SVCHOST network service HJT log Vyřešeno

[swot]

Ahoj, chtel bych se zeptat, mam win XP SP3 a kdyz zapnu internet, tak mi proces svchost.exe uzivatelskeho jmena NETWORK SERVICE vyskoci na 100% CPU, prestane nabihat stranka, a aby internet fungoval musim dat pres task managera quit tohoto procesu (jsou tam 2) pak to jde normalne do pristiho restartu (vypnuti) nevite proc ? Jo, a jeste, nevite proc mi obcas spadne net ? proste spadne mam dobreho poskytovatele a ostatnim jde, me po restartu PC take...

HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:10:38, on 30.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
D:\WINDOWS\system32\cisvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\PSIService.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\Program Files\Microsoft IntelliType Pro\itype.exe
D:\Program Files\Microsoft IntelliPoint\ipoint.exe
D:\Program Files\Hard Disk Sentinel\HDSentinel.exe
D:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - D:\WINDOWS\WebIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - D:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - D:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [itype] "D:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Hard Disk Sentinel] "D:\Program Files\Hard Disk Sentinel\HDSentinel.exe" /AUTORUN
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://D:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://D:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://D:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://D:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7545471171
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS3\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS4\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS5\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS6\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS7\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - D:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - D:\WINDOWS\System32\TuneUpDefragService.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 9218 bytes

diky za kontrolu a pripadne vyreseni

[Reklama]

[jaro3]

Chybí antivir...
vypni rez. ochranu u SpyBota:
- spusť Spybot - Search & Destroy
- nahoře v menu zvol: Režim => Pro pokročilé
- objeví se ti varovné okno kde zvol Ano
- okno programu se ti přepne do pokročilého zobrazení a tam zvol: Nástroje => Rezidentní
- tam zruš zatržení pokud bude u položky: Rezidentní program "TeaTimer" (Ochrana ...)
- zavři program
Restartuj PC.
Po té si stáhni ResetTeaTimer.bat(viz. Poznámka)
a ulož si ho na disku.
- spusť ho a po vyzvání zmáčkni libovolnou klávesu
- po proběhnutí a výzvě opět zmáčkni libovolnou klávesu a program se zavře.
Poznámka:
- pokud používáš Operu, tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit cíl odkazu jako...
- pokud používáš Firefox tak klikni pravým tlačítkem myši na odkaz a zvol možnost Uložit odkaz jako...
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[swot]

Sry ze to bylo tak pomalu, nemohl jsem na PC

ComboFix 09-01-21.04 - Rodina 2009-01-31 19:34:28.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1280.871 [GMT 1:00]
Spuštěný z: d:\documents and settings\Rodina\Plocha\ComboFix.exe
FW: Sygate Personal Firewall *enabled*

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.

((((((((((((((((((((((((( Soubory vytvořené od 2008-12-28 do 2009-01-31 )))))))))))))))))))))))))))))))
.

