=HP ... l&tsp=5000


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni AdwCleaner

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
Klikni na „ Vymazat-Clean“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.