Virů jak nastláno...

Zpráva

hoskinson · #1 Příspěvek od **hoskinson** » 02 led 2010 12:27

Dobrý den,
viry mi ovládly paměť i procesor,moje chyba,pustil jsem je...Něco vymazal NIS,něco Spybot ale ne úplně,takže prosím o kontrolu logu. Díky

Logfile of random's system information tool 1.06 (written by random/random)
Run by me at 2010-01-02 12:20:34
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 225 GB (94%) free of 238 GB
Total RAM: 1023 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21:11, on 2.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\program files\asus\asus remote\remotecontrolappl .exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\hdd health\hddhealth .exe
c:\program files\netmeter\netmeter .exe
c:\program files\meminfo\meminfo .exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\qip\qip .exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\RAR\RSIT.exe
C:\Program Files\trend micro\me.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [hddhealth] C:\Program Files\HDD Health\hddhealth.exe -wl
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKCU\..\Run: [QIP2005] c:\program files\qip\qip .exe
O4 - HKCU\..\Run: [MemInfo] C:\Program Files\MemInfo\meminfo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (file missing)
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 9062 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2009-05-07 169392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\WINDOWS\WebIE.dll [2009-11-28 491520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll [2009-08-26 378736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL [2009-08-26 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-30 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll [2009-08-26 378736]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\WINDOWS\WebIE.dll [2009-11-28 491520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"=C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe [2010-01-02 40960]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2010-01-02 40960]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"hddhealth"=C:\Program Files\HDD Health\hddhealth.exe [2010-01-02 40960]
"C:\Program Files\NetMeter\NetMeter.exe"=C:\Program Files\NetMeter\NetMeter.exe [2010-01-02 40960]
"QIP2005"=c:\program files\qip\qip .exe [2010-01-02 40960]
"MemInfo"=C:\Program Files\MemInfo\meminfo.exe [2010-01-02 40960]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
WDDMStatus.lnk - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
WDSmartWare.lnk - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-09-21 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\chvgk.exe"="C:\WINDOWS\system32\chvgk.exe:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-01-02 12:20:34 ----D---- C:\rsit
2010-01-01 21:55:44 ----A---- C:\WINDOWS\system32\chvgk.exe.delme91
2010-01-01 21:55:44 ----A---- C:\WINDOWS\system32\chvgk.exe
2010-01-01 21:55:44 ----A---- C:\WINDOWS\system32\chvgk .exe
2010-01-01 21:28:53 ----D---- C:\Program Files\WebSite X5 v8 - Evolution
2010-01-01 21:00:07 ----A---- C:\WINDOWS\iun6002.exe
2010-01-01 20:18:23 ----A---- C:\WINDOWS\system32\sshnas.dll
2010-01-01 14:36:41 ----D---- C:\MyWebSite
2009-12-31 17:35:00 ----D---- C:\Documents and Settings\me\Data aplikací\KompoZer
2009-12-31 17:34:42 ----D---- C:\Program Files\kompozer-0.7.10-win32
2009-12-29 22:35:10 ----D---- C:\Documents and Settings\me\Data aplikací\Wireshark
2009-12-29 21:49:47 ----D---- C:\Program Files\WinPcap
2009-12-29 21:48:10 ----D---- C:\Program Files\Wireshark
2009-12-29 12:06:28 ----D---- C:\Program Files\tcpview
2009-12-28 22:55:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\Seznam DVD 2008
2009-12-28 22:55:42 ----D---- C:\Program Files\Seznam DVD 2008
2009-12-26 17:14:52 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2009-12-17 16:41:08 ----D---- C:\Documents and Settings\me\Data aplikací\Western Digital
2009-12-17 16:40:21 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-12-17 16:40:04 ----D---- C:\Program Files\Western Digital
2009-12-16 22:13:32 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-12-15 17:14:11 ----D---- C:\69a6bdcb37c57ce20a7b
2009-12-15 17:13:47 ----D---- C:\WINDOWS\SxsCaPendDel
2009-12-13 10:48:25 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-12-13 10:45:38 ----D---- C:\Program Files\MSBuild
2009-12-13 10:45:32 ----D---- C:\WINDOWS\system32\XPSViewer
2009-12-13 10:45:27 ----D---- C:\WINDOWS\system32\en-us
2009-12-13 10:45:26 ----D---- C:\Program Files\Reference Assemblies
2009-12-13 10:44:42 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-12-12 20:51:06 ----D---- C:\Program Files\HDD Health
2009-12-12 20:26:59 ----D---- C:\Program Files\Registrar Registry Manager
2009-12-12 19:34:52 ----D---- C:\Program Files\Common Files\Teleca Shared
2009-12-12 19:30:55 ----D---- C:\WINDOWS\Downloaded Installations
2009-12-09 23:10:31 ----A---- C:\WINDOWS\imsins.BAK
2009-12-09 23:10:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2009-12-08 08:56:42 ----D---- C:\Documents and Settings\me\Data aplikací\VitySoft
2009-12-08 08:55:40 ----D---- C:\Program Files\FreeRapid-0.83
2009-12-07 14:46:29 ----D---- C:\Program Files\VB Colour Picker
2009-12-07 13:14:55 ----D---- C:\Program Files\trend micro
2009-12-06 13:13:36 ----D---- C:\Program Files\Common Files\BinarySense
2009-12-06 12:57:14 ----D---- C:\Program Files\AAALOGO2009.1
2009-12-06 11:47:48 ----SHD---- C:\RECYCLER
2009-12-06 11:06:44 ----A---- C:\Boot.bak
2009-12-06 11:06:40 ----RASHD---- C:\cmdcons
2009-12-06 09:08:48 ----D---- C:\Documents and Settings\me\Data aplikací\Malwarebytes
2009-12-06 09:08:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2009-12-04 10:45:35 ----D---- C:\PFiles
2009-12-03 21:08:56 ----D---- C:\Program Files\Alcohol Soft
2009-12-03 15:05:37 ----D---- C:\Program Files\Nová složka
2009-12-03 14:17:09 ----D---- C:\Program Files\Common Files\EZB Systems
2009-12-03 14:17:06 ----D---- C:\Program Files\UltraISO

======List of files/folders modified in the last 1 months======

2010-01-02 12:20:39 ----D---- C:\WINDOWS\Temp
2010-01-02 12:20:35 ----D---- C:\WINDOWS\Prefetch
2010-01-02 12:20:25 ----D---- C:\RAR
2010-01-02 12:20:15 ----D---- C:\Documents and Settings\me\Data aplikací\IDM
2010-01-02 12:20:14 ----D---- C:\Documents and Settings\me\Data aplikací\DMCache
2010-01-02 12:18:53 ----A---- C:\WINDOWS\TRNCOM.INI
2010-01-02 12:05:27 ----AD---- C:\Program Files\MemInfo
2010-01-02 12:05:26 ----D---- C:\Program Files\QIP
2010-01-02 12:05:25 ----AD---- C:\Program Files\NetMeter
2010-01-02 12:05:19 ----RD---- C:\Program Files
2010-01-02 11:32:52 ----D---- C:\WINDOWS
2010-01-02 11:32:52 ----A---- C:\WINDOWS\MAILTRAN.INI
2010-01-02 00:31:26 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-02 00:31:26 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-01 23:35:21 ----D---- C:\WINDOWS\system32
2010-01-01 22:22:40 ----SD---- C:\WINDOWS\Tasks
2010-01-01 22:14:59 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-01 22:14:24 ----A---- C:\WINDOWS\vsnpstd3.exe
2010-01-01 21:57:52 ----A---- C:\WINDOWS\vsnpstd3.exe.delme88
2010-01-01 21:56:08 ----D---- C:\Program Files\Internet Explorer
2010-01-01 20:40:58 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-01 20:40:47 ----SHD---- C:\WINDOWS\Installer
2010-01-01 20:40:47 ----D---- C:\Config.Msi
2010-01-01 13:36:43 ----D---- C:\Program Files\Nvu
2009-12-31 10:46:09 ----A---- C:\WINDOWS\NeroDigital.ini
2009-12-31 08:13:26 ----D---- C:\WINDOWS\system32\config
2009-12-30 20:52:37 ----AD---- C:\Program Files\LFS
2009-12-30 14:06:41 ----D---- C:\WINDOWS\system32\NtmsData
2009-12-29 21:49:47 ----D---- C:\WINDOWS\system32\drivers
2009-12-29 13:10:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-28 21:08:29 ----D---- C:\Program Files\DiskBase
2009-12-28 20:58:39 ----A---- C:\WINDOWS\adpt.ini
2009-12-28 11:43:55 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2009-12-28 11:43:18 ----D---- C:\Documents and Settings\me\Data aplikací\MyPhoneExplorer
2009-12-28 11:34:13 ----HD---- C:\WINDOWS\inf
2009-12-28 10:34:07 ----A---- C:\WINDOWS\Altair.INI
2009-12-26 17:26:10 ----D---- C:\WINDOWS\system32\oodag
2009-12-26 17:17:12 ----D---- C:\WINDOWS\AppPatch
2009-12-26 17:14:39 ----HD---- C:\WINDOWS\$hf_mig$
2009-12-25 17:37:06 ----A---- C:\WINDOWS\WDICT32.INI
2009-12-24 14:06:43 ----D---- C:\Program Files\DreamCom
2009-12-17 16:40:23 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-12-17 15:48:03 ----D---- C:\WINDOWS\Microsoft.NET
2009-12-17 15:47:57 ----RSD---- C:\WINDOWS\assembly
2009-12-16 22:16:17 ----D---- C:\WINDOWS\WinSxS
2009-12-16 22:13:50 ----D---- C:\WINDOWS\system32\CatRoot
2009-12-16 20:39:47 ----D---- C:\Program Files\TuneUp Utilities 2010
2009-12-15 17:15:06 ----RSD---- C:\WINDOWS\Fonts
2009-12-13 10:48:05 ----D---- C:\WINDOWS\system32\cs-CZ
2009-12-13 10:47:35 ----D---- C:\WINDOWS\system32\mui
2009-12-13 10:44:56 ----D---- C:\WINDOWS\system32\spool
2009-12-12 19:34:52 ----D---- C:\Program Files\Common Files
2009-12-12 19:34:50 ----D---- C:\Program Files\Sony Ericsson
2009-12-12 19:16:55 ----D---- C:\Program Files\Google
2009-12-12 15:42:03 ----D---- C:\Program Files\MyPhoneExplorer
2009-12-12 11:45:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-12-11 22:51:09 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-12-11 22:51:09 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2009-12-11 22:51:08 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-12-11 22:51:08 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-12-11 22:51:05 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2009-12-11 22:51:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-12-11 22:51:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-12-11 22:50:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956844_0$
2009-12-11 22:50:55 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-12-11 22:50:55 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2009-12-11 22:50:54 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2009-12-11 22:50:54 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2009-12-11 22:50:53 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2009-12-11 22:50:49 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-12-11 22:50:48 ----HDC---- C:\WINDOWS\$NtUninstallKB969947_0$
2009-12-11 22:50:45 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2009-12-11 22:50:43 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-12-11 22:50:40 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$
2009-12-11 22:50:36 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-12-11 22:50:33 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-12-10 20:55:13 ----SD---- C:\Documents and Settings\me\Data aplikací\Microsoft
2009-12-10 18:49:02 ----D---- C:\Program Files\The KMPlayer
2009-12-09 23:08:49 ----D---- C:\WINDOWS\Debug
2009-12-08 20:47:53 ----D---- C:\Program Files\AMP Font Viewer
2009-12-07 12:58:18 ----SHD---- C:\System Volume Information
2009-12-07 12:58:18 ----D---- C:\WINDOWS\system32\Restore
2009-12-06 22:56:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\DVD Shrink
2009-12-06 14:41:55 ----D---- C:\Program Files\Opera USB
2009-12-06 11:17:45 ----A---- C:\WINDOWS\system.ini
2009-12-06 11:06:44 ----RASH---- C:\boot.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 bbcap;bbcap; C:\WINDOWS\system32\DRIVERS\bbcap.sys [2009-11-29 2944]
R1 BHDrvx86;Symantec Heuristics Driver; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\BHDrvx86.sys [2009-08-26 259632]
R1 ccHP;Symantec Hash Provider; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\ccHPx86.sys [2009-11-28 482432]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091217.002\IDSxpx86.sys []
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 SRTSP;Symantec Real Time Storage Protection; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SRTSP.SYS [2009-08-26 308272]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\WINDOWS\system32\drivers\NIS\1007020.00B\SRTSPX.SYS [2009-08-26 43696]
R1 SYMTDI;Symantec Network Dispatch Driver; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMTDI.SYS [2009-08-26 217136]
R3 3xHybrid;3xHybrid service; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-02-14 2825088]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-05 141312]
R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-09-21 1334784]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVEX15.SYS []
R3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2009-10-20 50704]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;Symantec Network Filter Driver; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMFW.SYS [2009-08-26 89904]
R3 SYMIDS;Symantec Network Filter Driver; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMIDS.SYS [2009-08-26 33072]
R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-08-26 36400]
R3 SYMNDIS;Symantec Network Filter Driver; C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMNDIS.SYS [2009-08-26 36400]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-03-30 230400]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-02-11 79488]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 MPE;BDA MPE Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 pbfilter;pbfilter; \??\C:\Program Files\Peerblock\pbfilter.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2007-05-02 10222720]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 SYMDNS;SYMDNS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMDNS.SYS []
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-08-26 36400]
S3 SYMREDRV;SYMREDRV; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMREDRV.SYS []
S3 TfBulk;TfBulk; C:\WINDOWS\system32\DRIVERS\TfBulk.sys [2007-05-31 13312]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-09-21 376832]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [2009-08-26 117640]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-05-11 1050120]
R2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WDDMService;WD SmartWare Drive Manager; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-10-14 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-09-21 516096]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe /svc []
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe []
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2009-10-20 117264]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2009-11-28 435016]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