2009-01-30 19:03 . 2009-01-30 19:04 <DIR> d--h----- d:\windows\ie8
2009-01-30 14:46 . 2009-01-30 19:04 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Winamp
2009-01-30 11:52 . 2009-01-30 11:53 <DIR> d-------- d:\program files\RegCleaner
2009-01-29 16:43 . 2009-01-29 16:45 <DIR> d-------- d:\program files\Hard Disk Sentinel
2009-01-29 16:28 . 2009-01-29 16:29 <DIR> d-------- d:\program files\CCleaner
2009-01-28 21:30 . 2009-01-28 21:30 <DIR> d-------- d:\program files\Ventrilo
2009-01-28 21:30 . 2009-01-28 21:30 262 --a------ d:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-01-28 21:26 . 2009-01-28 21:27 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Ventrilo
2009-01-28 19:58 . 2009-01-28 19:58 <DIR> d-------- d:\program files\NOS
2009-01-28 19:58 . 2009-01-28 19:58 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\NOS
2009-01-26 17:45 . 2009-01-26 17:45 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Corel
2009-01-26 17:45 . 2009-01-26 17:45 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Corel
2009-01-23 18:09 . 2009-01-23 18:09 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Skype
2009-01-23 17:58 . 2009-01-23 17:58 <DIR> d-------- d:\windows\Cache
2009-01-23 17:57 . 2009-01-23 17:57 <DIR> d-------- d:\program files\uTorrent
2009-01-23 17:55 . 2009-01-23 17:55 <DIR> d-------- d:\program files\Common Files\lightning group shared files
2009-01-23 15:12 . 2009-01-23 15:12 <DIR> d-------- d:\documents and settings\NetworkService\Dokumenty
2009-01-22 20:01 . 2009-01-22 20:01 <DIR> d-------- d:\program files\Sygate
2009-01-22 20:01 . 2004-10-15 18:32 83,096 --a------ d:\windows\system32\SSSensor.dll
2009-01-22 20:01 . 2004-10-15 18:17 60,496 --a------ d:\windows\system32\drivers\Teefer.sys
2009-01-22 20:01 . 2004-10-15 18:18 21,075 --a------ d:\windows\system32\drivers\wpsdrvnt.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg6n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg5n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg4n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg3n.sys
2009-01-22 16:25 . 2009-01-22 16:25 <DIR> d-------- d:\program files\Axxin Wow Logo Creator
2009-01-22 07:21 . 2009-01-22 07:21 <DIR> d-------- d:\program files\AMP WinOFF
2009-01-21 19:10 . 2009-01-21 19:10 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2009-01-21 19:09 . 2009-01-21 19:09 <DIR> d-------- d:\program files\SUPERAntiSpyware
2009-01-21 19:09 . 2009-01-28 21:30 <DIR> d-------- d:\program files\Common Files\Wise Installation Wizard
2009-01-21 19:09 . 2009-01-21 19:09 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\SUPERAntiSpyware.com
2009-01-21 19:08 . 2009-01-21 19:08 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Windows Search
2009-01-20 19:17 . 2009-01-20 19:17 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Blizzard
2009-01-20 07:53 . 2009-01-31 17:24 <DIR> d-------- d:\program files\Common Files\Blizzard Entertainment
2009-01-20 07:45 . 2009-01-20 07:45 <DIR> d-------- d:\program files\XP TCPIP Repair
2009-01-18 20:02 . 2009-01-20 16:29 <DIR> d-------- d:\program files\GameShadow
2009-01-18 19:30 . 2009-01-18 20:24 <DIR> d-------- d:\program files\Pivot Stickfigure Animator
2009-01-17 21:05 . 2009-01-21 19:35 <DIR> d-------- d:\program files\n2n Gui
2009-01-17 16:40 . 2009-01-17 16:40 <DIR> d-------- d:\program files\Edisk
2009-01-16 07:26 . 2009-01-16 07:26 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\EPSON
2009-01-15 17:21 . 2009-01-15 17:34 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Hamachi
2009-01-15 17:19 . 2009-01-15 17:21 <DIR> d-------- d:\program files\Hamachi
2009-01-15 09:37 . 2009-01-15 09:37 42,320 --a------ d:\windows\system32\xfcodec.dll
2009-01-14 14:11 . 2009-01-14 14:11 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Autodesk
2009-01-14 13:32 . 2000-09-27 08:36 753,152 --a------ d:\windows\system32\ss32x25.ocx
2009-01-14 13:32 . 2000-09-27 08:36 525,352 --a------ d:\windows\system32\DBGRID32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 511,424 --a------ d:\windows\system32\40Comupd.exe
2009-01-14 13:32 . 2000-09-27 08:36 244,232 --a------ d:\windows\system32\MSFLXGRD.OCX
2009-01-14 13:32 . 2000-09-27 08:37 209,408 --a------ d:\windows\system32\TABCTL32.OCX
2009-01-14 13:32 . 2000-09-27 08:37 200,704 --a------ d:\windows\system32\THREED32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 158,992 --a------ d:\windows\system32\COMCT232.OCX
2009-01-14 13:32 . 2000-09-27 08:36 89,600 --a------ d:\windows\system32\GRID32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 82,960 --a------ d:\windows\system32\PICCLP32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 68,096 --a------ d:\windows\system32\cdslib5.dll
2009-01-14 13:32 . 2000-09-27 08:36 61,952 --a------ d:\windows\system32\Slide.ocx
2009-01-14 13:28 . 2009-01-14 13:31 <DIR> d-------- d:\program files\MechSoft
2009-01-13 19:33 . 2000-10-20 13:25 487,184 --a------ d:\windows\system32\Mrt7enu.dll
2009-01-13 19:33 . 2000-10-20 13:25 446,464 --a------ d:\windows\system32\hhactivex.dll
2009-01-13 19:33 . 2000-10-20 13:25 79,360 --a------ d:\windows\system32\acdbres.dll
2009-01-13 19:33 . 2000-10-20 13:25 31,744 --a------ d:\windows\system32\Hlp95en.dll
2009-01-13 19:32 . 2009-01-13 19:33 <DIR> d-------- d:\program files\Volo View Express
2009-01-13 19:29 . 2009-01-13 19:29 <DIR> d-------- d:\program files\Common Files\Wextech Shared
2009-01-13 19:29 . 2009-01-14 13:29 <DIR> d-------- d:\program files\Common Files\Autodesk Shared
2009-01-13 19:24 . 2009-01-13 19:24 260,096 --a------ d:\windows\CDILLA32.DLL
2009-01-13 19:24 . 2009-01-13 19:24 63,344 --a------ d:\windows\CDILLA05.DLL
2009-01-13 19:24 . 2009-01-13 19:24 60,416 --a------ d:\windows\CDILLA64.EXE
2009-01-13 19:24 . 2009-01-13 19:24 57,392 --a------ d:\windows\system32\drivers\CDANT.SYS
2009-01-13 19:24 . 2009-01-13 19:24 55,376 --a------ d:\windows\CDILLA40.DLL
2009-01-13 19:24 . 2009-01-13 19:24 45,056 --a------ d:\windows\CDILLA13.DLL
2009-01-13 19:24 . 2009-01-13 19:24 32,256 --a------ d:\windows\system32\drivers\CDANTSRV.EXE
2009-01-13 19:24 . 2009-01-13 19:24 23,856 --a------ d:\windows\CDILLA10.EXE
2009-01-13 19:24 . 2009-01-13 19:24 7,056 --a------ d:\windows\CDILLA16.EXE
2009-01-13 18:06 . 2008-01-07 14:29 352 --ah----- d:\windows\nod32fixtemdono.reg
2009-01-11 19:28 . 2008-12-11 11:57 333,952 -----c--- d:\windows\system32\dllcache\srv.sys
2009-01-11 19:28 . 2008-06-14 18:35 272,128 -----c--- d:\windows\system32\dllcache\bthport.sys
2009-01-11 19:27 . 2008-08-14 14:26 2,191,360 -----c--- d:\windows\system32\dllcache\ntoskrnl.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,147,328 -----c--- d:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,068,224 -----c--- d:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,025,984 -----c--- d:\windows\system32\dllcache\ntkrpamp.exe
2009-01-11 19:27 . 2008-09-15 16:27 1,846,400 -----c--- d:\windows\system32\dllcache\win32k.sys
2009-01-11 19:27 . 2008-04-11 20:06 691,712 -----c--- d:\windows\system32\dllcache\inetcomm.dll
2009-01-11 19:27 . 2008-10-24 12:21 455,296 -----c--- d:\windows\system32\dllcache\mrxsmb.sys
2009-01-11 19:27 . 2008-10-15 17:38 337,408 -----c--- d:\windows\system32\dllcache\netapi32.dll
2009-01-11 19:27 . 2008-05-08 15:02 203,136 -----c--- d:\windows\system32\dllcache\rmcast.sys
2009-01-11 18:56 . 2008-04-13 22:06 144,384 --------- d:\windows\system32\drivers\hdaudbus.sys
2009-01-11 18:56 . 2008-04-14 00:10 10,240 --------- d:\windows\system32\drivers\sffp_mmc.sys
2009-01-11 18:25 . 2009-01-11 18:25 <DIR> d-------- d:\program files\Microsoft Bootvis
2009-01-11 18:10 . 2009-01-11 18:10 603,904 --a------ d:\windows\system32\TUProgSt.exe
2009-01-11 18:10 . 2009-01-11 18:10 360,192 --a------ d:\windows\system32\TuneUpDefragService.exe
2009-01-11 18:10 . 2008-12-11 13:31 27,904 --a------ d:\windows\system32\uxtuneup.dll
2009-01-11 17:44 . 2009-01-30 14:26 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-01-09 14:02 . 2009-01-09 17:14 <DIR> d-------- d:\program files\PowerTCP
2009-01-08 15:51 . 2009-01-25 10:08 <DIR> d---s---- d:\program files\Xfire
2009-01-08 15:51 . 2009-01-24 20:00 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Xfire
2009-01-08 15:40 . 2009-01-08 15:50 327 --a------ d:\windows\CoDUO.INI
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\program files\Trend Micro
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\program files\Malwarebytes' Anti-Malware
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Malwarebytes
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-01-08 13:03 . 2009-01-04 18:38 38,496 --a------ d:\windows\system32\drivers\mbamswissarmy.sys
2009-01-08 13:03 . 2009-01-04 18:38 15,504 --a------ d:\windows\system32\drivers\mbam.sys
2009-01-08 09:35 . 2009-01-24 19:41 746 --a------ d:\windows\CoD.INI
2009-01-06 20:40 . 2009-01-06 20:40 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Ashampoo
2009-01-06 20:39 . 2009-01-06 20:39 <DIR> d-------- d:\program files\Ashampoo
2009-01-06 20:39 . 2009-01-06 20:39 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-06 15:17 . 2009-01-06 15:17 <DIR> d-------- d:\program files\PowerQuest
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d-------- d:\documents and settings\Administrator\Plocha
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d--h----- d:\documents and settings\Administrator\Okolní tiskárny
