v aplikaci došlo k problému... Vyřešeno

[Slegr]

už sem myslel že se toho logu nedožiju..

ComboFix 08-12-21.01 - hl. Gregrovi 2008-12-21 21:38:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.2047.1579 [GMT 1:00]
Spuštěný z: c:\documents and settings\hl. Gregrovi\Dokumenty\Stáhnuto\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\hl. Gregrovi\Data aplikací\inst.exe
c:\program files\perfect codec
c:\windows\system32\auto.exe
c:\windows\system32\dbfb.dll
c:\windows\system32\mdm.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OREANS32
-------\Service_oreans32


((((((((((((((((((((((((( Soubory vytvořené od 2008-11-21 do 2008-12-21 )))))))))))))))))))))))))))))))
.

2008-12-21 20:00 . 2008-12-21 20:01 <DIR> d-------- c:\windows\ERUNT
2008-12-21 19:52 . 2008-12-21 20:40 <DIR> d-------- C:\SDFix
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\Malwarebytes
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-12-21 19:29 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-21 19:29 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-20 17:28 . 2008-12-20 17:28 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-20 17:28 . 2008-12-20 17:28 1,409 --a------ c:\windows\QTFont.for
2008-12-19 22:01 . 2008-12-19 22:01 0 --a------ c:\windows\CleaningLab.INI
2008-12-19 21:46 . 2003-04-18 15:29 44,544 --a------ c:\windows\system32\msxml4a.dll
2008-12-19 21:44 . 2008-12-19 21:44 <DIR> d-------- c:\program files\Common Files\MAGIX Shared
2008-12-19 21:43 . 2008-12-19 21:43 <DIR> d-------- c:\program files\MAGIX
2008-12-19 21:43 . 1998-10-15 16:28 85,504 --a------ c:\windows\system32\HtmlWH.dll
2008-12-19 21:42 . 2008-12-19 21:45 <DIR> d-------- c:\windows\system32\MAGIX
2008-12-19 21:42 . 2007-01-16 10:55 663,552 --a------ c:\windows\system32\mgxoschk.dll
2008-12-19 21:42 . 2008-12-19 21:45 5,817 --a------ c:\windows\mgxoschk.ini
2008-12-19 21:32 . 2008-12-19 21:32 392 --a------ c:\windows\Quick_KARAOKE_demo.INI
2008-12-19 20:29 . 2008-12-19 20:48 <DIR> d-------- c:\program files\Officers
2008-12-14 16:00 . 2008-12-14 16:04 45 --a------ C:\F1DDPG18F.flv.3GP
2008-12-14 15:51 . 2004-05-11 08:14 719,872 --a------ c:\windows\system32\devil.dll
2008-12-14 15:51 . 2006-11-12 13:44 306,688 --a------ c:\windows\system32\avisynth.dll
2008-12-12 13:18 . 2008-12-12 13:18 24 --a------ C:\url_history.xml
2008-12-12 13:02 . 2008-12-12 14:00 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\SecondLife
2008-12-12 13:02 . 2008-12-12 14:31 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikacĂ­
2008-12-09 21:36 . 2008-12-09 21:36 <DIR> d-------- c:\program files\Volo View Express
2008-12-09 18:43 . 2008-12-09 20:23 32 --a------ c:\windows\render.ini
2008-12-09 17:51 . 2008-12-09 17:51 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\Autodesk
2008-12-09 17:28 . 2008-12-09 17:28 260,608 --a------ c:\windows\CDILLA32.DLL
2008-12-09 17:28 . 2008-12-09 17:28 63,344 --a------ c:\windows\CDILLA05.DLL
2008-12-09 17:28 . 2008-12-09 17:28 60,416 --a------ c:\windows\CDILLA64.EXE
2008-12-09 17:28 . 2008-12-09 17:28 58,160 --a------ c:\windows\system32\drivers\CDANT.SYS
2008-12-09 17:28 . 2008-12-09 17:28 55,376 --a------ c:\windows\CDILLA40.DLL
2008-12-09 17:28 . 2008-12-09 17:28 46,080 --a------ c:\windows\system32\drivers\CDANTSRV.EXE
2008-12-09 17:28 . 2008-12-09 17:28 44,544 --a------ c:\windows\CDILLA13.DLL
2008-12-09 17:28 . 2008-12-09 17:28 23,856 --a------ c:\windows\CDILLA10.EXE
2008-12-09 17:28 . 2008-12-09 17:28 7,056 --a------ c:\windows\CDILLA16.EXE
2008-12-09 17:27 . 2008-12-09 17:33 <DIR> d--h----- C:\C_DILLA
2008-12-09 17:25 . 2000-10-20 13:25 487,184 --a------ c:\windows\system32\Mrt7enu.dll
2008-12-09 17:25 . 2000-10-20 13:25 446,464 --a------ c:\windows\system32\hhactivex.dll
2008-12-09 17:25 . 2000-10-20 13:25 31,744 --a------ c:\windows\system32\Hlp95en.dll
2008-12-09 17:16 . 2008-12-09 17:16 <DIR> d-------- c:\program files\Common Files\Wextech Shared
2008-12-09 17:15 . 2008-12-09 21:36 <DIR> d-------- c:\program files\Common Files\Autodesk Shared
2008-12-09 17:15 . 2008-12-09 17:49 <DIR> d-------- c:\program files\AutoCAD 2002 Cz
2008-12-09 16:12 . 2008-12-09 16:12 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\T-FLEX CAD 11
2008-12-09 16:02 . 2008-12-09 16:02 <DIR> d-------- c:\program files\Common Files\T-FLEX
2008-12-08 19:54 . 2008-12-09 15:17 <DIR> d-------- c:\program files\ElastoMania111
2008-12-07 22:50 . 2008-12-09 17:01 <DIR> d-------- c:\program files\YouTube Video Downloader
2008-12-07 18:56 . 2008-12-07 18:56 <DIR> d-------- c:\program files\Microsoft Silverlight
2008-12-05 20:34 . 2008-12-05 20:34 <DIR> d-------- c:\program files\Bradbury
2008-12-02 17:37 . 2008-12-02 18:25 <DIR> d-------- c:\program files\Bus Simulator 2008 Demo
2008-12-01 20:02 . 2008-12-01 20:02 <DIR> d-------- C:\!KillBox