pitimir · #2 Příspěvek od **pitimir** » 02 led 2010 13:12

Ahoj, zeby Virtumonde?

Stiahni ComboFix, najlepsie na plochu. Vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall. Spust program cez ucet s administratorskymi pravami a postupuj podla instrukcii. Cely sken bude trvat cca 10 minut. Pocas neho moze byt PC restartovane. Log, ktory ComboFix vytvori, najdes na adrese "C:\ComboFix.txt".
Ten vloz sem.

Pozor: Kym ComboFix nevytvori log, na nic neklikat, nic nestlacat !!

hoskinson · #3 Příspěvek od **hoskinson** » 02 led 2010 13:38

...a je tady...

ComboFix 10-01-01.02 - me 02.01.2010 13:24:46.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.670 [GMT 1:00]
Spuštěný z: c:\rar\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\me\LOCALS~1\Temp\sshnas.dll
c:\windows\system32\ctfmon .exe
c:\windows\system32\chvgk .exe
c:\windows\system32\sshnas.dll
c:\windows\vsnpstd3 .exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS
-------\Service_SSHNAS

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-02 do 2010-01-02 )))))))))))))))))))))))))))))))
.

2010-01-02 11:20 . 2010-01-02 11:21 -------- d-----w- C:\rsit
2010-01-01 20:55 . 2010-01-01 21:14 40960 ----a-w- c:\windows\system32\chvgk.exe
2010-01-01 20:28 . 2010-01-01 20:40 -------- d-----w- c:\program files\WebSite X5 v8 - Evolution
2010-01-01 20:00 . 2010-01-01 19:59 737280 ----a-w- c:\windows\iun6002.exe
2010-01-01 13:36 . 2010-01-01 14:10 -------- d-----w- C:\MyWebSite
2009-12-31 16:34 . 2009-12-31 16:34 -------- d-----w- c:\program files\kompozer-0.7.10-win32
2009-12-29 20:49 . 2009-12-29 20:49 -------- d-----w- c:\program files\WinPcap
2009-12-29 20:48 . 2009-12-29 20:49 -------- d-----w- c:\program files\Wireshark
2009-12-29 11:06 . 2009-12-29 11:07 -------- d-----w- c:\program files\tcpview
2009-12-28 21:55 . 2009-12-28 21:56 -------- d-----w- c:\program files\Seznam DVD 2008
2009-12-28 21:13 . 2009-12-28 21:13 -------- d-----w- c:\documents and settings\me\Seznam DVD
2009-12-26 16:13 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-17 15:40 . 2009-12-17 15:40 -------- dc----w- c:\windows\system32\DRVSTORE
2009-12-17 15:40 . 2009-12-17 15:40 -------- d-----w- c:\program files\Western Digital
2009-12-17 15:25 . 2009-02-13 11:02 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys
2009-12-15 16:14 . 2009-12-15 16:14 -------- d-----w- C:\69a6bdcb37c57ce20a7b
2009-12-15 16:13 . 2009-12-15 16:53 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-14 20:54 . 2009-12-14 20:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\MSBuild
2009-12-13 09:45 . 2009-12-15 16:15 -------- d-----w- c:\windows\system32\XPSViewer
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\Reference Assemblies
2009-12-13 09:45 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-13 09:44 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-12-12 19:51 . 2010-01-02 12:32 -------- d-----w- c:\program files\HDD Health
2009-12-12 19:27 . 2009-11-13 11:23 32824 ----a-w- c:\windows\system32\rrMon.sys
2009-12-12 19:26 . 2009-12-28 19:27 -------- d-----w- c:\program files\Registrar Registry Manager
2009-12-12 18:42 . 2005-02-11 09:24 6144 ----a-r- c:\windows\system32\drivers\k750cm.sys
2009-12-12 18:41 . 2005-02-11 09:19 5744 ----a-r- c:\windows\system32\drivers\k750wh.sys
2009-12-12 18:34 . 2009-12-12 19:35 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-12-12 18:30 . 2009-12-12 18:30 -------- d-----w- c:\windows\Downloaded Installations
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\me\data aplikac?
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\All Users\data aplikac?
2009-12-08 07:55 . 2009-12-08 07:55 -------- d-----w- c:\program files\FreeRapid-0.83
2009-12-07 13:46 . 2009-12-07 13:49 -------- d-----w- c:\program files\VB Colour Picker
2009-12-07 12:14 . 2010-01-02 11:20 -------- d-----w- c:\program files\trend micro
2009-12-06 12:13 . 2009-12-08 06:53 -------- d-----w- c:\program files\Common Files\BinarySense
2009-12-06 11:57 . 2009-12-06 19:49 -------- d-----w- c:\program files\AAALOGO2009.1
2009-12-06 08:02 . 2009-12-06 08:02 -------- d-sh--w- c:\documents and settings\me\IECompatCache
2009-12-04 09:45 . 2009-12-04 09:45 -------- d-----w- C:\PFiles
2009-12-03 20:08 . 2009-12-03 20:08 -------- d-----w- c:\program files\Alcohol Soft
2009-12-03 20:06 . 2009-12-03 20:06 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\Nová složka
2009-12-03 13:17 . 2009-12-03 13:17 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-12-03 13:17 . 2009-12-03 13:19 -------- d-----w- c:\program files\UltraISO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 12:33 . 2009-11-28 11:55 -------- d-----w- c:\program files\QIP
2010-01-02 12:33 . 2009-11-28 12:10 -------- d---a-w- c:\program files\NetMeter
2010-01-02 12:32 . 2009-11-28 12:08 -------- d---a-w- c:\program files\MemInfo
2010-01-01 21:14 . 2009-12-02 20:09 40960 ----a-w- c:\windows\vsnpstd3.exe
2010-01-01 19:40 . 2009-11-26 18:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 12:36 . 2009-12-01 20:31 -------- d-----w- c:\program files\Nvu
2009-12-30 19:52 . 2009-11-28 12:05 -------- d---a-w- c:\program files\LFS
2009-12-29 12:10 . 2004-08-18 12:00 82552 ----a-w- c:\windows\system32\perfc005.dat
2009-12-29 12:10 . 2004-08-18 12:00 437832 ----a-w- c:\windows\system32\perfh005.dat
2009-12-28 20:08 . 2009-11-29 09:00 -------- d-----w- c:\program files\DiskBase
2009-12-24 13:06 . 2009-11-28 16:34 -------- d-----w- c:\program files\DreamCom
2009-12-16 19:39 . 2009-11-28 18:20 -------- d-----w- c:\program files\TuneUp Utilities 2010
2009-12-12 18:34 . 2009-11-28 16:09 -------- d-----w- c:\program files\Sony Ericsson
2009-12-12 18:16 . 2009-11-29 19:49 -------- d-----w- c:\program files\Google
2009-12-12 14:42 . 2009-11-30 18:49 -------- d-----w- c:\program files\MyPhoneExplorer
2009-12-10 17:49 . 2009-11-28 20:13 -------- d-----w- c:\program files\The KMPlayer
2009-12-08 19:47 . 2009-11-28 16:27 -------- d-----w- c:\program files\AMP Font Viewer
2009-12-06 13:41 . 2009-11-28 16:13 -------- d-----w- c:\program files\Opera USB
2009-12-02 20:12 . 2009-11-29 08:33 -------- d-----w- c:\program files\MSI
2009-12-02 20:09 . 2009-12-02 20:09 -------- d-----w- c:\program files\Common Files\snpstd3
2009-12-02 19:29 . 2009-12-02 19:23 -------- d-----w- c:\program files\TechSmith
2009-12-02 17:16 . 2009-11-28 12:57 294912 ----a-w- c:\windows\TrnWord.dll
2009-12-02 17:16 . 2009-11-28 12:57 356352 ----a-w- c:\windows\TrnOutl.dll
2009-12-02 17:16 . 2009-11-28 12:57 45056 ----a-w- c:\windows\TRNOEH.DLL
2009-12-02 17:16 . 2009-11-28 12:57 26624 ----a-w- c:\windows\OETRN.EXE
2009-12-02 17:16 . 2009-11-28 12:57 200704 ----a-w- c:\windows\TRNOET.DLL
2009-12-02 17:16 . 2009-11-29 11:05 -------- d-----w- c:\program files\PC Translator
2009-12-02 17:06 . 2009-11-28 13:01 -------- d-----w- c:\program files\Topfield
2009-12-01 19:20 . 2009-11-30 19:07 -------- d-----w- c:\program files\WebSite X5 Smart
2009-11-30 20:40 . 2009-11-28 11:05 -------- d-----w- c:\program files\Cobian Backup 9
2009-11-30 20:18 . 2009-11-30 20:14 -------- d-----w- c:\program files\Womble Multimedia
2009-11-30 19:25 . 2009-11-30 19:25 -------- d-----w- c:\program files\Avanquest
2009-11-30 18:14 . 2009-11-28 12:18 -------- d---a-w- c:\program files\The Ultimate File Splitter 1.0
2009-11-30 18:13 . 2009-11-30 18:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-30 18:13 . 2009-11-28 11:17 -------- d-----w- c:\program files\Java
2009-11-30 18:06 . 2009-11-28 12:16 -------- d---a-w- c:\program files\ShellExView
2009-11-30 18:04 . 2009-11-30 18:04 -------- d-----w- c:\program files\Skype
2009-11-30 18:00 . 2009-11-30 18:00 -------- d-----w- c:\program files\Samsung
2009-11-30 17:59 . 2009-11-28 16:20 -------- d---a-w- c:\program files\RealDrawPRO4
2009-11-30 17:53 . 2009-11-28 16:20 -------- d-----w- c:\program files\pravitko
2009-11-30 17:41 . 2009-11-28 12:08 -------- d-----w- c:\program files\MediaCoder
2009-11-30 17:38 . 2009-11-28 16:19 -------- d---a-w- c:\program files\LiknoWebButtonMakerFree
2009-11-30 17:37 . 2009-11-28 12:05 -------- d---a-w- c:\program files\lexikon
2009-11-30 17:28 . 2009-11-28 12:02 -------- d---a-r- c:\program files\GSpot
2009-11-30 17:04 . 2009-11-28 16:19 -------- d---a-w- c:\program files\FileZilla FTP Client
2009-11-30 17:03 . 2009-11-28 12:00 -------- d---a-w- c:\program files\EvilLyrics
2009-11-30 17:00 . 2009-11-28 12:00 -------- d-----w- c:\program files\DVDFab Decrypter 3
2009-11-30 16:59 . 2009-11-28 12:00 -------- d---a-w- c:\program files\DVD Decrypter
2009-11-30 16:48 . 2009-11-28 18:02 -------- d-----w- c:\program files\Internet Download Manager
2009-11-30 15:51 . 2009-11-30 15:51 2331008 ----a-w- c:\windows\system32\TUKernel.exe
2009-11-29 20:37 . 2009-11-28 11:57 -------- d-----w- c:\program files\Cedulky
2009-11-29 20:36 . 2009-11-28 16:11 -------- d-----w- c:\program files\Caricature Studio 3.0
2009-11-29 20:33 . 2009-11-29 20:33 4608 ----a-w- c:\windows\system32\bbchlp.dll
2009-11-29 20:33 . 2009-11-29 20:33 2944 ----a-w- c:\windows\system32\drivers\bbcap.sys
2009-11-29 20:33 . 2009-11-29 20:33 27776 ----a-w- c:\windows\system32\bbcap.dll
2009-11-29 20:29 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Avidemux 2.4
2009-11-29 20:28 . 2009-11-29 20:27 -------- d-----w- c:\program files\AutoGK
2009-11-29 20:27 . 2009-11-29 20:27 43602 ----a-w- c:\windows\system32\xvid-uninstall.exe
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\AviSynth 2.5
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\Gabest
2009-11-29 20:26 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Audacity
2009-11-29 19:46 . 2009-11-28 11:14 -------- d---a-w- c:\program files\DVD Shrink
2009-11-29 17:50 . 2009-11-29 17:50 -------- d-----w- c:\program files\Microsoft.NET
2009-11-29 14:54 . 2009-11-29 14:51 -------- d-----w- c:\program files\linguatec
2009-11-29 10:52 . 2009-11-29 10:52 -------- d-----w- c:\program files\MSXML 4.0
2009-11-29 10:30 . 2009-11-29 10:12 -------- d-----w- c:\program files\Zoner
2009-11-29 08:28 . 2009-11-29 08:23 -------- d-----w- c:\program files\ASUS
2009-11-29 08:14 . 2009-11-29 07:52 113335 ----a-w- c:\windows\hpoins07.dat
2009-11-29 08:10 . 2009-11-29 08:10 -------- d-----w- c:\program files\Common Files\HP
2009-11-29 08:10 . 2009-11-29 07:57 -------- d-----w- c:\program files\HP
2009-11-29 08:09 . 2009-11-29 08:09 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-29 08:07 . 2009-11-29 08:07 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-11-28 22:06 . 2009-11-28 21:59 -------- d-----w- c:\program files\Nero
2009-11-28 22:01 . 2009-11-28 21:59 -------- d-----w- c:\program files\Common Files\Nero
2009-11-28 20:10 . 2009-11-28 20:10 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-28 18:56 . 2009-11-28 18:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-28 16:19 . 2009-11-28 16:19 -------- d-----w- c:\program files\CardTest
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostscript
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostgum
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\DComSoft
2009-11-28 15:26 . 2009-11-28 15:23 -------- d-----w- c:\program files\OO Software
2009-11-28 14:56 . 2009-11-28 14:50 -------- d-----w- c:\program files\ATI Technologies
2009-11-28 14:55 . 2009-11-28 14:55 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-28 14:48 . 2009-11-26 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-28 14:44 . 2009-11-28 14:44 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-11-28 14:15 . 2009-11-28 13:47 -------- d-----w- c:\program files\ICQ6.5
2009-11-28 13:46 . 2009-11-28 11:55 -------- d-----w- c:\program files\ICQ6
2009-11-28 13:30 . 2009-11-28 11:37 -------- d-----w- c:\program files\Symantec
2009-11-28 13:30 . 2009-11-28 11:37 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-11-28 13:30 . 2009-11-28 11:37 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-11-28 13:30 . 2009-11-28 11:37 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-11-28 13:30 . 2009-11-28 11:37 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-28 12:57 . 2009-11-28 12:57 491520 ----a-w- c:\windows\WebIE.dll
2009-11-28 12:20 . 2009-11-28 12:00 -------- d-----w- c:\program files\Diagnostika HDD
2009-11-28 12:16 . 2009-11-28 12:16 -------- d-----w- c:\program files\Smart PC Solutions
2009-11-28 11:57 . 2009-11-28 11:57 -------- d-----w- c:\program files\Calculator
2009-11-28 11:46 . 2009-11-28 11:37 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-11-28 11:36 . 2009-11-28 11:36 -------- d-----w- c:\program files\Norton Internet Security
2009-11-28 11:36 . 2009-11-28 11:36 -------- d-----w- c:\program files\Windows Sidebar
2009-11-28 11:36 . 2009-11-28 11:36 -------- d-----w- c:\program files\NortonInstaller
.