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d--h----- d:\documents and settings\Administrator\Okolní síť
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr------- d:\documents and settings\Administrator\Oblíbené položky
2009-01-05 15:20 . 2008-10-05 13:49 <DIR> d--h----- d:\documents and settings\Administrator\Šablony
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> dr------- d:\documents and settings\Administrator\Nabídka Start
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr------- d:\documents and settings\Administrator\Dokumenty
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr-h----- d:\documents and settings\Administrator\Data aplikací
2009-01-05 15:20 . 2009-01-30 19:05 <DIR> d-------- d:\documents and settings\Administrator
2009-01-04 19:08 . 2009-01-04 19:08 <DIR> d-------- d:\windows\system32\NtmsData
2009-01-02 17:54 . 2001-05-11 13:18 420,240 --a------ d:\windows\system32\mpg4c32.dll
2009-01-02 17:54 . 2001-03-26 04:41 245,760 --a------ d:\windows\system32\mp4sds32.ax
2009-01-01 15:26 . 2009-01-01 15:27 <DIR> d-------- d:\program files\Free Download Manager
2008-12-30 15:38 . 2008-12-30 15:38 25 --a------ d:\windows\system32\sysogg.dll
2008-12-30 15:35 . 2008-12-30 15:35 <DIR> d-------- d:\program files\Ogg Converter
2008-12-30 15:35 . 2002-07-09 22:42 140,288 --a------ d:\windows\system32\Comdlg32.ocx
2008-12-28 17:08 . 2008-12-28 17:08 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Elaborate Bytes
2008-12-28 17:05 . 2008-12-28 17:08 24 ---hs---- d:\windows\S8EE954DF.tmp
2008-12-28 17:04 . 2008-12-28 17:04 <DIR> d-------- d:\program files\Elaborate Bytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-30 18:04 --------- d-----w d:\program files\QIP Infium
2009-01-29 18:14 --------- d-----w d:\program files\Common Files\Corel
2009-01-29 15:09 --------- d-----w d:\documents and settings\Rodina\Data aplikací\skypePM
2009-01-29 15:09 --------- d-----w d:\documents and settings\Rodina\Data aplikací\Skype
2009-01-28 19:00 --------- d-----w d:\program files\Common Files\Adobe
2009-01-27 14:19 --------- d-----w d:\program files\mIRC
2009-01-26 16:45 7,360 --sha-w d:\windows\system32\KGyGaAvL.sys
2009-01-25 16:53 --------- d-----w d:\documents and settings\Rodina\Data aplikací\HLSW
2009-01-25 16:52 138,376 ----a-w d:\windows\system32\drivers\PnkBstrK.sys
2009-01-25 16:51 202,448 ----a-w d:\windows\system32\PnkBstrB.exe
2009-01-23 17:57 --------- d-----w d:\documents and settings\Rodina\Data aplikací\uTorrent
2009-01-22 15:08 --------- d-----w d:\documents and settings\Rodina\Data aplikací\teamspeak2
2009-01-20 16:00 --------- d-----w d:\program files\7-Zip
2009-01-18 18:52 --------- d--h--w d:\program files\InstallShield Installation Information
2009-01-17 19:31 2,331,008 ----a-w d:\windows\system32\TUKernel.exe
2009-01-17 17:48 --------- d-----w d:\program files\TuneUp Utilities 2009
2009-01-15 16:19 25,280 ----a-w d:\windows\system32\drivers\hamachi.sys
2009-01-13 17:29 --------- d-----w d:\program files\RSL
2009-01-09 07:14 --------- d-s---w d:\program files\HLSW
2009-01-08 16:43 --------- d-----w d:\program files\Electronic Arts
2009-01-05 15:39 --------- d-----w d:\documents and settings\All Users\Data aplikací\Autodesk
2008-12-22 16:46 --------- d-----w d:\program files\Opera
2008-12-14 19:27 --------- d-----w d:\program files\Google
2008-12-11 10:57 333,952 ----a-w d:\windows\system32\drivers\srv.sys
2008-12-07 09:27 --------- d-----w d:\program files\epson
2008-12-07 09:21 --------- d-----w d:\program files\Windows Media Connect 2
2008-12-06 16:58 --------- d-----w d:\program files\Windows Live
2008-12-02 09:11 --------- d-----w d:\program files\ATI Technologies
2008-12-02 08:39 --------- d-----w d:\program files\upnito.sk Upload manager
2008-11-30 18:53 --------- d-----w d:\documents and settings\All Users\Data aplikací\InstallShield
2008-11-28 18:35 796,672 ----a-w d:\windows\GPInstall.exe
2008-11-23 17:41 3,140 --sha-w d:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2008-11-23 11:23 8 --sh--r d:\documents and settings\All Users\Data aplikací\ECE179E22B.sys
2008-11-23 09:09 606,848 ----a-w d:\windows\flashax.exe
2008-11-23 09:09 12,288 ----a-w d:\windows\impborl.dll
2008-11-21 14:30 107,888 ----a-w d:\windows\system32\CmdLineExt.dll
2008-11-21 13:24 66,872 ----a-w d:\windows\system32\PnkBstrA.exe
2008-11-20 20:43 22,328 ----a-w d:\documents and settings\Rodina\Data aplikací\PnkBstrK.sys
2008-11-16 14:07 43,520 ----a-w d:\windows\system32\CmdLineExt03.dll
2008-11-13 19:11 339,456 ----a-w d:\windows\UIA200.exe
2008-11-05 16:36 499,712 ----a-w d:\windows\system32\msvcp71.dll
2008-11-02 16:17 410,976 ----a-w d:\windows\system32\deploytk.dll
2008-10-29 02:23 425,984 ----a-w d:\windows\system32\ATIDEMGX.dll
2008-10-29 02:22 314,880 ----a-w d:\windows\system32\ati2dvag.dll
2008-10-29 02:11 43,520 ----a-w d:\windows\system32\ati2edxx.dll
2008-10-29 02:11 26,112 ----a-w d:\windows\system32\Ati2mdxx.exe
2008-10-29 02:11 188,416 ----a-w d:\windows\system32\atipdlxx.dll
2008-10-29 02:11 147,456 ----a-w d:\windows\system32\Oemdspif.dll
2008-10-29 02:10 143,360 ----a-w d:\windows\system32\ati2evxx.dll
2008-10-29 02:10 10,973,184 ----a-w d:\windows\system32\atioglxx.dll
2008-10-29 02:09 585,728 ----a-w d:\windows\system32\ati2evxx.exe
2008-10-29 02:07 53,248 ----a-w d:\windows\system32\ATIDDC.DLL
2008-10-29 01:57 4,041,472 ----a-w d:\windows\system32\ati3duag.dll
2008-10-29 01:49 307,200 ----a-w d:\windows\system32\atiiiexx.dll
2008-10-29 01:41 2,472,832 ----a-w d:\windows\system32\ativvaxx.dll
2008-10-29 01:25 48,640 ----a-w d:\windows\system32\amdpcom32.dll
2008-10-29 01:21 389,120 ----a-w d:\windows\system32\atikvmag.dll
2008-10-29 01:19 44,032 ----a-w d:\windows\system32\atiadlxx.dll
2008-10-29 01:19 17,408 ----a-w d:\windows\system32\atitvo32.dll
2008-10-29 01:18 253,952 ----a-w d:\windows\system32\atiok3x2.dll
2008-10-29 01:12 577,536 ----a-w d:\windows\system32\ati2cqag.dll
2008-10-28 22:36 823,296 ----a-w d:\windows\system32\divx_xx0c.dll
2008-10-28 22:36 823,296 ----a-w d:\windows\system32\divx_xx07.dll
2008-10-28 22:35 815,104 ----a-w d:\windows\system32\divx_xx0a.dll
2008-10-28 22:35 802,816 ----a-w d:\windows\system32\divx_xx11.dll
2008-10-28 22:35 684,032 ----a-w d:\windows\system32\DivX.dll
2008-10-28 20:05 593,920 ------w d:\windows\system32\ati2sgag.exe
2008-10-26 08:43 30 ----a-w d:\documents and settings\Rodina\jagex_runescape_preferences.dat
2008-10-23 12:42 286,720 ----a-w d:\windows\system32\gdi32.dll
2008-10-21 17:51 118,784 ----a-w d:\windows\system32\atibrtmon.exe
2008-10-16 13:13 202,776 ----a-w d:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w d:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w d:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w d:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w d:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w d:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w d:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w d:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w d:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w d:\windows\system32\muweb.dll
2008-10-12 05:57 491,520 ----a-w d:\windows\WebIE.dll
2008-10-12 05:57 45,056 ----a-w d:\windows\TRNOEH.DLL
2008-10-12 05:57 356,352 ----a-w d:\windows\TrnOutl.dll
2008-10-12 05:57 294,912 ----a-w d:\windows\TrnWord.dll
2008-10-12 05:57 26,624 ----a-w d:\windows\OETRN.EXE
2008-10-12 05:57 200,704 ----a-w d:\windows\TRNOET.DLL
2008-10-12 05:56 516,096 ----a-w d:\windows\UN32.EXE
2008-10-05 12:54 558,142 ----a-w d:\windows\java\Packages\YS6CDVX7.ZIP
2008-10-05 12:54 155,995 ----a-w d:\windows\java\Packages\S2DRBV7B.ZIP
2008-10-03 10:17 247,326 ----a-w d:\windows\system32\strmdll.dll
2008-10-02 23:46 81,920 ----a-w d:\windows\system32\frapsvid.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="d:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 813912]
"IntelliPoint"="d:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Hard Disk Sentinel"="d:\program files\Hard Disk Sentinel\HDSentinel.exe" [2008-11-06 3407360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="d:\documents and settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 d:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 08:52 15360 d:\windows\system32\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=d:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiSpyWareDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Opera\\opera.exe"=
"d:\\Program Files\\uTorrent\\utorrent.exe"=
"d:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"d:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"d:\\WINDOWS\\system32\\java.exe"=
"d:\\Program Files\\QIP Infium\\infium.exe"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Free Download Manager\\fdm.exe"=
"g:\\Hry\\Call of Duty\\CoDMP.exe"=
"d:\\Program Files\\Xfire\\Xfire.exe"=
"g:\\Hry\\Call of Duty\\CoDUOMP.exe"=
"d:\\Program Files\\HLSW\\hlsw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Edisk\\eDisk klient\\eDisk klient.exe"=
"e:\\World of Warcraft\\Repair.exe"=
"d:\\Program Files\\mIRC\\mirc.exe"=
"d:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"g:\\DOWNLOADS\\WowMatrix\\WowMatrix.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"80:TCP"= 80:TCP:HTTP
"3658:UDP"= 3658:UDP:Game Packets
"59786:TCP"= 59786:TCP:Utorrent