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 18:58 3,934 ----a-w c:\windows\system32\drivers\fwdrv.err
2008-12-16 20:23 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\OpenOffice.org2
2008-12-16 14:36 --------- d-----w c:\program files\Mozilla Thunderbird
2008-12-14 14:49 --------- d-----w c:\program files\MediaCell Video Converter
2008-12-11 20:01 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Hamachi
2008-12-06 19:41 --------- d-----w c:\program files\DivX
2008-12-01 18:54 --------- d-----w c:\program files\GOTCHA!
2008-11-29 22:01 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Skype
2008-11-27 12:44 --------- d-----w c:\program files\FaceOnBody
2008-11-27 12:19 --------- d-----w c:\program files\Cool CENZURA
2008-11-23 19:23 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Desktop Sidebar
2008-11-19 15:49 --------- d-----w c:\program files\SpeedFan
2008-11-18 14:56 --------- d-----w c:\program files\Desktop Sidebar
2008-11-15 18:29 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 18:28 --------- d-----w c:\program files\Codemasters
2008-11-15 10:32 --------- d-----w c:\program files\rFactor MP Test
2008-11-13 16:13 --------- d-----w c:\program files\RegCleaner
2008-11-11 14:22 --------- d-----w c:\program files\DDR
2008-11-09 15:41 --------- d-----w c:\documents and settings\All Users\Data aplikací\Trymedia
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 10:39 660,480 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ------w c:\windows\system32\msxml4.dll
2008-08-28 19:15 81,920 ----a-w c:\documents and settings\hl. Gregrovi\Data aplikací\ezpinst.exe
2008-08-28 19:15 47,360 ----a-w c:\documents and settings\hl. Gregrovi\Data aplikací\pcouffin.sys
2007-01-13 18:36 168 ---ha-w c:\documents and settings\hl. Gregrovi\hpothb07.dat
2006-08-09 14:23 880 --sha-w c:\windows\dwin.sys
2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-22 335872]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm
"vidc.i420"= i420vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 11:06 3144800 c:\program files\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-08-09 15:49 77824 c:\program files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Nival Interactive\\Blitzkrieg\\Run\\game.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\PANZERS - Phase1\\Run\\panzers.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\ICQLite\\ICQLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10044:TCP"= 10044:TCP:BitComet 10044 TCP
"10044:UDP"= 10044:UDP:BitComet 10044 UDP