Kód: Vybrat vše

<pre>
c:\program files\ASUS\ASUS Remote\remotecontrolappl .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\HDD Health\hddhealth .exe
c:\program files\MemInfo\meminfo .exe
c:\program files\NetMeter\netmeter .exe
c:\program files\QIP\qip   .exe
c:\program files\QIP\qip  .exe
c:\program files\QIP\qip .exe
</pre>

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hddhealth"="c:\program files\HDD Health\hddhealth.exe" [2010-01-02 40960]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2010-01-02 40960]
"QIP2005"="c:\program files\qip\qip .exe" [2010-01-02 40960]
"MemInfo"="c:\program files\MemInfo\meminfo.exe" [2010-01-02 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2010-01-02 40960]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2010-01-02 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-10-14 9085760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"OEXPRESS"=c:\windows\OETRN.EXE
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"High Definition Audio Property Page Shortcut"=HDAShCut.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"tsnpstd3"=c:\windows\tsnpstd3.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\chvgk.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.12.2009 21:06 717296]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [28.11.2009 14:30 310320]
R1 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [29.11.2009 21:33 2944]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [28.11.2009 14:30 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [28.11.2009 14:30 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [21.12.2009 21:58 329592]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [28.11.2009 14:30 117640]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [14.10.2009 14:31 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 9:58 20480]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [29.11.2009 9:23 2825088]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [29.12.2009 21:31 102448]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;"c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe" --> c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 19:19 50704]
S3 pbfilter;pbfilter;\??\c:\program files\Peerblock\pbfilter.sys --> c:\program files\Peerblock\pbfilter.sys [?]
S3 TfBulk;TfBulk;c:\windows\system32\drivers\TfBulk.SYS [31.5.2007 21:11 13312]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [17.12.2009 16:25 11520]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 13:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys atapi.sys spgp.sys hal.dll >>UNKNOWN [0x8678C938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7873f28
\Driver\ACPI -> ACPI.sys @ 0xf76cecb8
\Driver\atapi -> atapi.sys @ 0xf7689b40
IoDeviceObjectType -> DeleteProcedure -> TUKERNEL.EXE @ 0x805a05a9
ParseProcedure -> TUKERNEL.EXE @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> TUKERNEL.EXE @ 0x805a05a9
ParseProcedure -> TUKERNEL.EXE @ 0x8056ea15
NDIS: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7543bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7550a21
SendHandler -> NDIS.sys @ 0xf752e87b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-57989841-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):83,42,84,7a,e0,3b,a0,2a,9d,c4,11,37,84,e8,00,75,56,05,58,0a,f0,
8f,7f,50,7e,3a,04,dc,5d,43,01,d9,25,b3,f4,f0,9d,17,99,0a,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9b4d8bd2-6202-4ad4-ae4f-bcf38762f032}]
@Denied: (Full) (Everyone)
"Model"=dword:00000167
"Therad"=dword:0000001d

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="38D140A9C8AA2DD0A9B3839FED7894F6A768EFF07D5F3B942D0054CD2522FA393796A30010953ED4E27A0D380E36D63319A016A1CB7C6832CFE85949938D675858B4BE5FAC359C34BCC6513637B4C78CAD7DA39FAE5EC15F05523E12E301BD34CE3127A79DA68FBD6B9A705E3B1F0746BC9DDCB5685CDE7564151196E7A12FDA93C0D50C697C7E53E8A86CC76E93D8B8DDD1700240C27BE0C7C0C719788691EB6252A81498BAF8EBF1DA2BE12BA5224E711FEAF58051F820CE1839B171BEDC1EBA03E09C365EB09087CC78EA4F5CEE8618C0C15678BCD84A5C90A3C831CB2FB8E0A7A3D4D454FB61EFCE00F73CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6171C11EC38DE3DFEBC9E127BECC74C3B060D50980065913945AF4169ABFAC48E096D6F9E618E3074F761E2A2E07A02B0E13CA95E35C926D2876A746242FB75C17503C45B71A5641771062E51D9504ECA70EEA2C40B39CA312615CE0B5AD593C81BDB8F07452FFAD25932E7AD6989F3C226E61658015B277ACEC32E6BF61518557F014CC98C3F5F07AF85CD19885FEEC49CF8A4D7F7AA67C65421B43F851A818ECE133E7BDB3C8187193563AA125A3F73909033B6B3F83E262CEC45F8531BD00FD745EAAAA85CD11DDD09F12C47D967E2E2A8699DDF685D1970F6893B119F8BE78CDE1D17CE314704E8DC021E4C12EF1D1952336788F101975E28EF5FD784BC1A85BB63380E1ADD6B4A21E2302B08E31D5AB441A22060630958F8A97121FA709D7B498EB78A4E937836D929CA4E1853D6F4870793FAD3C4CE64F72AB2CA07B75C4E8D35F04AD6EAC18420AA0807EF512C5A98BDB2D2C06B372C48AC179703AAB6821DB177B991EA54322083360991F6781DC9DF2A45ED9F0B7E202C48AD1A61003CA4A21127AF9D2FDC1A1358EDD5DD87F8102FDAD3772D834B486BA197CD797D48E269B4C7B81248C9E07BA4B067A89AC974AF57634D65CDA921EFB3C4F2956B152CAC92B184DB85615E258533C2F6668E93A8E6BDB39C8D541B01C28532DAF7B466570BE04210C3AD0E3919393C73156FA0270511C12C57A73D2CC89108F1485F8D953433F2C854E08129336AFA49C333DE7AE2ECE2EFB5272244F0044689F06F315AD6EDEC28F8CCDB275954F82781472837E14757C8A777F65D9B5910D2FDE3F3DC70B7D94CEAEAD52A47E60542553CE9359A7B339C9DE10050DEF55F84EE5F0E16339CB6DFD6D63A6C6A76C25137C726115944DDD17E56913B021E00D6B4A849C4840BD50BDB4F6B6EE43B280F1542F0AB1C4593D5A465967E817E9409B92B07EA7D575DFC8DB95CF30DD1003C4E2874279682639ADB450E3F0FA38FDAD575B84EEC38C6E8749D96826F3AE81C3A1BED"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1080)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2612)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\oodag.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\program files\asus\asus remote\remotecontrolappl .exe
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
c:\program files\internet explorer\wmpscfgs.exe
c:\program files\meminfo\meminfo .exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\netmeter\netmeter .exe
c:\program files\hdd health\hddhealth .exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\qip\qip .exe
.
**************************************************************************
.
Celkový čas: 2010-01-02 13:36:30 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-02 12:36

Před spuštěním: Volných bajtů: 236 226 719 744
Po spuštění: Volných bajtů: 236 433 092 608

- - End Of File - - BE2AC455DCBD885B1192B834DAB2A801

pitimir · #4 Příspěvek od **pitimir** » 02 led 2010 14:00

1) Stiahni SecurityCheck. Spust ho a postupuj podla instrukcii. Nakoniec vyhodi log, ktory skopiruj sem.