R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R3 DynCal;Dynamic Calibration Service;d:\windows\system32\drivers\DynCal.sys [2005-09-26 8576]
R3 PSched;Plánovač paketů technologie QoS;d:\windows\system32\drivers\psched.sys [2002-08-29 69120]
R3 tap0901;TAP-Win32 Adapter V9;d:\windows\system32\drivers\tap0901.sys [2008-01-30 25216]
S3 getPlus(R) Helper;getPlus(R) Helper;d:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-28 33752]
S3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;d:\windows\system32\TUProgSt.exe [2009-01-11 603904]
S4 WinDefend;Windows Defender;d:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2009-01-31 d:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]

2009-01-24 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyServer = 127.0.0.1:8080
uInternet Settings,ProxyOverride = local
IE: Stáhnout Free Download Managerem - file://d:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://d:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://d:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://d:\program files\Free Download Manager\dlall.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - d:\windows\WebIE.dll
TCP: {054FA508-8656-4090-8104-94424010F112} = 172.27.12.254
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file:///D:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - d:\documents and settings\Rodina\Data aplikací\Mozilla\Firefox\Profiles\4ody1ps8.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/ig?hl=cs&source=iglk
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: d:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - plugin: d:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: d:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: d:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: d:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: g:\programy\Adobe\Reader 9.0\Reader\browser\nppdf32.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-31 19:35:08
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\vsdatant]
"ImagePath"=""
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-823518204-790525478-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:76,71,3c,af,14,c6,53,08,a4,50,e8,58,71,cd,84,2a,6a,e4,96,9e,a4,cf,cd,
18,37,28,f8,2b,58,6c,31,d9,9e,a9,68,63,20,fd,e5,d3,e2,48,12,ae,f8,54,64,57,\
"??"=hex:5c,2a,be,77,99,3e,61,31,c8,dc,45,8e,d2,9c,ad,99

[HKEY_USERS\S-1-5-21-823518204-790525478-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:e2,f4,b3,fc,25,ee,27,04,0a,8a,c5,e9,73,c4,13,1f,29,90,b7,49,39,
b4,15,dd,24,46,5a,fc,8c,d2,20,98,77,96,ae,af,0a,4e,06,e7,bd,2a,ec,1a,e5,aa,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(976)
d:\program files\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-01-31 19:38:05
ComboFix-quarantined-files.txt 2009-01-31 18:38:03

Před spuštěním: 2,123,710,464
Po spuštění: 2,120,163,328

Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7
384 --- E O F --- 2009-01-30 18:30:04


btw nainstalovat jsem konzoli nemohl, zadny z prgramu se mi z nejakeho duvodu nepripoji na net ( krome web. prohlizecu)

[jaro3]

Toto otestuj na Virustotal
d:\windows\S8EE954DF.tmp
d:\documents and settings\All Users\Data aplikací\ECE179E22B.sys
d:\windows\UIA200.exe
d:\windows\java\Packages\YS6CDVX7.ZIP
d:\windows\java\Packages\S2DRBV7B.ZIP
Vlož sem pak odkazy výsledků.
Zítra udělám script.