R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2006-07-29 77312]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-01 111184]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-02-20 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-02-20 71088]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-01 20560]
R2 Prvflder;Prvflder;c:\windows\system32\DRIVERS\prvflder.sys [2006-04-21 70912]
R2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys [2008-01-10 2368]
R3 PhTVTune;MuchTV Plus TVTuner;c:\windows\system32\DRIVERS\PhTVTune.sys [2006-08-19 24000]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2002-08-29 69120]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{857b110b-7bfe-11db-89a4-0040ca73ad2a}]
\Shell\AutoRun\command - I:\Autorun.exe
.
Obsah adresáře 'Naplánované úlohy'

2006-10-30 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1154198135.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-STYLEXP - c:\program files\TGTSoft\StyleXP\StyleXP.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Subscribe in Desktop Sidebar - c:\program files\Desktop Sidebar\sbhelp.dll/menuhandler.html

c:\windows\Downloaded Program Files\InstFred.ocx - O16 -: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1}
file://c:\program files\AutoCAD 2002 Cz\InstFred.ocx

c:\windows\system32\msvcrt.dll - c:\windows\system32\mfc42.dll
c:\windows\system32\olepro32.dll
c:\windows\Downloaded Program Files\ICQDevilImg.ocx
O16 -: {A20B1BB0-AC3D-4530-85F3-791B81303190}
hxxp://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
c:\windows\Downloaded Program Files\ICQDevilImg.inf

c:\windows\Downloaded Program Files\InstBanr.ocx - O16 -: {AE563723-B4F5-11D4-A415-00108302FDFD}
file://c:\program files\AutoCAD 2002 Cz\InstBanr.ocx
FF - ProfilePath - c:\documents and settings\hl. Gregrovi\Data aplikací\Mozilla\Firefox\Profiles\m6spb5ho.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 21:48:45
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2652)
c:\progra~1\WINDOW~2\wmpband.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\drivers\CDANTSRV.EXE
c:\program files\Sunbelt Software\Personal Firewall\kpf4ss.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft Private Folder 1.0\PrfldSvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Sunbelt Software\Personal Firewall\kpf4gui.exe
c:\program files\Sunbelt Software\Personal Firewall\kpf4gui.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Celkový čas: 2008-12-21 21:57:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-12-21 20:57:11

Před spuštěním: Volných bajtů: 17 059 471 360
Po spuštění: Volných bajtů: 16,968,945,664

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

254 --- E O F --- 2008-12-18 19:40:44

[Reklama]

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Folder::
C:\SDFix

File::
c:\windows\mgxoschk.ini


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto znáš: C:\F1DDPG18F.flv.3GP ?
Toto otestuj na Virustotal
c:\windows\system32\drivers\CDANTSRV.EXE
c:\windows\system32\drivers\CDANT.SYS
c:\windows\CDILLA16.EXE
Vlož sem pak výsledky.

[Slegr]

ComboFix 08-12-21.01 - hl. Gregrovi 2008-12-22 0:56:01.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.2047.1589 [GMT 1:00]
Spuštěný z: c:\documents and settings\hl. Gregrovi\Dokumenty\Stáhnuto\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\hl. Gregrovi\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