2) Stiahni Defogger. Spust, klik na "Disable" -> "OK". V mieste spustenia by sa mal zjavit log, ten sem vloz.

3) Start -> Spustit -> (napis) cmd /c mbr.exe -t >log.txt&start log.txt
Otvori sa textak (log.txt), aj jeho obsah sem skopiruj.

hoskinson · #5 Příspěvek od **hoskinson** » 02 led 2010 15:11

Folder C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\ was created.
Přestavování dříve stažených částí souborů...
Probíhá připojování...
Windows 5.1
v5.17b5 Time: Sat Jan 02 14:48:40.593 2010 (1262440120 sec)
Url http://screen317.spywareinfoforum.org /SecurityCheck.exe
User : anonymous, password :xxx
C0:Probíhá připojování...
C0:Checking connect, socket = 1736
C0:Připojení je v pořádku.
C0:Odesílá se příkaz GET...
C0:HTTP/1.1 206 Partial Content
C0:Date: Sat, 02 Jan 2010 13:48:40 GMT
C0:Server: Apache/2
C0:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C0:ETag: "33025d-cddb3-4796aa6b1b140"
C0:Accept-Ranges: bytes
C0:Content-Length: 843187
C0:Content-Range: bytes 0-843186/843187
C0:Content-Type: application/octet-stream
C0:
C0:Probíhá příjem dat...
time 1262440121
Připojují se volitelná připojení...
C1:Probíhá připojování...
time 1262440121
time 1262440121
Probíhá příjem dat...
Insert next chunk in list
s9
Adding record to registry with ID 1, startPos 425096, nextID -1
Updating record with num 0: set ID 0, startPos 0, nextID 1
C1:Odesílá se příkaz GET...
C1:HTTP/1.1 206 Partial Content
C1:Date: Sat, 02 Jan 2010 13:48:40 GMT
C1:Server: Apache/2
C1:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C1:ETag: "33025d-cddb3-4796aa6b1b140"
C1:Accept-Ranges: bytes
C1:Content-Length: 418091
C1:Content-Range: bytes 425096-843186/843187
C1:Content-Type: application/octet-stream
C1:
C1:Probíhá příjem dat...
C2:Probíhá připojování...
Insert next chunk in list
s9
Adding record to registry with ID 2, startPos 637642, nextID -1
Updating record with num 1: set ID 1, startPos 425096, nextID 2
C2:Odesílá se příkaz GET...
C2:HTTP/1.1 206 Partial Content
C2:Date: Sat, 02 Jan 2010 13:48:40 GMT
C2:Server: Apache/2
C2:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C2:ETag: "33025d-cddb3-4796aa6b1b140"
C2:Accept-Ranges: bytes
C2:Content-Length: 205545
C2:Content-Range: bytes 637642-843186/843187
C2:Content-Type: application/octet-stream
C2:
C2:Probíhá příjem dat...
C3:Probíhá připojování...
Insert next chunk in list
s9
Adding record to registry with ID 3, startPos 243791, nextID 1
Updating record with num 0: set ID 0, startPos 0, nextID 3
C3:Odesílá se příkaz GET...
C3:HTTP/1.1 206 Partial Content
C3:Date: Sat, 02 Jan 2010 13:48:41 GMT
C3:Server: Apache/2
C3:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C3:ETag: "33025d-cddb3-4796aa6b1b140"
C3:Accept-Ranges: bytes
C3:Content-Length: 181306
C3:Content-Range: bytes 243791-425096/843187
C3:Content-Type: application/octet-stream
C3:
C3:Probíhá příjem dat...
C4:Probíhá připojování...
C5:Probíhá připojování...
Insert next chunk in list
s9
Adding record to registry with ID 4, startPos 749755, nextID -1
Updating record with num 2: set ID 2, startPos 637642, nextID 4
C4:Odesílá se příkaz GET...
Insert next chunk in list
s9
Adding record to registry with ID 5, startPos 337944, nextID 1
Updating record with num 3: set ID 3, startPos 243791, nextID 5
C5:Odesílá se příkaz GET...
C4:HTTP/1.1 206 Partial Content
C4:Date: Sat, 02 Jan 2010 13:48:41 GMT
C4:Server: Apache/2
C4:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C4:ETag: "33025d-cddb3-4796aa6b1b140"
C4:Accept-Ranges: bytes
C4:Content-Length: 93432
C4:Content-Range: bytes 749755-843186/843187
C4:Content-Type: application/octet-stream
C4:
C4:Probíhá příjem dat...
C5:HTTP/1.1 206 Partial Content
C5:Date: Sat, 02 Jan 2010 13:48:41 GMT
C5:Server: Apache/2
C5:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C5:ETag: "33025d-cddb3-4796aa6b1b140"
C5:Accept-Ranges: bytes
C5:Content-Length: 87153
C5:Content-Range: bytes 337944-425096/843187
C5:Content-Type: application/octet-stream
C5:
C5:Probíhá příjem dat...
C6:Probíhá připojování...
C7:Probíhá připojování...
Insert next chunk in list
s9
Adding record to registry with ID 6, startPos 576479, nextID 2
Updating record with num 1: set ID 1, startPos 425096, nextID 6
C6:Odesílá se příkaz GET...
Insert next chunk in list
s9
Adding record to registry with ID 7, startPos 189490, nextID 3
Updating record with num 0: set ID 0, startPos 0, nextID 7
C7:Odesílá se příkaz GET...
C6:HTTP/1.1 206 Partial Content
C6:Date: Sat, 02 Jan 2010 13:48:41 GMT
C6:Server: Apache/2
C6:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C6:ETag: "33025d-cddb3-4796aa6b1b140"
C6:Accept-Ranges: bytes
C6:Content-Length: 61164
C6:Content-Range: bytes 576479-637642/843187
C6:Content-Type: application/octet-stream
C6:
C6:Probíhá příjem dat...
C7:HTTP/1.1 206 Partial Content
C7:Date: Sat, 02 Jan 2010 13:48:41 GMT
C7:Server: Apache/2
C7:Last-Modified: Sat, 28 Nov 2009 09:01:17 GMT
C7:ETag: "33025d-cddb3-4796aa6b1b140"
C7:Accept-Ranges: bytes
C7:Content-Length: 54302
C7:Content-Range: bytes 189490-243791/843187
C7:Content-Type: application/octet-stream
C7:
C7:Probíhá příjem dat...
C0:conn. 0 dowload complete
C0:Odpojeno.
C0:Dokončeno
C0:next 7
C2:conn. 2 dowload complete
C2:Odpojeno.
C2:Dokončeno
C2:next 4
C3:conn. 3 dowload complete
C3:Odpojeno.
C3:Dokončeno
C3:next 5
C5:conn. 5 dowload complete
C5:Odpojeno.
C5:Dokončeno
C5:next 1
time 1262440123, speed 328660, downl 740463 Bytes
C7:conn. 7 dowload complete
C7:Odpojeno.
C7:Dokončeno
C7:next 3
C6:conn. 6 dowload complete
C6:Odpojeno.
C6:Dokončeno
C6:next 2
C1:conn. 1 dowload complete
C1:Odpojeno.
C1:Dokončeno
C1:next 6
C4:conn. 4 dowload complete
C4:Odpojeno.
C4:Dokončeno
C4:This is the last chunk.
Stahování skončilo. Celkem bylo staženo 843187 bajtů.
Stahování bylo dokončeno, stažené části se spojují do jednoho souboru...
Assembling all downloaded portions into one file...
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe is 189490
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe7 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe7 is 54301
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe7
Deleting record 7 from registry
Updating record with ID 0, set nextID 3
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe3 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe3 is 94153
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe3
Deleting record 3 from registry
Updating record with ID 0, set nextID 5
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe5 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe5 is 87152
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe5
Deleting record 5 from registry
Updating record with ID 0, set nextID 1
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe1 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe1 is 151383
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe1
Deleting record 1 from registry
Updating record with ID 0, set nextID 6
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe6 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe6 is 61163
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe6
Deleting record 6 from registry
Updating record with ID 0, set nextID 2
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe2 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe2 is 112113
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe2
Deleting record 2 from registry
Updating record with ID 0, set nextID 4
Adding file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe4 to file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe.
Size of C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe4 is 93432
Deleting temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe4
Deleting record 4 from registry
Updating record with ID 0, set nextID -1
Rebuilding file complete.
time 1262440125
time 1262440125, speed 245346, downl 843187 Bytes
Rename temp file C:\Documents and Settings\me\Data aplikací\IDM\DwnlData\me\SecurityCheck_154\SecurityCheck.exe to C:\RAR\SecurityCheck.exe.

defogger_disable by jpshortstuff (28.11.09.2)
Log created at 14:59 on 02/01/2010 (me)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Already disabled

-=E.O.F=-

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS
kernel: MBR read successfully

hoskinson · #6 Příspěvek od **hoskinson** » 02 led 2010 17:11

...neustále se připojuje 3 až 5 souborů iexplore.exe (každý užírá 20 až 60 MB paměti).Podle Wiresharku se připojují k různým adresám typu ad.media.atd...

Nepomůže ani vymazání v Prefetch,ani ukončení ve Správci,ani zákaz v IE (používám Operu,IE jen
minimálně).A jedou pořád - každých 30 s mám připojení...

Víc do toho nevidím,takže spoléhám na druhé...

pitimir · #7 Příspěvek od **pitimir** » 02 led 2010 17:37

Ten Security Check uloz normalne na plochu a spust este raz (a poriadne

). To iste sa tykalo ComboFixu, mal by na ploche a kde bol? Niekde uplne inde...na srandu to nepisem.

K tym pripojeniam: niet sa co cudovat, este ti tam ostali smejdy. A Prefetch nema nic spolocne s takymto spustanim programov.

Presun ikonu CF na plochu, vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall a otvor poznamkovy blok. Donho skopiruj:

Kód: Vybrat vše

http://viry.cz/forum/viewtopic.php?f=13&t=95643

KillAll::
Collect::
c:\windows\system32\chvgk.exe

Folder::
C:\69a6bdcb37c57ce20a7b

RegNull::
[HKEY_USERS\S-1-5-21-1606980848-57989841-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]

RegLockDel::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9b4d8bd2-6202-4ad4-ae4f-bcf38762f032}]

Uloz na plochu ako CFScript.txt a mysou pretiahni nad ikonou CF.

Obrázek

Program script spracuje a spravi novy log.