[swot]

Prvni se mi nepovedlo zkontrolovat, mel 0 bajtu - nenasel jsem ho, ale zbytek mam -

http://www.virustotal.com/cs/analisis/7 ... 637e9caa00
http://www.virustotal.com/cs/analisis/2 ... afd58dff9a
http://www.virustotal.com/cs/analisis/f ... 51451f9ef8
http://www.virustotal.com/cs/analisis/9 ... 275c6da790

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
d:\windows\S8EE954DF.tmp
d:\documents and settings\All Users\Data aplikací\ECE179E22B.sys
d:\windows\UIA200.exe
d:\windows\java\Packages\YS6CDVX7.ZIP
d:\windows\java\Packages\S2DRBV7B.ZIP
d:\windows\UN32.EXE

Folder::
d:\windows\S8EE954DF.tmp

Driver::
ECE179E22B

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiSpyWareDisableNotify"=dword:00000000


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[swot]

ComboFix 09-01-31.03 - Rodina 2009-02-01 18:22:56.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1280.860 [GMT 1:00]
Spuštěný z: d:\documents and settings\Rodina\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Rodina\Plocha\CFScript.txt
FW: Sygate Personal Firewall *disabled*
* Vytvořen nový Bod Obnovení

FILE ::
d:\documents and settings\All Users\Data aplikací\ECE179E22B.sys
d:\windows\java\Packages\S2DRBV7B.ZIP
d:\windows\java\Packages\YS6CDVX7.ZIP
d:\windows\S8EE954DF.tmp
d:\windows\UIA200.exe
d:\windows\UN32.EXE
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\All Users\Data aplikací\ECE179E22B.sys
d:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat
d:\windows\java\Packages\S2DRBV7B.ZIP
d:\windows\java\Packages\YS6CDVX7.ZIP
d:\windows\S8EE954DF.tmp\
d:\windows\system32\sysogg.dll
d:\windows\UIA200.exe
d:\windows\UN32.EXE
d:\windows\S8EE954DF.tmp . . . . nemohl být smazán

----- BITS: Možné infikované stránky -----

hxxp://91.203.93.6
hxxp://78.157.143.163
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-01 do 2009-02-01 )))))))))))))))))))))))))))))))
.