FILE ::
c:\windows\mgxoschk.ini
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\SDFix
c:\sdfix\Add_DBFix_RunOnce_key.inf
c:\sdfix\apps\assosfix.reg
c:\sdfix\apps\Cghtme.exe
c:\sdfix\apps\cliptext.exe
c:\sdfix\apps\DBFix.inf
c:\sdfix\apps\download.exe
c:\sdfix\apps\dummy.sys
c:\sdfix\apps\Enable_Command_Prompt.inf
c:\sdfix\apps\Enable_Command_Prompt.reg
c:\sdfix\apps\ERDNT.E_E
c:\sdfix\apps\ERDNTDOS.LOC
c:\sdfix\apps\ERDNTWIN.LOC
c:\sdfix\apps\ERUNT.EXE
c:\sdfix\apps\ERUNT.LOC
c:\sdfix\apps\fix.reg
c:\sdfix\apps\FixBeep.reg
c:\sdfix\apps\FixBH.reg
c:\sdfix\apps\FixComponents.reg
c:\sdfix\apps\FIXCU.reg
c:\sdfix\apps\FIXLM.reg
c:\sdfix\apps\FixPath.exe
c:\sdfix\apps\FixRedir.reg
c:\sdfix\apps\FixSchedule.reg
c:\sdfix\apps\FixWebCheck.reg
c:\sdfix\apps\fixXP.reg
c:\sdfix\apps\FixXPsp2.reg
c:\sdfix\apps\grep.exe
c:\sdfix\apps\HaxdFix.reg
c:\sdfix\apps\HPFix.reg
c:\sdfix\apps\HPFix2.reg
c:\sdfix\apps\HPFix3.reg
c:\sdfix\apps\HPFix4.reg
c:\sdfix\apps\HPFix5.reg
c:\sdfix\apps\HPFix6.reg
c:\sdfix\apps\HPFix7.reg
c:\sdfix\apps\HPFix8.reg
c:\sdfix\apps\HPFix9.reg
c:\sdfix\apps\Installed.txt
c:\sdfix\apps\isadmin.exe
c:\sdfix\apps\leg2.txt
c:\sdfix\apps\legacy.txt
c:\sdfix\apps\legacybk.txt
c:\sdfix\apps\locate.com
c:\sdfix\apps\LS.exe
c:\sdfix\apps\MD5File.exe
c:\sdfix\apps\moveex.exe
c:\sdfix\apps\MyGcpvFix.reg
c:\sdfix\apps\MyGkFix2.reg
c:\sdfix\apps\Process.exe
c:\sdfix\apps\procs.exe
c:\sdfix\apps\psservice.exe
c:\sdfix\apps\Rem.txt
c:\sdfix\apps\Rem2.txt
c:\sdfix\apps\Replace\regedit.exe
c:\sdfix\apps\Replace\w2k\AUTOEXEC.NT
c:\sdfix\apps\Replace\w2k\beep.sys
c:\sdfix\apps\Replace\w2k\command.com
c:\sdfix\apps\Replace\w2k\command.PIF
c:\sdfix\apps\Replace\w2k\CONFIG.NT
c:\sdfix\apps\Replace\w2k\null.sys
c:\sdfix\apps\Replace\xp\AUTOEXEC.NT
c:\sdfix\apps\Replace\xp\beep.sys
c:\sdfix\apps\Replace\xp\command.com
c:\sdfix\apps\Replace\xp\command.PIF
c:\sdfix\apps\Replace\xp\CONFIG.NT
c:\sdfix\apps\Replace\xp\null.sys
c:\sdfix\apps\Reset_AppInit_DLLs.reg
c:\sdfix\apps\RestartIt!.exe
c:\sdfix\apps\Restore_SafeBoot_Windows2000.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP2.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP3.reg
c:\sdfix\apps\Restore_SecurityCenter.reg
c:\sdfix\apps\Restore_SharedAccess.reg
c:\sdfix\apps\sc.exe
c:\sdfix\apps\sed.exe
c:\sdfix\apps\SF.exe
c:\sdfix\apps\shutdown.exe
c:\sdfix\apps\srv2.txt
c:\sdfix\apps\srv2bk.txt
c:\sdfix\apps\svc.txt
c:\sdfix\apps\svcbk.txt
c:\sdfix\apps\Swreg.exe
c:\sdfix\apps\swsc.exe
c:\sdfix\apps\UnRAR.exe
c:\sdfix\apps\unzip.exe
c:\sdfix\apps\vfind.exe
c:\sdfix\apps\WINMSG.EXE
c:\sdfix\apps\winsec.reg
c:\sdfix\apps\zip.exe
c:\sdfix\backups\backupreg.zip
c:\sdfix\backups\catchme.log
c:\sdfix\backups\HOSTS
c:\sdfix\catchme.exe
c:\sdfix\DBFix.bat
c:\sdfix\dummy.sys
c:\sdfix\Report.txt
c:\sdfix\RunThis.bat
c:\sdfix\SDFIX_ReadMe_Online.url
c:\sdfix\W2K_VirusAlert_Repair.inf
c:\sdfix\XP_VirusAlert_Repair.inf
c:\windows\mgxoschk.ini

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-11-21 do 2008-12-21 )))))))))))))))))))))))))))))))
.