Pozor: Ak po aplikacii skriptu nenabehne Windows, restartuj PC, stlac F8 a zvol Poslednu znamu funkcnu konfiguraciu.

hoskinson · #8 Příspěvek od **hoskinson** » 02 led 2010 18:13

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Norton Internet Security
``````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
HijackThis 2.0.2
TuneUp Utilities
TuneUp Utilities
TuneUp Utilities Language Pack (en-US)
Java(TM) 6 Update 17
Adobe Flash Player 10
Adobe Reader 9.2
``````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

ComboFix 10-01-01.02 - me 02.01.2010 17:56:57.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.363 [GMT 1:00]
Spuštěný z: c:\documents and settings\me\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\me\Plocha\CFScript.txt.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

file zipped: c:\windows\system32\chvgk.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\69a6bdcb37c57ce20a7b
c:\69a6bdcb37c57ce20a7b\amd64\filterpipelineprintproc.dll
c:\69a6bdcb37c57ce20a7b\amd64\msxpsdrv.cat
c:\69a6bdcb37c57ce20a7b\amd64\msxpsdrv.inf
c:\69a6bdcb37c57ce20a7b\amd64\msxpsinc.gpd
c:\69a6bdcb37c57ce20a7b\amd64\msxpsinc.ppd
c:\69a6bdcb37c57ce20a7b\amd64\mxdwdrv.dll
c:\69a6bdcb37c57ce20a7b\amd64\xpssvcs.dll
c:\69a6bdcb37c57ce20a7b\i386\filterpipelineprintproc.dll
c:\69a6bdcb37c57ce20a7b\i386\msxpsdrv.cat
c:\69a6bdcb37c57ce20a7b\i386\msxpsdrv.inf
c:\69a6bdcb37c57ce20a7b\i386\msxpsinc.gpd
c:\69a6bdcb37c57ce20a7b\i386\msxpsinc.ppd
c:\69a6bdcb37c57ce20a7b\i386\mxdwdrv.dll
c:\69a6bdcb37c57ce20a7b\i386\xpssvcs.dll
c:\windows\system32\ctfmon .exe
c:\windows\system32\chvgk.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-02 do 2010-01-02 )))))))))))))))))))))))))))))))
.

2010-01-02 11:20 . 2010-01-02 11:21 -------- d-----w- C:\rsit
2010-01-01 20:28 . 2010-01-01 20:40 -------- d-----w- c:\program files\WebSite X5 v8 - Evolution
2010-01-01 20:00 . 2010-01-01 19:59 737280 ----a-w- c:\windows\iun6002.exe
2010-01-01 13:36 . 2010-01-01 14:10 -------- d-----w- C:\MyWebSite
2009-12-31 16:34 . 2009-12-31 16:34 -------- d-----w- c:\program files\kompozer-0.7.10-win32
2009-12-29 20:49 . 2009-12-29 20:49 -------- d-----w- c:\program files\WinPcap
2009-12-29 20:48 . 2009-12-29 20:49 -------- d-----w- c:\program files\Wireshark
2009-12-29 11:06 . 2009-12-29 11:07 -------- d-----w- c:\program files\tcpview
2009-12-28 21:55 . 2009-12-28 21:56 -------- d-----w- c:\program files\Seznam DVD 2008
2009-12-28 21:13 . 2009-12-28 21:13 -------- d-----w- c:\documents and settings\me\Seznam DVD
2009-12-26 16:13 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-17 15:40 . 2009-12-17 15:40 -------- dc----w- c:\windows\system32\DRVSTORE
2009-12-17 15:40 . 2009-12-17 15:40 -------- d-----w- c:\program files\Western Digital
2009-12-17 15:25 . 2009-02-13 11:02 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys
2009-12-15 16:13 . 2009-12-15 16:53 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-14 20:54 . 2009-12-14 20:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\MSBuild
2009-12-13 09:45 . 2009-12-15 16:15 -------- d-----w- c:\windows\system32\XPSViewer
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\Reference Assemblies
2009-12-13 09:45 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-13 09:44 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-12-12 19:51 . 2010-01-02 17:03 -------- d-----w- c:\program files\HDD Health
2009-12-12 19:27 . 2009-11-13 11:23 32824 ----a-w- c:\windows\system32\rrMon.sys
2009-12-12 19:26 . 2009-12-28 19:27 -------- d-----w- c:\program files\Registrar Registry Manager
2009-12-12 18:42 . 2005-02-11 09:24 6144 ----a-r- c:\windows\system32\drivers\k750cm.sys
2009-12-12 18:41 . 2005-02-11 09:19 5744 ----a-r- c:\windows\system32\drivers\k750wh.sys
2009-12-12 18:34 . 2009-12-12 19:35 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-12-12 18:30 . 2009-12-12 18:30 -------- d-----w- c:\windows\Downloaded Installations
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\me\data aplikac?
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\All Users\data aplikac?
2009-12-08 07:55 . 2009-12-08 07:55 -------- d-----w- c:\program files\FreeRapid-0.83
2009-12-07 13:46 . 2009-12-07 13:49 -------- d-----w- c:\program files\VB Colour Picker
2009-12-07 12:14 . 2010-01-02 11:20 -------- d-----w- c:\program files\trend micro
2009-12-06 12:13 . 2009-12-08 06:53 -------- d-----w- c:\program files\Common Files\BinarySense
2009-12-06 11:57 . 2009-12-06 19:49 -------- d-----w- c:\program files\AAALOGO2009.1
2009-12-06 08:02 . 2009-12-06 08:02 -------- d-sh--w- c:\documents and settings\me\IECompatCache
2009-12-04 09:45 . 2009-12-04 09:45 -------- d-----w- C:\PFiles
2009-12-03 20:08 . 2009-12-03 20:08 -------- d-----w- c:\program files\Alcohol Soft
2009-12-03 20:06 . 2009-12-03 20:06 717296 ----a-w- c:\windows\system32\drivers\sptd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 17:05 . 2009-11-28 12:08 -------- d---a-w- c:\program files\MemInfo
2010-01-02 17:05 . 2009-11-28 11:55 -------- d-----w- c:\program files\QIP
2010-01-02 17:05 . 2009-11-28 12:10 -------- d---a-w- c:\program files\NetMeter
2010-01-01 21:14 . 2009-12-02 20:09 40960 ----a-w- c:\windows\vsnpstd3.exe
2010-01-01 19:40 . 2009-11-26 18:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 12:36 . 2009-12-01 20:31 -------- d-----w- c:\program files\Nvu
2009-12-30 19:52 . 2009-11-28 12:05 -------- d---a-w- c:\program files\LFS
2009-12-29 12:10 . 2004-08-18 12:00 82552 ----a-w- c:\windows\system32\perfc005.dat
2009-12-29 12:10 . 2004-08-18 12:00 437832 ----a-w- c:\windows\system32\perfh005.dat
2009-12-28 20:08 . 2009-11-29 09:00 -------- d-----w- c:\program files\DiskBase
2009-12-24 13:06 . 2009-11-28 16:34 -------- d-----w- c:\program files\DreamCom
2009-12-16 19:39 . 2009-11-28 18:20 -------- d-----w- c:\program files\TuneUp Utilities 2010
2009-12-12 18:34 . 2009-11-28 16:09 -------- d-----w- c:\program files\Sony Ericsson
2009-12-12 18:16 . 2009-11-29 19:49 -------- d-----w- c:\program files\Google
2009-12-12 14:42 . 2009-11-30 18:49 -------- d-----w- c:\program files\MyPhoneExplorer
2009-12-10 17:49 . 2009-11-28 20:13 -------- d-----w- c:\program files\The KMPlayer
2009-12-08 19:47 . 2009-11-28 16:27 -------- d-----w- c:\program files\AMP Font Viewer
2009-12-06 13:41 . 2009-11-28 16:13 -------- d-----w- c:\program files\Opera USB
2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\Nová složka
2009-12-03 13:19 . 2009-12-03 13:17 -------- d-----w- c:\program files\UltraISO
2009-12-03 13:17 . 2009-12-03 13:17 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-12-02 20:12 . 2009-11-29 08:33 -------- d-----w- c:\program files\MSI
2009-12-02 20:09 . 2009-12-02 20:09 -------- d-----w- c:\program files\Common Files\snpstd3
2009-12-02 19:29 . 2009-12-02 19:23 -------- d-----w- c:\program files\TechSmith
2009-12-02 17:16 . 2009-11-28 12:57 294912 ----a-w- c:\windows\TrnWord.dll
2009-12-02 17:16 . 2009-11-28 12:57 356352 ----a-w- c:\windows\TrnOutl.dll
2009-12-02 17:16 . 2009-11-28 12:57 45056 ----a-w- c:\windows\TRNOEH.DLL
2009-12-02 17:16 . 2009-11-28 12:57 26624 ----a-w- c:\windows\OETRN.EXE
2009-12-02 17:16 . 2009-11-28 12:57 200704 ----a-w- c:\windows\TRNOET.DLL
2009-12-02 17:16 . 2009-11-29 11:05 -------- d-----w- c:\program files\PC Translator
2009-12-02 17:06 . 2009-11-28 13:01 -------- d-----w- c:\program files\Topfield
2009-12-01 19:20 . 2009-11-30 19:07 -------- d-----w- c:\program files\WebSite X5 Smart
2009-11-30 20:40 . 2009-11-28 11:05 -------- d-----w- c:\program files\Cobian Backup 9
2009-11-30 20:18 . 2009-11-30 20:14 -------- d-----w- c:\program files\Womble Multimedia
2009-11-30 19:25 . 2009-11-30 19:25 -------- d-----w- c:\program files\Avanquest
2009-11-30 18:14 . 2009-11-28 12:18 -------- d---a-w- c:\program files\The Ultimate File Splitter 1.0
2009-11-30 18:13 . 2009-11-30 18:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-30 18:13 . 2009-11-28 11:17 -------- d-----w- c:\program files\Java
2009-11-30 18:06 . 2009-11-28 12:16 -------- d---a-w- c:\program files\ShellExView
2009-11-30 18:04 . 2009-11-30 18:04 -------- d-----w- c:\program files\Skype
2009-11-30 18:00 . 2009-11-30 18:00 -------- d-----w- c:\program files\Samsung
2009-11-30 17:59 . 2009-11-28 16:20 -------- d---a-w- c:\program files\RealDrawPRO4
2009-11-30 17:53 . 2009-11-28 16:20 -------- d-----w- c:\program files\pravitko
2009-11-30 17:41 . 2009-11-28 12:08 -------- d-----w- c:\program files\MediaCoder
2009-11-30 17:38 . 2009-11-28 16:19 -------- d---a-w- c:\program files\LiknoWebButtonMakerFree
2009-11-30 17:37 . 2009-11-28 12:05 -------- d---a-w- c:\program files\lexikon
2009-11-30 17:28 . 2009-11-28 12:02 -------- d---a-r- c:\program files\GSpot
2009-11-30 17:04 . 2009-11-28 16:19 -------- d---a-w- c:\program files\FileZilla FTP Client
2009-11-30 17:03 . 2009-11-28 12:00 -------- d---a-w- c:\program files\EvilLyrics
2009-11-30 17:00 . 2009-11-28 12:00 -------- d-----w- c:\program files\DVDFab Decrypter 3
2009-11-30 16:59 . 2009-11-28 12:00 -------- d---a-w- c:\program files\DVD Decrypter
2009-11-30 16:48 . 2009-11-28 18:02 -------- d-----w- c:\program files\Internet Download Manager
2009-11-30 15:51 . 2009-11-30 15:51 2331008 ----a-w- c:\windows\system32\TUKernel.exe
2009-11-29 20:37 . 2009-11-28 11:57 -------- d-----w- c:\program files\Cedulky
2009-11-29 20:36 . 2009-11-28 16:11 -------- d-----w- c:\program files\Caricature Studio 3.0
2009-11-29 20:33 . 2009-11-29 20:33 4608 ----a-w- c:\windows\system32\bbchlp.dll
2009-11-29 20:33 . 2009-11-29 20:33 2944 ----a-w- c:\windows\system32\drivers\bbcap.sys
2009-11-29 20:33 . 2009-11-29 20:33 27776 ----a-w- c:\windows\system32\bbcap.dll
2009-11-29 20:29 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Avidemux 2.4
2009-11-29 20:28 . 2009-11-29 20:27 -------- d-----w- c:\program files\AutoGK
2009-11-29 20:27 . 2009-11-29 20:27 43602 ----a-w- c:\windows\system32\xvid-uninstall.exe
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\AviSynth 2.5
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\Gabest
2009-11-29 20:26 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Audacity
2009-11-29 19:46 . 2009-11-28 11:14 -------- d---a-w- c:\program files\DVD Shrink
2009-11-29 17:50 . 2009-11-29 17:50 -------- d-----w- c:\program files\Microsoft.NET
2009-11-29 14:54 . 2009-11-29 14:51 -------- d-----w- c:\program files\linguatec
2009-11-29 10:52 . 2009-11-29 10:52 -------- d-----w- c:\program files\MSXML 4.0
2009-11-29 10:30 . 2009-11-29 10:12 -------- d-----w- c:\program files\Zoner
2009-11-29 08:28 . 2009-11-29 08:23 -------- d-----w- c:\program files\ASUS
2009-11-29 08:14 . 2009-11-29 07:52 113335 ----a-w- c:\windows\hpoins07.dat
2009-11-29 08:10 . 2009-11-29 08:10 -------- d-----w- c:\program files\Common Files\HP
2009-11-29 08:10 . 2009-11-29 07:57 -------- d-----w- c:\program files\HP
2009-11-29 08:09 . 2009-11-29 08:09 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-29 08:07 . 2009-11-29 08:07 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-11-28 22:06 . 2009-11-28 21:59 -------- d-----w- c:\program files\Nero
2009-11-28 22:01 . 2009-11-28 21:59 -------- d-----w- c:\program files\Common Files\Nero
2009-11-28 20:10 . 2009-11-28 20:10 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-28 18:56 . 2009-11-28 18:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-28 16:19 . 2009-11-28 16:19 -------- d-----w- c:\program files\CardTest
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostscript
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostgum
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\DComSoft
2009-11-28 15:26 . 2009-11-28 15:23 -------- d-----w- c:\program files\OO Software
2009-11-28 14:56 . 2009-11-28 14:50 -------- d-----w- c:\program files\ATI Technologies
2009-11-28 14:55 . 2009-11-28 14:55 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-28 14:48 . 2009-11-26 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-28 14:44 . 2009-11-28 14:44 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-11-28 14:15 . 2009-11-28 13:47 -------- d-----w- c:\program files\ICQ6.5
2009-11-28 13:46 . 2009-11-28 11:55 -------- d-----w- c:\program files\ICQ6
2009-11-28 13:30 . 2009-11-28 11:37 -------- d-----w- c:\program files\Symantec
2009-11-28 13:30 . 2009-11-28 11:37 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-11-28 13:30 . 2009-11-28 11:37 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-11-28 13:30 . 2009-11-28 11:37 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-11-28 13:30 . 2009-11-28 11:37 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-28 12:57 . 2009-11-28 12:57 491520 ----a-w- c:\windows\WebIE.dll
2009-11-28 12:20 . 2009-11-28 12:00 -------- d-----w- c:\program files\Diagnostika HDD
2009-11-28 12:16 . 2009-11-28 12:16 -------- d-----w- c:\program files\Smart PC Solutions
2009-11-28 11:57 . 2009-11-28 11:57 -------- d-----w- c:\program files\Calculator
2009-11-28 11:46 . 2009-11-28 11:37 -------- d-----w- c:\program files\Common Files\Symantec Shared
.