2009-02-01 18:26 . 2009-02-01 18:26 0 --------- d:\windows\S8EE954DF.tmp
2009-01-30 19:03 . 2009-01-30 19:04 <DIR> d--h----- d:\windows\ie8
2009-01-30 14:46 . 2009-01-30 19:04 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Winamp
2009-01-30 11:52 . 2009-01-30 11:53 <DIR> d-------- d:\program files\RegCleaner
2009-01-29 16:43 . 2009-01-29 16:45 <DIR> d-------- d:\program files\Hard Disk Sentinel
2009-01-29 16:28 . 2009-01-29 16:29 <DIR> d-------- d:\program files\CCleaner
2009-01-28 21:30 . 2009-01-28 21:30 <DIR> d-------- d:\program files\Ventrilo
2009-01-28 21:30 . 2009-01-28 21:30 262 --a------ d:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-01-28 21:26 . 2009-01-28 21:27 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Ventrilo
2009-01-28 19:58 . 2009-01-28 19:58 <DIR> d-------- d:\program files\NOS
2009-01-28 19:58 . 2009-01-28 19:58 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\NOS
2009-01-26 17:45 . 2009-01-26 17:45 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Corel
2009-01-26 17:45 . 2009-01-26 17:45 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Corel
2009-01-23 18:09 . 2009-01-23 18:09 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Skype
2009-01-23 17:58 . 2009-01-23 17:58 <DIR> d-------- d:\windows\Cache
2009-01-23 17:57 . 2009-01-23 17:57 <DIR> d-------- d:\program files\uTorrent
2009-01-23 17:55 . 2009-01-23 17:55 <DIR> d-------- d:\program files\Common Files\lightning group shared files
2009-01-23 15:12 . 2009-01-23 15:12 <DIR> d-------- d:\documents and settings\NetworkService\Dokumenty
2009-01-22 20:01 . 2009-01-22 20:01 <DIR> d-------- d:\program files\Sygate
2009-01-22 20:01 . 2004-10-15 18:32 83,096 --a------ d:\windows\system32\SSSensor.dll
2009-01-22 20:01 . 2004-10-15 18:17 60,496 --a------ d:\windows\system32\drivers\Teefer.sys
2009-01-22 20:01 . 2004-10-15 18:18 21,075 --a------ d:\windows\system32\drivers\wpsdrvnt.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg6n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg5n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg4n.sys
2009-01-22 20:01 . 2004-10-15 18:32 14,568 --a------ d:\windows\system32\drivers\wg3n.sys
2009-01-22 16:25 . 2009-01-22 16:25 <DIR> d-------- d:\program files\Axxin Wow Logo Creator
2009-01-22 07:21 . 2009-01-22 07:21 <DIR> d-------- d:\program files\AMP WinOFF
2009-01-21 19:10 . 2009-01-21 19:10 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2009-01-21 19:09 . 2009-01-21 19:09 <DIR> d-------- d:\program files\SUPERAntiSpyware
2009-01-21 19:09 . 2009-01-28 21:30 <DIR> d-------- d:\program files\Common Files\Wise Installation Wizard
2009-01-21 19:09 . 2009-01-21 19:09 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\SUPERAntiSpyware.com
2009-01-21 19:08 . 2009-01-21 19:08 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Windows Search
2009-01-20 19:17 . 2009-01-20 19:17 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Blizzard
2009-01-20 07:53 . 2009-01-31 17:24 <DIR> d-------- d:\program files\Common Files\Blizzard Entertainment
2009-01-20 07:45 . 2009-01-20 07:45 <DIR> d-------- d:\program files\XP TCPIP Repair
2009-01-18 20:02 . 2009-01-20 16:29 <DIR> d-------- d:\program files\GameShadow
2009-01-18 19:30 . 2009-01-18 20:24 <DIR> d-------- d:\program files\Pivot Stickfigure Animator
2009-01-17 21:05 . 2009-01-21 19:35 <DIR> d-------- d:\program files\n2n Gui
2009-01-17 16:40 . 2009-01-17 16:40 <DIR> d-------- d:\program files\Edisk
2009-01-16 07:26 . 2009-01-16 07:26 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\EPSON
2009-01-15 17:21 . 2009-01-15 17:34 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Hamachi
2009-01-15 17:19 . 2009-01-15 17:21 <DIR> d-------- d:\program files\Hamachi
2009-01-15 09:37 . 2009-01-15 09:37 42,320 --a------ d:\windows\system32\xfcodec.dll
2009-01-14 14:11 . 2009-01-14 14:11 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Autodesk
2009-01-14 13:32 . 2000-09-27 08:36 753,152 --a------ d:\windows\system32\ss32x25.ocx
2009-01-14 13:32 . 2000-09-27 08:36 525,352 --a------ d:\windows\system32\DBGRID32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 511,424 --a------ d:\windows\system32\40Comupd.exe
2009-01-14 13:32 . 2000-09-27 08:36 244,232 --a------ d:\windows\system32\MSFLXGRD.OCX
2009-01-14 13:32 . 2000-09-27 08:37 209,408 --a------ d:\windows\system32\TABCTL32.OCX
2009-01-14 13:32 . 2000-09-27 08:37 200,704 --a------ d:\windows\system32\THREED32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 158,992 --a------ d:\windows\system32\COMCT232.OCX
2009-01-14 13:32 . 2000-09-27 08:36 89,600 --a------ d:\windows\system32\GRID32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 82,960 --a------ d:\windows\system32\PICCLP32.OCX
2009-01-14 13:32 . 2000-09-27 08:36 68,096 --a------ d:\windows\system32\cdslib5.dll
2009-01-14 13:32 . 2000-09-27 08:36 61,952 --a------ d:\windows\system32\Slide.ocx
2009-01-14 13:28 . 2009-01-14 13:31 <DIR> d-------- d:\program files\MechSoft
2009-01-13 19:33 . 2000-10-20 13:25 487,184 --a------ d:\windows\system32\Mrt7enu.dll
2009-01-13 19:33 . 2000-10-20 13:25 446,464 --a------ d:\windows\system32\hhactivex.dll
2009-01-13 19:33 . 2000-10-20 13:25 79,360 --a------ d:\windows\system32\acdbres.dll
2009-01-13 19:33 . 2000-10-20 13:25 31,744 --a------ d:\windows\system32\Hlp95en.dll
2009-01-13 19:32 . 2009-01-13 19:33 <DIR> d-------- d:\program files\Volo View Express
2009-01-13 19:29 . 2009-01-13 19:29 <DIR> d-------- d:\program files\Common Files\Wextech Shared
2009-01-13 19:29 . 2009-01-14 13:29 <DIR> d-------- d:\program files\Common Files\Autodesk Shared
2009-01-13 19:24 . 2009-01-13 19:24 260,096 --a------ d:\windows\CDILLA32.DLL
2009-01-13 19:24 . 2009-01-13 19:24 63,344 --a------ d:\windows\CDILLA05.DLL
2009-01-13 19:24 . 2009-01-13 19:24 60,416 --a------ d:\windows\CDILLA64.EXE
2009-01-13 19:24 . 2009-01-13 19:24 57,392 --a------ d:\windows\system32\drivers\CDANT.SYS
2009-01-13 19:24 . 2009-01-13 19:24 55,376 --a------ d:\windows\CDILLA40.DLL
2009-01-13 19:24 . 2009-01-13 19:24 45,056 --a------ d:\windows\CDILLA13.DLL
2009-01-13 19:24 . 2009-01-13 19:24 32,256 --a------ d:\windows\system32\drivers\CDANTSRV.EXE
2009-01-13 19:24 . 2009-01-13 19:24 23,856 --a------ d:\windows\CDILLA10.EXE
2009-01-13 19:24 . 2009-01-13 19:24 7,056 --a------ d:\windows\CDILLA16.EXE
2009-01-13 18:06 . 2008-01-07 14:29 352 --ah----- d:\windows\nod32fixtemdono.reg
2009-01-11 19:28 . 2008-12-11 11:57 333,952 -----c--- d:\windows\system32\dllcache\srv.sys
2009-01-11 19:28 . 2008-06-14 18:35 272,128 -----c--- d:\windows\system32\dllcache\bthport.sys
2009-01-11 19:27 . 2008-08-14 14:26 2,191,360 -----c--- d:\windows\system32\dllcache\ntoskrnl.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,147,328 -----c--- d:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,068,224 -----c--- d:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-11 19:27 . 2008-08-14 14:26 2,025,984 -----c--- d:\windows\system32\dllcache\ntkrpamp.exe
2009-01-11 19:27 . 2008-09-15 16:27 1,846,400 -----c--- d:\windows\system32\dllcache\win32k.sys
2009-01-11 19:27 . 2008-04-11 20:06 691,712 -----c--- d:\windows\system32\dllcache\inetcomm.dll
2009-01-11 19:27 . 2008-10-24 12:21 455,296 -----c--- d:\windows\system32\dllcache\mrxsmb.sys
2009-01-11 19:27 . 2008-10-15 17:38 337,408 -----c--- d:\windows\system32\dllcache\netapi32.dll
2009-01-11 19:27 . 2008-05-08 15:02 203,136 -----c--- d:\windows\system32\dllcache\rmcast.sys
2009-01-11 18:56 . 2008-04-13 22:06 144,384 --------- d:\windows\system32\drivers\hdaudbus.sys
2009-01-11 18:56 . 2008-04-14 00:10 10,240 --------- d:\windows\system32\drivers\sffp_mmc.sys
2009-01-11 18:25 . 2009-01-11 18:25 <DIR> d-------- d:\program files\Microsoft Bootvis
2009-01-11 18:10 . 2009-01-11 18:10 603,904 --a------ d:\windows\system32\TUProgSt.exe
2009-01-11 18:10 . 2009-01-11 18:10 360,192 --a------ d:\windows\system32\TuneUpDefragService.exe
2009-01-11 18:10 . 2008-12-11 13:31 27,904 --a------ d:\windows\system32\uxtuneup.dll
2009-01-11 17:44 . 2009-01-30 14:26 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-01-09 14:02 . 2009-01-09 17:14 <DIR> d-------- d:\program files\PowerTCP
2009-01-08 15:51 . 2009-01-25 10:08 <DIR> d---s---- d:\program files\Xfire
2009-01-08 15:51 . 2009-01-24 20:00 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Xfire
2009-01-08 15:40 . 2009-01-08 15:50 327 --a------ d:\windows\CoDUO.INI
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\program files\Trend Micro
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\program files\Malwarebytes' Anti-Malware
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Malwarebytes
2009-01-08 13:03 . 2009-01-08 13:03 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-01-08 13:03 . 2009-01-04 18:38 38,496 --a------ d:\windows\system32\drivers\mbamswissarmy.sys
2009-01-08 13:03 . 2009-01-04 18:38 15,504 --a------ d:\windows\system32\drivers\mbam.sys
2009-01-08 09:35 . 2009-01-24 19:41 746 --a------ d:\windows\CoD.INI
2009-01-06 20:40 . 2009-01-06 20:40 <DIR> d-------- d:\documents and settings\Rodina\Data aplikací\Ashampoo
2009-01-06 20:39 . 2009-01-06 20:39 <DIR> d-------- d:\program files\Ashampoo
2009-01-06 20:39 . 2009-01-06 20:39 <DIR> d-------- d:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-06 15:17 . 2009-01-06 15:17 <DIR> d-------- d:\program files\PowerQuest
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d-------- d:\documents and settings\Administrator\Plocha
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d--h----- d:\documents and settings\Administrator\Okolní tiskárny
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> d--h----- d:\documents and settings\Administrator\Okolní síť
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr------- d:\documents and settings\Administrator\Oblíbené položky
2009-01-05 15:20 . 2008-10-05 13:49 <DIR> d--h----- d:\documents and settings\Administrator\Šablony
2009-01-05 15:20 . 2008-10-05 15:32 <DIR> dr------- d:\documents and settings\Administrator\Nabídka Start
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr------- d:\documents and settings\Administrator\Dokumenty
2009-01-05 15:20 . 2009-01-05 15:21 <DIR> dr-h----- d:\documents and settings\Administrator\Data aplikací
2009-01-05 15:20 . 2009-01-30 19:05 <DIR> d-------- d:\documents and settings\Administrator
2009-01-04 19:08 . 2009-01-04 19:08 <DIR> d-------- d:\windows\system32\NtmsData
2009-01-02 17:54 . 2001-05-11 13:18 420,240 --a------ d:\windows\system32\mpg4c32.dll
2009-01-02 17:54 . 2001-03-26 04:41 245,760 --a------ d:\windows\system32\mp4sds32.ax
2009-01-01 15:26 . 2009-01-01 15:27 <DIR> d-------- d:\program files\Free Download Manager