2008-12-21 20:00 . 2008-12-21 20:01 <DIR> d-------- c:\windows\ERUNT
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\Malwarebytes
2008-12-21 19:29 . 2008-12-21 19:29 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-12-21 19:29 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-21 19:29 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-20 17:28 . 2008-12-20 17:28 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-20 17:28 . 2008-12-20 17:28 1,409 --a------ c:\windows\QTFont.for
2008-12-19 22:01 . 2008-12-19 22:01 0 --a------ c:\windows\CleaningLab.INI
2008-12-19 21:46 . 2003-04-18 15:29 44,544 --a------ c:\windows\system32\msxml4a.dll
2008-12-19 21:44 . 2008-12-19 21:44 <DIR> d-------- c:\program files\Common Files\MAGIX Shared
2008-12-19 21:43 . 2008-12-19 21:43 <DIR> d-------- c:\program files\MAGIX
2008-12-19 21:43 . 1998-10-15 16:28 85,504 --a------ c:\windows\system32\HtmlWH.dll
2008-12-19 21:42 . 2008-12-19 21:45 <DIR> d-------- c:\windows\system32\MAGIX
2008-12-19 21:42 . 2007-01-16 10:55 663,552 --a------ c:\windows\system32\mgxoschk.dll
2008-12-19 21:32 . 2008-12-19 21:32 392 --a------ c:\windows\Quick_KARAOKE_demo.INI
2008-12-19 20:29 . 2008-12-19 20:48 <DIR> d-------- c:\program files\Officers
2008-12-14 16:00 . 2008-12-14 16:04 45 --a------ C:\F1DDPG18F.flv.3GP
2008-12-14 15:51 . 2004-05-11 08:14 719,872 --a------ c:\windows\system32\devil.dll
2008-12-14 15:51 . 2006-11-12 13:44 306,688 --a------ c:\windows\system32\avisynth.dll
2008-12-12 13:18 . 2008-12-12 13:18 24 --a------ C:\url_history.xml
2008-12-12 13:02 . 2008-12-12 14:00 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\SecondLife
2008-12-12 13:02 . 2008-12-12 14:31 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikacĂ­
2008-12-09 21:36 . 2008-12-09 21:36 <DIR> d-------- c:\program files\Volo View Express
2008-12-09 18:43 . 2008-12-09 20:23 32 --a------ c:\windows\render.ini
2008-12-09 17:51 . 2008-12-09 17:51 <DIR> d-------- c:\documents and settings\hl. Gregrovi\Data aplikací\Autodesk
2008-12-09 17:28 . 2008-12-09 17:28 260,608 --a------ c:\windows\CDILLA32.DLL
2008-12-09 17:28 . 2008-12-09 17:28 63,344 --a------ c:\windows\CDILLA05.DLL
2008-12-09 17:28 . 2008-12-09 17:28 60,416 --a------ c:\windows\CDILLA64.EXE
2008-12-09 17:28 . 2008-12-09 17:28 58,160 --a------ c:\windows\system32\drivers\CDANT.SYS
2008-12-09 17:28 . 2008-12-09 17:28 55,376 --a------ c:\windows\CDILLA40.DLL
2008-12-09 17:28 . 2008-12-09 17:28 46,080 --a------ c:\windows\system32\drivers\CDANTSRV.EXE
2008-12-09 17:28 . 2008-12-09 17:28 44,544 --a------ c:\windows\CDILLA13.DLL
2008-12-09 17:28 . 2008-12-09 17:28 23,856 --a------ c:\windows\CDILLA10.EXE
2008-12-09 17:28 . 2008-12-09 17:28 7,056 --a------ c:\windows\CDILLA16.EXE
2008-12-09 17:27 . 2008-12-09 17:33 <DIR> d--h----- C:\C_DILLA
2008-12-09 17:25 . 2000-10-20 13:25 487,184 --a------ c:\windows\system32\Mrt7enu.dll
2008-12-09 17:25 . 2000-10-20 13:25 446,464 --a------ c:\windows\system32\hhactivex.dll
2008-12-09 17:25 . 2000-10-20 13:25 31,744 --a------ c:\windows\system32\Hlp95en.dll
2008-12-09 17:16 . 2008-12-09 17:16 <DIR> d-------- c:\program files\Common Files\Wextech Shared
2008-12-09 17:15 . 2008-12-09 21:36 <DIR> d-------- c:\program files\Common Files\Autodesk Shared
2008-12-09 17:15 . 2008-12-09 17:49 <DIR> d-------- c:\program files\AutoCAD 2002 Cz
2008-12-09 16:12 . 2008-12-09 16:12 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\T-FLEX CAD 11
2008-12-09 16:02 . 2008-12-09 16:02 <DIR> d-------- c:\program files\Common Files\T-FLEX
2008-12-08 19:54 . 2008-12-09 15:17 <DIR> d-------- c:\program files\ElastoMania111
2008-12-07 22:50 . 2008-12-09 17:01 <DIR> d-------- c:\program files\YouTube Video Downloader
2008-12-07 18:56 . 2008-12-07 18:56 <DIR> d-------- c:\program files\Microsoft Silverlight
2008-12-05 20:34 . 2008-12-05 20:34 <DIR> d-------- c:\program files\Bradbury
2008-12-02 17:37 . 2008-12-02 18:25 <DIR> d-------- c:\program files\Bus Simulator 2008 Demo
2008-12-01 20:02 . 2008-12-01 20:02 <DIR> d-------- C:\!KillBox