Kód: Vybrat vše

<pre>
c:\program files\ASUS\ASUS Remote\remotecontrolappl .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\HDD Health\hddhealth .exe
c:\program files\MemInfo\meminfo .exe
c:\program files\NetMeter\netmeter .exe
c:\program files\QIP\qip     .exe
c:\program files\QIP\qip    .exe
c:\program files\QIP\qip   .exe
c:\program files\QIP\qip  .exe
c:\program files\QIP\qip .exe
</pre>

((((((((((((((((((((((((((((( SnapShot@2010-01-02_12.32.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-02 13:55 . 2010-01-02 13:55 16384 c:\windows\Temp\Perflib_Perfdata_5c4.dat
+ 2010-01-02 17:03 . 2010-01-02 17:03 16384 c:\windows\Temp\Perflib_Perfdata_4e0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hddhealth"="c:\program files\HDD Health\hddhealth.exe" [2010-01-02 40960]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2010-01-02 40960]
"QIP2005"="c:\program files\qip\qip .exe" [2010-01-02 40960]
"MemInfo"="c:\program files\MemInfo\meminfo.exe" [2010-01-02 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2010-01-02 40960]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2010-01-02 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-10-14 9085760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"OEXPRESS"=c:\windows\OETRN.EXE
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"High Definition Audio Property Page Shortcut"=HDAShCut.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"tsnpstd3"=c:\windows\tsnpstd3.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [28.11.2009 14:30 310320]
R1 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [29.11.2009 21:33 2944]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [28.11.2009 14:30 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [28.11.2009 14:30 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [21.12.2009 21:58 329592]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [28.11.2009 14:30 117640]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [14.10.2009 14:31 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 9:58 20480]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [29.11.2009 9:23 2825088]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [29.12.2009 21:31 102448]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;"c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe" --> c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 19:19 50704]
S3 pbfilter;pbfilter;\??\c:\program files\Peerblock\pbfilter.sys --> c:\program files\Peerblock\pbfilter.sys [?]
S3 TfBulk;TfBulk;c:\windows\system32\drivers\TfBulk.SYS [31.5.2007 21:11 13312]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [17.12.2009 16:25 11520]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.12.2009 21:06 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 18:04
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-57989841-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="38D140A9C8AA2DD0A9B3839FED7894F6A768EFF07D5F3B942D0054CD2522FA393796A30010953ED4E27A0D380E36D63319A016A1CB7C6832CFE85949938D675858B4BE5FAC359C34BCC6513637B4C78CAD7DA39FAE5EC15F05523E12E301BD34CE3127A79DA68FBD6B9A705E3B1F0746BC9DDCB5685CDE7564151196E7A12FDA93C0D50C697C7E53E8A86CC76E93D8B8DDD1700240C27BE0C7C0C719788691EB6252A81498BAF8EBF1DA2BE12BA5224E711FEAF58051F820CE1839B171BEDC1EBA03E09C365EB09087CC78EA4F5CEE8618C0C15678BCD84A5C90A3C831CB2FB8E0A7A3D4D454FB61EFCE00F73CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6171C11EC38DE3DFEBC9E127BECC74C3B060D50980065913945AF4169ABFAC48E096D6F9E618E3074F761E2A2E07A02B0E13CA95E35C926D2876A746242FB75C17503C45B71A5641771062E51D9504ECA70EEA2C40B39CA312615CE0B5AD593C81BDB8F07452FFAD25932E7AD6989F3C226E61658015B277ACEC32E6BF61518557F014CC98C3F5F07AF85CD19885FEEC49CF8A4D7F7AA67C65421B43F851A818ECE133E7BDB3C8187193563AA125A3F73909033B6B3F83E262CEC45F8531BD00FD745EAAAA85CD11DDD09F12C47D967E2E2A8699DDF685D1970F6893B119F8BE78CDE1D17CE314704E8DC021E4C12EF1D1952336788F101975E28EF5FD784BC1A85BB63380E1ADD6B4A21E2302B08E31D5AB441A22060630958F8A97121FA709D7B498EB78A4E937836D929CA4E1853D6F4870793FAD3C4CE64F72AB2CA07B75C4E8D35F04AD6EAC18420AA0807EF512C5A98BDB2D2C06B372C48AC179703AAB6821DB177B991EA54322083360991F6781DC9DF2A45ED9F0B7E202C48AD1A61003CA4A21127AF9D2FDC1A1358EDD5DD87F8102FDAD3772D834B486BA197CD797D48E269B4C7B81248C9E07BA4B067A89AC974AF57634D65CDA921EFB3C4F2956B152CAC92B184DB85615E258533C2F6668E93A8E6BDB39C8D541B01C28532DAF7B466570BE04210C3AD0E3919393C73156FA0270511C12C57A73D2CC89108F1485F8D953433F2C854E08129336AFA49C333DE7AE2ECE2EFB5272244F0044689F06F315AD6EDEC28F8CCDB275954F82781472837E14757C8A777F65D9B5910D2FDE3F3DC70B7D94CEAEAD52A47E60542553CE9359A7B339C9DE10050DEF55F84EE5F0E16339CB6DFD6D63A6C6A76C25137C726115944DDD17E56913B021E00D6B4A849C4840BD50BDB4F6B6EE43B280F1542F0AB1C4593D5A465967E817E9409B92B07EA7D575DFC8DB95CF30DD1003C4E2874279682639ADB450E3F0FA38FDAD575B84EEC38C6E8749D96826F3AE81C3A1BED"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1192)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3216)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\oodag.exe
c:\program files\asus\asus remote\remotecontrolappl .exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
c:\program files\internet explorer\wmpscfgs.exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\hdd health\hddhealth .exe
c:\program files\netmeter\netmeter .exe
c:\program files\meminfo\meminfo .exe
c:\program files\qip\qip .exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
.
**************************************************************************
.
Celkový čas: 2010-01-02 18:09:02 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-02 17:08
ComboFix2.txt 2010-01-02 12:36

Před spuštěním: Volných bajtů: 236 319 248 384
Po spuštění: Volných bajtů: 236 301 312 000

- - End Of File - - 7B0306F89398E669F737F5A8842C7040

pitimir · #9 Příspěvek od **pitimir** » 02 led 2010 18:33

Dakujem

Stiahni na plochu CureIt. Zatial ho nespustat. Restart do nudoveho rezimu (>>klik<<) a v nom spravis nasledovne:

Spust program dvojklikom, zrus pripadne vyzvy na stiahnutie novsej verzie a klikni na "Start".
Potvrd okna a automaticky zacne expresny scan. Ak sa pri tomto kratkom scane najdu infikovane subory, klikni na "Vyber vsetky" -> "Liecit" -> "Odstran neliecitelne".
Vo vrchnom menu klikni na "Volby" -> "Zmenit Nastavenia" a vyfajkni Heuristicka analyza a Vyzva na akciu -> "OK". Vrat sa naspat do hlavneho menu, v nom zvol komplet scan a klikni na zelenu sipku naprvo pod logom Dr. Web.
Ked bude scan hotovy, vo vrchnom menu klik na "File" a zvol "Uloz...". Uloz log na plochu, otvor v poznamkovom bloku a vloz ho sem. Nezabudni restartovat PC.

hoskinson · #10 Příspěvek od **hoskinson** » 02 led 2010 22:36

{2F4BEFE9-858F-4B48-829D-CDBDD5AF0449}.qbd\data001 C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{3AD18386-90AC-4 Trojan.Click.39881
{2F4BEFE9-858F-4B48-829D-CDBDD5AF0449}.qbd C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{3AD18386-90AC-4 Kontejner obsahuje nakažené objekty Přesunut.
{06C6B92B-C258-41AC-B8DC-4872B474D93A}.qbd\data001 C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{7EFCE54B-1D0F-4 Trojan.Click.39881
{06C6B92B-C258-41AC-B8DC-4872B474D93A}.qbd C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{7EFCE54B-1D0F-4 Kontejner obsahuje nakažené objekty Přesunut.
{08A2DA5A-26FE-46CB-9CDE-1EA4976284E7}.qbd\data001 C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{9C0DE55F-4AF7-4 Trojan.Packed.706
{08A2DA5A-26FE-46CB-9CDE-1EA4976284E7}.qbd C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{9C0DE55F-4AF7-4 Kontejner obsahuje nakažené objekty Přesunut.
{9A3FC8B4-A849-4FC4-B339-506326295B80}.qbd\data001 C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{A873E7D9-44D4-4 Trojan.Click.39881
{9A3FC8B4-A849-4FC4-B339-506326295B80}.qbd C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{A873E7D9-44D4-4 Kontejner obsahuje nakažené objekty Přesunut.
{D82F93E0-0978-4033-A145-A487A7A92DF4}.qbd\data001 C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{A873E7D9-44D4-4 Trojan.Click.39881
{D82F93E0-0978-4033-A145-A487A7A92DF4}.qbd C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup\{A873E7D9-44D4-4 Kontejner obsahuje nakažené objekty Přesunut.
sshnas.dll.vir C:\Qoobox\Quarantine\C\WINDOWS\system32 Trojan.Click.39880 Smazán.
A0025763.exe C:\System Volume Information\_restore{5F4AF070-E886-4B5D-AD2A-7467546650A0}\RP84 Trojan.DownLoad1.5059 Smazán.
A0026116.dll C:\System Volume Information\_restore{5F4AF070-E886-4B5D-AD2A-7467546650A0}\RP85 Trojan.Click.39880 Smazán.

pitimir · #11 Příspěvek od **pitimir** » 03 led 2010 12:50

Super.