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-30 18:04 --------- d-----w d:\program files\QIP Infium
2009-01-29 18:14 --------- d-----w d:\program files\Common Files\Corel
2009-01-29 15:09 --------- d-----w d:\documents and settings\Rodina\Data aplikací\skypePM
2009-01-29 15:09 --------- d-----w d:\documents and settings\Rodina\Data aplikací\Skype
2009-01-28 19:00 --------- d-----w d:\program files\Common Files\Adobe
2009-01-27 14:19 --------- d-----w d:\program files\mIRC
2009-01-25 16:53 --------- d-----w d:\documents and settings\Rodina\Data aplikací\HLSW
2009-01-25 16:52 138,376 ----a-w d:\windows\system32\drivers\PnkBstrK.sys
2009-01-23 17:57 --------- d-----w d:\documents and settings\Rodina\Data aplikací\uTorrent
2009-01-22 15:08 --------- d-----w d:\documents and settings\Rodina\Data aplikací\teamspeak2
2009-01-20 16:00 --------- d-----w d:\program files\7-Zip
2009-01-18 18:52 --------- d--h--w d:\program files\InstallShield Installation Information
2009-01-17 17:48 --------- d-----w d:\program files\TuneUp Utilities 2009
2009-01-15 16:19 25,280 ----a-w d:\windows\system32\drivers\hamachi.sys
2009-01-13 17:29 --------- d-----w d:\program files\RSL
2009-01-09 07:14 --------- d-s---w d:\program files\HLSW
2009-01-08 16:43 --------- d-----w d:\program files\Electronic Arts
2009-01-05 15:39 --------- d-----w d:\documents and settings\All Users\Data aplikací\Autodesk
2008-12-30 14:35 --------- d-----w d:\program files\Ogg Converter
2008-12-28 16:08 --------- d-----w d:\documents and settings\All Users\Data aplikací\Elaborate Bytes
2008-12-28 16:04 --------- d-----w d:\program files\Elaborate Bytes
2008-12-26 10:12 --------- d-----w d:\program files\Burn4Free
2008-12-22 16:46 --------- d-----w d:\program files\Opera
2008-12-18 14:42 --------- d-----w d:\program files\Windows Defender
2008-12-14 19:27 --------- d-----w d:\program files\Google
2008-12-11 10:57 333,952 ----a-w d:\windows\system32\drivers\srv.sys
2008-12-07 09:27 --------- d-----w d:\program files\epson
2008-12-07 09:21 --------- d-----w d:\program files\Windows Media Connect 2
2008-12-06 16:58 --------- d-----w d:\program files\Windows Live
2008-12-02 09:16 --------- d-----w d:\documents and settings\All Users\Data aplikací\ATI
2008-12-02 09:11 --------- d-----w d:\program files\ATI Technologies
2008-12-02 08:39 --------- d-----w d:\program files\upnito.sk Upload manager
2008-11-28 18:35 796,672 ----a-w d:\windows\GPInstall.exe
2008-11-23 17:41 3,140 --sha-w d:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2008-11-23 09:09 606,848 ----a-w d:\windows\flashax.exe
2008-11-23 09:09 12,288 ----a-w d:\windows\impborl.dll
2008-11-20 20:43 22,328 ----a-w d:\documents and settings\Rodina\Data aplikací\PnkBstrK.sys
2008-10-26 08:43 30 ----a-w d:\documents and settings\Rodina\jagex_runescape_preferences.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-31_19.36.13.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-20 19:02:28 163,328 ----a-w d:\windows\ERDNT\Hiv-backup\ERDNT.EXE
+ 2005-10-20 12:02:28 163,328 ----a-w d:\windows\ERDNT\Hiv-backup\ERDNT.EXE
- 2000-08-31 07:00:00 161,792 ----a-w d:\windows\SWREG.exe
+ 2000-08-31 07:00:00 286,720 ----a-w d:\windows\SWREG.exe
+ 2009-02-01 17:27:19 16,384 ----atw d:\windows\temp\Perflib_Perfdata_26c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="d:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 813912]
"IntelliPoint"="d:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Hard Disk Sentinel"="d:\program files\Hard Disk Sentinel\HDSentinel.exe" [2008-11-06 3407360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="d:\documents and settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 d:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 08:52 15360 d:\windows\system32\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=d:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Opera\\opera.exe"=
"d:\\Program Files\\uTorrent\\utorrent.exe"=
"d:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"d:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"d:\\WINDOWS\\system32\\java.exe"=
"d:\\Program Files\\QIP Infium\\infium.exe"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Free Download Manager\\fdm.exe"=
"g:\\Hry\\Call of Duty\\CoDMP.exe"=
"d:\\Program Files\\Xfire\\Xfire.exe"=
"g:\\Hry\\Call of Duty\\CoDUOMP.exe"=
"d:\\Program Files\\HLSW\\hlsw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Edisk\\eDisk klient\\eDisk klient.exe"=
"d:\\Program Files\\mIRC\\mirc.exe"=
"d:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"g:\\DOWNLOADS\\WowMatrix\\WowMatrix.exe"=
"e:\\World of Warcraft\\Repair.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"80:TCP"= 80:TCP:HTTP
"3658:UDP"= 3658:UDP:Game Packets
"59786:TCP"= 59786:TCP:Utorrent