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 18:58 3,934 ----a-w c:\windows\system32\drivers\fwdrv.err
2008-12-16 20:23 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\OpenOffice.org2
2008-12-16 14:36 --------- d-----w c:\program files\Mozilla Thunderbird
2008-12-14 14:49 --------- d-----w c:\program files\MediaCell Video Converter
2008-12-11 20:01 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Hamachi
2008-12-06 19:41 --------- d-----w c:\program files\DivX
2008-12-01 18:54 --------- d-----w c:\program files\GOTCHA!
2008-11-29 22:01 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Skype
2008-11-27 12:44 --------- d-----w c:\program files\FaceOnBody
2008-11-27 12:19 --------- d-----w c:\program files\Cool CENZURA
2008-11-23 19:23 --------- d-----w c:\documents and settings\hl. Gregrovi\Data aplikací\Desktop Sidebar
2008-11-19 15:49 --------- d-----w c:\program files\SpeedFan
2008-11-18 14:56 --------- d-----w c:\program files\Desktop Sidebar
2008-11-15 18:29 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 18:28 --------- d-----w c:\program files\Codemasters
2008-11-15 10:32 --------- d-----w c:\program files\rFactor MP Test
2008-11-13 16:13 --------- d-----w c:\program files\RegCleaner
2008-11-11 14:22 --------- d-----w c:\program files\DDR
2008-11-09 15:41 --------- d-----w c:\documents and settings\All Users\Data aplikací\Trymedia
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 10:39 660,480 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ------w c:\windows\system32\msxml4.dll
2008-08-28 19:15 81,920 ----a-w c:\documents and settings\hl. Gregrovi\Data aplikací\ezpinst.exe
2008-08-28 19:15 47,360 ----a-w c:\documents and settings\hl. Gregrovi\Data aplikací\pcouffin.sys
2007-01-13 18:36 168 ---ha-w c:\documents and settings\hl. Gregrovi\hpothb07.dat
2006-08-09 14:23 880 --sha-w c:\windows\dwin.sys
2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-22 335872]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm
"vidc.i420"= i420vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 11:06 3144800 c:\program files\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-08-09 15:49 77824 c:\program files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Nival Interactive\\Blitzkrieg\\Run\\game.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\PANZERS - Phase1\\Run\\panzers.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\ICQLite\\ICQLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10044:TCP"= 10044:TCP:BitComet 10044 TCP
"10044:UDP"= 10044:UDP:BitComet 10044 UDP