1) Docistime to:

Odinstaluj Combofix:
Start -> Spustit -> (napis) combofix /uninstall

Pouzi T-Cleaner (ak by ho antivirus hlasil ako smejda, nic sa netreba bat, ide len o paranoju AV programu).

Precisti PC CCleanerom (vratane registrov).

Pouzi TFC (spust program a klikni na "Start". Pozor, PC moze byt restartovane).

2) Vloz log z HJT.

V pripade nezrovnalosti sa >>tu<< nachadza navod.

hoskinson · #12 Příspěvek od **hoskinson** » 03 led 2010 13:27

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:26:15, on 3.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
c:\program files\asus\asus remote\remotecontrolappl .exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
c:\program files\internet explorer\wmpscfgs.exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\netmeter\netmeter .exe
c:\program files\hdd health\hddhealth .exe
c:\program files\meminfo\meminfo .exe
c:\program files\qip\qip .exe
c:\program files\ati technologies\ati.ace\cli .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\program files\qip\qip .exe
c:\docume~1\me\locals~1\temp\wmpscfgs.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\RAR\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [hddhealth] C:\Program Files\HDD Health\hddhealth.exe -wl
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKCU\..\Run: [MemInfo] C:\Program Files\MemInfo\meminfo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QIP2005] c:\program files\qip\qip .exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (file missing)
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 8962 bytes

pitimir · #13 Příspěvek od **pitimir** » 03 led 2010 13:39

Ten bordel sa tam stale drzi...sprav prosim ta znova log z ComboFixu (musis ho nanovo stiahnut), vecer to odpalime snad uz nadobro. Teraz musim letiet z domu...

hoskinson · #14 Příspěvek od **hoskinson** » 03 led 2010 13:54

ComboFix 10-01-02.04 - me 03.01.2010 13:47:03.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.494 [GMT 1:00]
Spuštěný z: c:\documents and settings\me\Plocha\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ctfmon .exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-03 do 2010-01-03 )))))))))))))))))))))))))))))))
.

2010-01-03 12:11 . 2010-01-03 12:11 -------- d-----w- c:\program files\CCleaner
2010-01-02 17:45 . 2010-01-02 18:13 -------- d-----w- c:\documents and settings\me\DoctorWeb
2010-01-01 20:28 . 2010-01-01 20:40 -------- d-----w- c:\program files\WebSite X5 v8 - Evolution
2010-01-01 20:00 . 2010-01-01 19:59 737280 ----a-w- c:\windows\iun6002.exe
2010-01-01 13:36 . 2010-01-01 14:10 -------- d-----w- C:\MyWebSite
2009-12-31 16:34 . 2009-12-31 16:34 -------- d-----w- c:\program files\kompozer-0.7.10-win32
2009-12-29 20:49 . 2009-12-29 20:49 -------- d-----w- c:\program files\WinPcap
2009-12-29 20:48 . 2009-12-29 20:49 -------- d-----w- c:\program files\Wireshark
2009-12-29 11:06 . 2009-12-29 11:07 -------- d-----w- c:\program files\tcpview
2009-12-28 21:55 . 2009-12-28 21:56 -------- d-----w- c:\program files\Seznam DVD 2008
2009-12-28 21:13 . 2009-12-28 21:13 -------- d-----w- c:\documents and settings\me\Seznam DVD
2009-12-26 16:13 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-17 15:40 . 2009-12-17 15:40 -------- dc----w- c:\windows\system32\DRVSTORE
2009-12-17 15:40 . 2009-12-17 15:40 -------- d-----w- c:\program files\Western Digital
2009-12-17 15:25 . 2009-02-13 11:02 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys
2009-12-15 16:13 . 2009-12-15 16:53 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-14 20:54 . 2009-12-14 20:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\MSBuild
2009-12-13 09:45 . 2009-12-15 16:15 -------- d-----w- c:\windows\system32\XPSViewer
2009-12-13 09:45 . 2009-12-13 09:45 -------- d-----w- c:\program files\Reference Assemblies
2009-12-13 09:45 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-13 09:44 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-12-12 19:51 . 2010-01-03 12:31 -------- d-----w- c:\program files\HDD Health
2009-12-12 19:27 . 2009-11-13 11:23 32824 ----a-w- c:\windows\system32\rrMon.sys
2009-12-12 19:26 . 2009-12-28 19:27 -------- d-----w- c:\program files\Registrar Registry Manager
2009-12-12 18:42 . 2005-02-11 09:24 6144 ----a-r- c:\windows\system32\drivers\k750cm.sys
2009-12-12 18:41 . 2005-02-11 09:19 5744 ----a-r- c:\windows\system32\drivers\k750wh.sys
2009-12-12 18:34 . 2009-12-12 19:35 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-12-12 18:30 . 2009-12-12 18:30 -------- d-----w- c:\windows\Downloaded Installations
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\me\data aplikac?
2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\All Users\data aplikac?
2009-12-08 07:55 . 2009-12-08 07:55 -------- d-----w- c:\program files\FreeRapid-0.83
2009-12-07 13:46 . 2009-12-07 13:49 -------- d-----w- c:\program files\VB Colour Picker
2009-12-07 12:14 . 2010-01-02 11:20 -------- d-----w- c:\program files\trend micro
2009-12-06 12:13 . 2009-12-08 06:53 -------- d-----w- c:\program files\Common Files\BinarySense
2009-12-06 11:57 . 2009-12-06 19:49 -------- d-----w- c:\program files\AAALOGO2009.1
2009-12-06 08:02 . 2009-12-06 08:02 -------- d-sh--w- c:\documents and settings\me\IECompatCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 12:31 . 2009-11-28 11:55 -------- d-----w- c:\program files\QIP
2010-01-03 12:31 . 2009-11-28 12:08 -------- d---a-w- c:\program files\MemInfo
2010-01-03 12:31 . 2009-11-28 12:10 -------- d---a-w- c:\program files\NetMeter
2010-01-01 21:14 . 2009-12-02 20:09 40960 ----a-w- c:\windows\vsnpstd3.exe
2010-01-01 19:40 . 2009-11-26 18:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 12:36 . 2009-12-01 20:31 -------- d-----w- c:\program files\Nvu
2009-12-30 19:52 . 2009-11-28 12:05 -------- d---a-w- c:\program files\LFS
2009-12-29 12:10 . 2004-08-18 12:00 82552 ----a-w- c:\windows\system32\perfc005.dat
2009-12-29 12:10 . 2004-08-18 12:00 437832 ----a-w- c:\windows\system32\perfh005.dat
2009-12-28 20:08 . 2009-11-29 09:00 -------- d-----w- c:\program files\DiskBase
2009-12-24 13:06 . 2009-11-28 16:34 -------- d-----w- c:\program files\DreamCom
2009-12-16 19:39 . 2009-11-28 18:20 -------- d-----w- c:\program files\TuneUp Utilities 2010
2009-12-12 18:34 . 2009-11-28 16:09 -------- d-----w- c:\program files\Sony Ericsson
2009-12-12 18:16 . 2009-11-29 19:49 -------- d-----w- c:\program files\Google
2009-12-12 14:42 . 2009-11-30 18:49 -------- d-----w- c:\program files\MyPhoneExplorer
2009-12-10 17:49 . 2009-11-28 20:13 -------- d-----w- c:\program files\The KMPlayer
2009-12-08 19:47 . 2009-11-28 16:27 -------- d-----w- c:\program files\AMP Font Viewer
2009-12-06 13:41 . 2009-11-28 16:13 -------- d-----w- c:\program files\Opera USB
2009-12-03 20:08 . 2009-12-03 20:08 -------- d-----w- c:\program files\Alcohol Soft
2009-12-03 20:06 . 2009-12-03 20:06 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\Nová složka
2009-12-03 13:19 . 2009-12-03 13:17 -------- d-----w- c:\program files\UltraISO
2009-12-03 13:17 . 2009-12-03 13:17 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-12-02 20:12 . 2009-11-29 08:33 -------- d-----w- c:\program files\MSI
2009-12-02 20:09 . 2009-12-02 20:09 -------- d-----w- c:\program files\Common Files\snpstd3
2009-12-02 19:29 . 2009-12-02 19:23 -------- d-----w- c:\program files\TechSmith
2009-12-02 17:16 . 2009-11-28 12:57 294912 ----a-w- c:\windows\TrnWord.dll
2009-12-02 17:16 . 2009-11-28 12:57 356352 ----a-w- c:\windows\TrnOutl.dll
2009-12-02 17:16 . 2009-11-28 12:57 45056 ----a-w- c:\windows\TRNOEH.DLL
2009-12-02 17:16 . 2009-11-28 12:57 26624 ----a-w- c:\windows\OETRN.EXE
2009-12-02 17:16 . 2009-11-28 12:57 200704 ----a-w- c:\windows\TRNOET.DLL
2009-12-02 17:16 . 2009-11-29 11:05 -------- d-----w- c:\program files\PC Translator
2009-12-02 17:06 . 2009-11-28 13:01 -------- d-----w- c:\program files\Topfield
2009-12-01 19:20 . 2009-11-30 19:07 -------- d-----w- c:\program files\WebSite X5 Smart
2009-11-30 20:40 . 2009-11-28 11:05 -------- d-----w- c:\program files\Cobian Backup 9
2009-11-30 20:18 . 2009-11-30 20:14 -------- d-----w- c:\program files\Womble Multimedia
2009-11-30 19:25 . 2009-11-30 19:25 -------- d-----w- c:\program files\Avanquest
2009-11-30 18:14 . 2009-11-28 12:18 -------- d---a-w- c:\program files\The Ultimate File Splitter 1.0
2009-11-30 18:13 . 2009-11-30 18:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-30 18:13 . 2009-11-28 11:17 -------- d-----w- c:\program files\Java
2009-11-30 18:06 . 2009-11-28 12:16 -------- d---a-w- c:\program files\ShellExView
2009-11-30 18:04 . 2009-11-30 18:04 -------- d-----w- c:\program files\Skype
2009-11-30 18:00 . 2009-11-30 18:00 -------- d-----w- c:\program files\Samsung
2009-11-30 17:59 . 2009-11-28 16:20 -------- d---a-w- c:\program files\RealDrawPRO4
2009-11-30 17:53 . 2009-11-28 16:20 -------- d-----w- c:\program files\pravitko
2009-11-30 17:41 . 2009-11-28 12:08 -------- d-----w- c:\program files\MediaCoder
2009-11-30 17:38 . 2009-11-28 16:19 -------- d---a-w- c:\program files\LiknoWebButtonMakerFree
2009-11-30 17:37 . 2009-11-28 12:05 -------- d---a-w- c:\program files\lexikon
2009-11-30 17:28 . 2009-11-28 12:02 -------- d---a-r- c:\program files\GSpot
2009-11-30 17:04 . 2009-11-28 16:19 -------- d---a-w- c:\program files\FileZilla FTP Client
2009-11-30 17:03 . 2009-11-28 12:00 -------- d---a-w- c:\program files\EvilLyrics
2009-11-30 17:00 . 2009-11-28 12:00 -------- d-----w- c:\program files\DVDFab Decrypter 3
2009-11-30 16:59 . 2009-11-28 12:00 -------- d---a-w- c:\program files\DVD Decrypter
2009-11-30 16:48 . 2009-11-28 18:02 -------- d-----w- c:\program files\Internet Download Manager
2009-11-30 15:51 . 2009-11-30 15:51 2331008 ----a-w- c:\windows\system32\TUKernel.exe
2009-11-29 20:37 . 2009-11-28 11:57 -------- d-----w- c:\program files\Cedulky
2009-11-29 20:36 . 2009-11-28 16:11 -------- d-----w- c:\program files\Caricature Studio 3.0
2009-11-29 20:33 . 2009-11-29 20:33 4608 ----a-w- c:\windows\system32\bbchlp.dll
2009-11-29 20:33 . 2009-11-29 20:33 2944 ----a-w- c:\windows\system32\drivers\bbcap.sys
2009-11-29 20:33 . 2009-11-29 20:33 27776 ----a-w- c:\windows\system32\bbcap.dll
2009-11-29 20:29 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Avidemux 2.4
2009-11-29 20:28 . 2009-11-29 20:27 -------- d-----w- c:\program files\AutoGK
2009-11-29 20:27 . 2009-11-29 20:27 43602 ----a-w- c:\windows\system32\xvid-uninstall.exe
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\AviSynth 2.5
2009-11-29 20:27 . 2009-11-29 20:27 -------- d-----w- c:\program files\Gabest
2009-11-29 20:26 . 2009-11-28 11:56 -------- d---a-w- c:\program files\Audacity
2009-11-29 19:46 . 2009-11-28 11:14 -------- d---a-w- c:\program files\DVD Shrink
2009-11-29 17:50 . 2009-11-29 17:50 -------- d-----w- c:\program files\Microsoft.NET
2009-11-29 14:54 . 2009-11-29 14:51 -------- d-----w- c:\program files\linguatec
2009-11-29 10:52 . 2009-11-29 10:52 -------- d-----w- c:\program files\MSXML 4.0
2009-11-29 10:30 . 2009-11-29 10:12 -------- d-----w- c:\program files\Zoner
2009-11-29 08:28 . 2009-11-29 08:23 -------- d-----w- c:\program files\ASUS
2009-11-29 08:14 . 2009-11-29 07:52 113335 ----a-w- c:\windows\hpoins07.dat
2009-11-29 08:10 . 2009-11-29 08:10 -------- d-----w- c:\program files\Common Files\HP
2009-11-29 08:10 . 2009-11-29 07:57 -------- d-----w- c:\program files\HP
2009-11-29 08:09 . 2009-11-29 08:09 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-29 08:07 . 2009-11-29 08:07 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-11-28 22:06 . 2009-11-28 21:59 -------- d-----w- c:\program files\Nero
2009-11-28 22:01 . 2009-11-28 21:59 -------- d-----w- c:\program files\Common Files\Nero
2009-11-28 20:10 . 2009-11-28 20:10 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-28 18:56 . 2009-11-28 18:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-28 16:19 . 2009-11-28 16:19 -------- d-----w- c:\program files\CardTest
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostscript
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\Ghostgum
2009-11-28 16:11 . 2009-11-28 16:11 -------- d-----w- c:\program files\DComSoft
2009-11-28 15:26 . 2009-11-28 15:23 -------- d-----w- c:\program files\OO Software
2009-11-28 14:56 . 2009-11-28 14:50 -------- d-----w- c:\program files\ATI Technologies
2009-11-28 14:55 . 2009-11-28 14:55 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-28 14:48 . 2009-11-26 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-28 14:44 . 2009-11-28 14:44 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-11-28 14:15 . 2009-11-28 13:47 -------- d-----w- c:\program files\ICQ6.5
2009-11-28 13:46 . 2009-11-28 11:55 -------- d-----w- c:\program files\ICQ6
2009-11-28 13:30 . 2009-11-28 11:37 -------- d-----w- c:\program files\Symantec
2009-11-28 13:30 . 2009-11-28 11:37 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-11-28 13:30 . 2009-11-28 11:37 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-11-28 13:30 . 2009-11-28 11:37 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-11-28 13:30 . 2009-11-28 11:37 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-28 12:57 . 2009-11-28 12:57 491520 ----a-w- c:\windows\WebIE.dll
2009-11-28 12:20 . 2009-11-28 12:00 -------- d-----w- c:\program files\Diagnostika HDD
2009-11-28 12:16 . 2009-11-28 12:16 -------- d-----w- c:\program files\Smart PC Solutions
.