R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R3 DynCal;Dynamic Calibration Service;d:\windows\system32\drivers\DynCal.sys [2005-09-26 8576]
R3 PSched;Plánovač paketů technologie QoS;d:\windows\system32\drivers\psched.sys [2002-08-29 69120]
R3 tap0901;TAP-Win32 Adapter V9;d:\windows\system32\drivers\tap0901.sys [2008-01-30 25216]
S2 WinDefend;Windows Defender;d:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 getPlus(R) Helper;getPlus(R) Helper;d:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-28 33752]
S3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;d:\windows\system32\TUProgSt.exe [2009-01-11 603904]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2009-02-01 d:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]

2009-01-24 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyServer = 127.0.0.1:8080
uInternet Settings,ProxyOverride = local
IE: Stáhnout Free Download Managerem - file://d:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://d:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://d:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://d:\program files\Free Download Manager\dlall.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - d:\windows\WebIE.dll
TCP: {054FA508-8656-4090-8104-94424010F112} = 172.27.12.254
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file:///D:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - d:\documents and settings\Rodina\Data aplikací\Mozilla\Firefox\Profiles\4ody1ps8.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/ig?hl=cs&source=iglk
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: d:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - plugin: d:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: d:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: d:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: d:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: g:\programy\Adobe\Reader 9.0\Reader\browser\nppdf32.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-01 18:27:40
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\vsdatant]
"ImagePath"=""
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-823518204-790525478-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:76,71,3c,af,14,c6,53,08,a4,50,e8,58,71,cd,84,2a,6a,e4,96,9e,a4,cf,cd,
18,37,28,f8,2b,58,6c,31,d9,9e,a9,68,63,20,fd,e5,d3,e2,48,12,ae,f8,54,64,57,\
"??"=hex:5c,2a,be,77,99,3e,61,31,c8,dc,45,8e,d2,9c,ad,99

[HKEY_USERS\S-1-5-21-823518204-790525478-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:e2,f4,b3,fc,25,ee,27,04,0a,8a,c5,e9,73,c4,13,1f,29,90,b7,49,39,
b4,15,dd,24,46,5a,fc,8c,d2,20,98,77,96,ae,af,0a,4e,06,e7,bd,2a,ec,1a,e5,aa,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(984)
d:\program files\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\windows\system32\ati2evxx.exe
d:\program files\Sygate\SPF\Smc.exe
d:\windows\system32\ati2evxx.exe
d:\windows\system32\drivers\CDANTSRV.EXE
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\PnkBstrA.exe
d:\windows\system32\PSIService.exe
d:\program files\Analog Devices\SoundMAX\SMAgent.exe
d:\windows\system32\wscntfy.exe
d:\program files\Microsoft IntelliPoint\dpupdchk.exe
.
**************************************************************************
.
Celkový čas: 2009-02-01 18:32:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-02-01 17:32:43
ComboFix2.txt 2009-01-31 18:38:10

Před spuštěním: 2 069 659 648
Po spuštění: 2,048,081,920

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /TUTag=8QDKYB /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional (TuneUp Záloha)" /fastdetect /NoExecute=OptIn /TUTag=8QDKYB-BAK


Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7
374 --- E O F --- 2009-01-30 18:30:04



tady je log z Combofixu

[swot]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:16, on 1.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\PSIService.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\Program Files\Microsoft IntelliType Pro\itype.exe
D:\Program Files\Microsoft IntelliPoint\ipoint.exe
D:\Program Files\Hard Disk Sentinel\HDSentinel.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - D:\WINDOWS\WebIE.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - D:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - D:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [itype] "D:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Hard Disk Sentinel] "D:\Program Files\Hard Disk Sentinel\HDSentinel.exe" /AUTORUN
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://D:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://D:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://D:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://D:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7545471171
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS3\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS4\Services\Tcpip\..\{2AF536E6-4510-4830-BDFE-0E4329492BF4}: NameServer = 172.27.12.254
O17 - HKLM\System\CS5\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS6\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O17 - HKLM\System\CS7\Services\Tcpip\..\{054FA508-8656-4090-8104-94424010F112}: NameServer = 172.27.12.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - D:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - D:\WINDOWS\System32\TuneUpDefragService.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 8632 bytes



zde z Hjt


Jinak, pred davnou dobou sem si pomoci TuneUpUtilities zablokoval zobrazovani "Výstrahy zabezpečení systému Windows" (kdyz vam neco chybi ukaze se vam takovej stit cervenej s X uprostred urcite vite) a ted se znovu objevil... jinak zmeny zatím necítím

[swot]

Jeste, ktery antivir doporucujete ? nemam na nej prachy takze asi free.. warez samozrejme sezenu ale nevim jestli to ma u antiviru cenu

[jaro3]

Stahni si Avanger
do něj podle navodu:
zadej prikaz z kodu:

Kód: Vybrat vše

Files to delete:
d:\windows\nod32fixtemdono.reg

Folders to delete:
d:\windows\S8EE954DF.tmp

po restartu log z avengeru.

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - - (no file)
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O24 - Desktop Component 0: (no name) - (no file)


vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Nainstaluj si Aviru nebo Avast (free).

[swot]

Toto mi to vyhodilo po restartu pc u Avangeru

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at D:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "d:\windows\nod32fixtemdono.reg" deleted successfully.

Error: "d:\windows\S8EE954DF.tmp" is not a folder! It may instead be a file.
Deletion of folder "d:\windows\S8EE954DF.tmp" failed!
Status: 0xc0000103 (STATUS_NOT_A_DIRECTORY)
--> use "Files to delete:" instead of "Folders to delete:" to delete an ordinary file


Completed script processing.

*******************

Finished! Terminate.

[jaro3]

Tak ten Avenger ještě jednou s tímto scriptem:

Kód: Vybrat vše

Files to delete:
d:\windows\S8EE954DF.tmp