R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2006-07-29 77312]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-01 111184]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-02-20 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-02-20 71088]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-01 20560]
R2 Prvflder;Prvflder;c:\windows\system32\DRIVERS\prvflder.sys [2006-04-21 70912]
R2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys [2008-01-10 2368]
R3 PhTVTune;MuchTV Plus TVTuner;c:\windows\system32\DRIVERS\PhTVTune.sys [2006-08-19 24000]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2002-08-29 69120]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{857b110b-7bfe-11db-89a4-0040ca73ad2a}]
\Shell\AutoRun\command - I:\Autorun.exe
.
Obsah adresáře 'Naplánované úlohy'

2006-10-30 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1154198135.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Subscribe in Desktop Sidebar - c:\program files\Desktop Sidebar\sbhelp.dll/menuhandler.html

c:\windows\Downloaded Program Files\InstFred.ocx - O16 -: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1}
file://c:\program files\AutoCAD 2002 Cz\InstFred.ocx

c:\windows\system32\msvcrt.dll - c:\windows\system32\mfc42.dll
c:\windows\system32\olepro32.dll
c:\windows\Downloaded Program Files\ICQDevilImg.ocx
O16 -: {A20B1BB0-AC3D-4530-85F3-791B81303190}
hxxp://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
c:\windows\Downloaded Program Files\ICQDevilImg.inf

c:\windows\Downloaded Program Files\InstBanr.ocx - O16 -: {AE563723-B4F5-11D4-A415-00108302FDFD}
file://c:\program files\AutoCAD 2002 Cz\InstBanr.ocx
FF - ProfilePath - c:\documents and settings\hl. Gregrovi\Data aplikací\Mozilla\Firefox\Profiles\m6spb5ho.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 01:05:21
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-12-22 1:08:52
ComboFix-quarantined-files.txt 2008-12-22 00:08:46
ComboFix2.txt 2008-12-21 20:57:33

Před spuštěním: Volných bajtů: 16 949 379 072
Po spuštění: Volných bajtů: 16,926,564,352

320 --- E O F --- 2008-12-18 19:40:44

[Slegr]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:15, on 22.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://C:\Program Files\Desktop Sidebar\sbhelp.dll/menuhandler.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://C:\Program Files\AutoCAD 2002 Cz\InstFred.ocx
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2656016312
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Ovládací prvek AcDcToday) - file://C:\Program Files\AutoCAD 2002 Cz\AcDcToday.ocx
O16 - DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} (ICQDevilImg Control) - http://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
O16 - DPF: {AE563723-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002 Cz\InstBanr.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Prvek AcPreview) - file://C:\Program Files\AutoCAD 2002 Cz\AcPreview.ocx
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Private Folder Service (prfldsvc) - Unknown owner - C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

--
End of file - 7110 bytes

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem
a RegCleanerem

a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Aktualizuj javu:
Java SE Runtime Environment 6u11
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u11-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Ty soubory jsi asi netestoval na VirusTotal, měli by být O.K.
Napiš , jak se chová comp.

[Slegr]

večer sem to nestihl ale už du na to

[Slegr]

To C:\F1DDPG18F.flv.3GP jsem už smazal bylo to nějaké nedostáhlé video. Jinak u souborů
c:\windows\system32\drivers\CDANTSRV.EXE
c:\windows\system32\drivers\CDANT.SYS
c:\windows\CDILLA16.EXE
VirusTotal nic nenašel.

[Slegr]

CCleaner,RegCleaner a T-Cleaner sem použil.
Jo a ty Javy mám odinstalovat uplně všechny?

(toto jsou všechny co mám v Přidat a odebrat programy)

A to Nero.exe zatím nehodilo žádnou chybu :)

[jaro3]

Jo úplně všechny a pak nainstaluj tu nejnovější z odkazu.Tak by to mělo být vše.

[Slegr]

Všechno úspěšně provedeno. Můžu říct že po tvé uzdravovací kůře se cítím lépe já i můj počítač. Vše klape jak hodinky. Moc dík za tvůj čas a zas někdy příště.