Kód: Vybrat vše

<pre>
c:\program files\ASUS\ASUS Remote\remotecontrolappl .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\HDD Health\hddhealth .exe
c:\program files\MemInfo\meminfo .exe
c:\program files\NetMeter\netmeter .exe
c:\program files\QIP\qip         .exe
c:\program files\QIP\qip        .exe
c:\program files\QIP\qip       .exe
c:\program files\QIP\qip      .exe
c:\program files\QIP\qip     .exe
c:\program files\QIP\qip    .exe
c:\program files\QIP\qip   .exe
c:\program files\QIP\qip  .exe
c:\program files\QIP\qip .exe
</pre>

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hddhealth"="c:\program files\HDD Health\hddhealth.exe" [2010-01-03 40960]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2010-01-03 40960]
"MemInfo"="c:\program files\MemInfo\meminfo.exe" [2010-01-03 40960]
"QIP2005"="c:\program files\qip\qip .exe" [2010-01-03 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2010-01-03 40960]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2010-01-03 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"OEXPRESS"=c:\windows\OETRN.EXE
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"High Definition Audio Property Page Shortcut"=HDAShCut.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"tsnpstd3"=c:\windows\tsnpstd3.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [28.11.2009 14:30 310320]
R1 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [29.11.2009 21:33 2944]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [28.11.2009 14:30 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [28.11.2009 14:30 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [21.12.2009 21:58 329592]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [28.11.2009 14:30 117640]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [14.10.2009 14:31 98304]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [29.11.2009 9:23 2825088]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [29.12.2009 21:31 102448]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;"c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe" --> c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [?]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 9:58 20480]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 19:19 50704]
S3 pbfilter;pbfilter;\??\c:\program files\Peerblock\pbfilter.sys --> c:\program files\Peerblock\pbfilter.sys [?]
S3 TfBulk;TfBulk;c:\windows\system32\drivers\TfBulk.SYS [31.5.2007 21:11 13312]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [17.12.2009 16:25 11520]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.12.2009 21:06 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-03 c:\windows\Tasks\Automatic maintenance.job
- c:\program files\TuneUp Utilities 2010\OneClickStarter.exe [2009-10-29 19:46]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 13:51
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1606980848-57989841-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="38D140A9C8AA2DD0A9B3839FED7894F6A768EFF07D5F3B942D0054CD2522FA393796A30010953ED4E27A0D380E36D63319A016A1CB7C6832CFE85949938D675858B4BE5FAC359C34BCC6513637B4C78CAD7DA39FAE5EC15F05523E12E301BD34CE3127A79DA68FBD6B9A705E3B1F0746BC9DDCB5685CDE7564151196E7A12FDA93C0D50C697C7E53E8A86CC76E93D8B8DDD1700240C27BE0C7C0C719788691EB6252A81498BAF8EBF1DA2BE12BA5224E711FEAF58051F820CE1839B171BEDC1EBA03E09C365EB09087CC78EA4F5CEE8618C0C15678BCD84A5C90A3C831CB2FB8E0A7A3D4D454FB61EFCE00F73CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6171C11EC38DE3DFEBC9E127BECC74C3B060D50980065913945AF4169ABFAC48E096D6F9E618E3074F761E2A2E07A02B0E13CA95E35C926D2876A746242FB75C17503C45B71A5641771062E51D9504ECA70EEA2C40B39CA312615CE0B5AD593C81BDB8F07452FFAD25932E7AD6989F3C226E61658015B277ACEC32E6BF61518557F014CC98C3F5F07AF85CD19885FEEC49CF8A4D7F7AA67C65421B43F851A818ECE133E7BDB3C8187193563AA125A3F73909033B6B3F83E262CEC45F8531BD00FD745EAAAA85CD11DDD09F12C47D967E2E2A8699DDF685D1970F6893B119F8BE78CDE1D17CE314704E8DC021E4C12EF1D1952336788F101975E28EF5FD784BC1A85BB63380E1ADD6B4A21E2302B08E31D5AB441A22060630958F8A97121FA709D7B498EB78A4E937836D929CA4E1853D6F4870793FAD3C4CE64F72AB2CA07B75C4E8D35F04AD6EAC18420AA0807EF512C5A98BDB2D2C06B372C48AC179703AAB6821DB177B991EA54322083360991F6781DC9DF2A45ED9F0B7E202C48AD1A61003CA4A21127AF9D2FDC1A1358EDD5DD87F8102FDAD3772D834B486BA197CD797D48E269B4C7B81248C9E07BA4B067A89AC974AF57634D65CDA921EFB3C4F2956B152CAC92B184DB85615E258533C2F6668E93A8E6BDB39C8D541B01C28532DAF7B466570BE04210C3AD0E3919393C73156FA0270511C12C57A73D2CC89108F1485F8D953433F2C854E08129336AFA49C333DE7AE2ECE2EFB5272244F0044689F06F315AD6EDEC28F8CCDB275954F82781472837E14757C8A777F65D9B5910D2FDE3F3DC70B7D94CEAEAD52A47E60542553CE9359A7B339C9DE10050DEF55F84EE5F0E16339CB6DFD6D63A6C6A76C25137C726115944DDD17E56913B021E00D6B4A849C4840BD50BDB4F6B6EE43B280F1542F0AB1C4593D5A465967E817E9409B92B07EA7D575DFC8DB95CF30DD1003C4E2874279682639ADB450E3F0FA38FDAD575B84EEC38C6E8749D96826F3AE81C3A1BED"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1260)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-01-03 13:53:30
ComboFix-quarantined-files.txt 2010-01-03 12:53

Před spuštěním: Volných bajtů: 236 683 640 832
Po spuštění: Volných bajtů: 236 651 589 632

- - End Of File - - C483F15741497AB20A44C8F40F4B90FA

hoskinson · #15 Příspěvek od **hoskinson** » 03 led 2010 14:04

...místo 6x "iexplore.exe" už jen 2 x ale přibylo 5 x "qip.exe"...

VIRY.CZ

Virů jak nastláno...

Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...

Re: Virů jak nastláno...