po zapnuti pc skryty iexplorer

[uniross]

zdravim
po zapnuti pocitace a nabehnuti vsech programu naskoci hlaska o necekanem vypnuti systemu a ukonceni prohlizece IE s moznosti obnovit predchozi relaci nebo zacit novou ... pri ukonceni pres krizek nabehne znovu, pri pouziti jakekoliv moznosti se zavre a nic se nestane - pouze ve spravci bezi jako proces iexplorer.exe (s malou hodnotou) - neni spusten jako aplikace ...musim podotknout, ze pouzivam mozillu ff
diky za pomoc


Logfile of random's system information tool 1.06 (written by random/random)
Run by r at 2010-01-03 13:30:10
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 67 GB (58%) free of 114 GB
Total RAM: 1023 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:30:32, on 3.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Programy\CoreCenter\CoreCenter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Documents and Settings\r\Plocha\RSIT.exe
C:\Program Files\trend micro\r.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:Blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: CoreCenter.lnk = C:\Programy\CoreCenter\CoreCenter.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\Programy\OFFICE~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Otevřít obrázek v aplikaci &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1029\phdintl.dll/phdContext.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\OFFICE~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\OFFICE~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\OFFICE~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5406273499
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/l2/bin/cortvrml.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5386 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\SLOW-PCfighter.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programy\Adobe\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-08-25 1062184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programy\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2007-03-19 949376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bootvis.lnk]
[]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
CoreCenter.lnk - C:\Programy\CoreCenter\CoreCenter.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"ShutdownWithoutLogon"=1
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"HideClock"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoResolveTrack"=
"NoViewContextMenu"=
"NoFileAssociate"=
"NoFind"=
"NoRun"=
"NoClose"=
"StartMenuLogoff"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Hry\Warcraft III\war3.exe"="C:\Hry\Warcraft III\war3.exe:*:Disabled:Warcraft III"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Programy\QIP\qip.exe"="C:\Programy\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\ZALOHY\utorrent.exe"="C:\ZALOHY\utorrent.exe:*:Enabled:µTorrent"
"C:\Programy\Office 2000\Office12\OUTLOOK.EXE"="C:\Programy\Office 2000\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Programy\Office 2000\Office12\ONENOTE.EXE"="C:\Programy\Office 2000\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-01-03 13:30:10 ----D---- C:\rsit
2010-01-03 13:30:10 ----D---- C:\Program Files\trend micro
2009-12-17 10:55:51 ----HDC---- C:\Documents and Settings\All Users\Data aplikací\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-12-17 10:35:06 ----A---- C:\WINDOWS\system32\AAP.DLL
2009-12-17 10:34:59 ----A---- C:\WINDOWS\system32\AAK.dll
2009-12-17 10:34:59 ----A---- C:\WINDOWS\system32\AAD.DLL
2009-12-17 07:50:02 ----D---- C:\Documents and Settings\r\Data aplikací\Fighters
2009-12-16 12:29:11 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-12-16 12:28:57 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-12-16 12:27:34 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-12-15 01:31:26 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-12-15 00:42:55 ----A---- C:\WINDOWS\system32\xwr16380.dll
2009-12-14 23:02:13 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-12-14 23:01:47 ----D---- C:\Program Files\Windows Media Connect 2
2009-12-14 23:01:38 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-12-14 23:00:50 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-12-14 23:00:20 ----D---- C:\WINDOWS\system32\LogFiles
2009-12-14 23:00:05 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-12-14 22:40:39 ----D---- C:\Documents and Settings\r\Data aplikací\Apple Computer
2009-12-14 22:38:17 ----D---- C:\Program Files\Common Files\Apple
2009-12-14 22:38:09 ----D---- C:\Program Files\Apple Software Update
2009-12-14 22:38:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2009-12-14 14:22:44 ----A---- C:\WINDOWS\system32\msonpmon.dll
2009-12-14 14:18:07 ----D---- C:\Program Files\Microsoft Works
2009-12-14 14:17:02 ----D---- C:\Program Files\Microsoft Visual Studio
2009-12-14 14:17:02 ----D---- C:\Program Files\Common Files\DESIGNER
2009-12-14 14:15:57 ----D---- C:\Program Files\Microsoft.NET
2009-12-14 14:13:09 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-12-14 14:12:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2009-12-14 14:11:19 ----RHD---- C:\MSOCache
2009-12-10 12:33:28 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2009-12-10 12:33:22 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-10 12:32:28 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-10 12:32:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-10 12:32:07 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2009-12-06 09:08:47 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-12-05 16:13:41 ----D---- C:\WINDOWS\system32\XPSViewer
2009-12-05 16:13:38 ----D---- C:\Program Files\MSBuild
2009-12-05 16:13:21 ----D---- C:\Program Files\Reference Assemblies
2009-12-05 16:12:24 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-12-05 16:12:23 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-12-05 16:12:23 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-12-05 16:12:23 ----D---- C:\Program Files\0bf907516ca8ab236048bd9e
2009-12-05 16:10:46 ----SHD---- C:\Config.Msi
2009-12-05 16:09:13 ----D---- C:\Program Files\db28559eae194151c979d857
2009-12-05 16:04:58 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-12-05 16:04:33 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-12-05 16:04:20 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2009-12-05 16:04:15 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-12-05 16:04:10 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-12-05 16:04:00 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-12-05 16:03:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-12-05 16:03:44 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-12-05 16:03:39 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-12-05 16:01:11 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-12-05 16:01:05 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-12-05 16:00:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-12-05 16:00:53 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-12-05 16:00:46 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-12-05 16:00:39 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-12-05 16:00:34 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-12-05 16:00:28 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-12-05 16:00:23 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-12-05 16:00:16 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2009-12-05 16:00:09 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-12-05 16:00:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-12-05 15:59:49 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-12-05 15:59:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-12-05 15:58:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-12-05 15:58:46 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-12-05 15:58:22 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-12-05 15:58:15 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-12-05 15:58:08 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-12-05 13:39:20 ----HD---- C:\WINDOWS\$hf_mig$
2009-12-05 13:12:00 ----SHD---- C:\RECYCLER
2009-12-05 12:55:46 ----A---- C:\WINDOWS\NIRCMD.exe
2009-12-05 12:55:46 ----A---- C:\WINDOWS\MBR.exe
2009-12-05 12:55:43 ----A---- C:\WINDOWS\zip.exe
2009-12-05 12:55:43 ----A---- C:\WINDOWS\SWREG.exe
2009-12-05 12:55:43 ----A---- C:\WINDOWS\sed.exe
2009-12-05 12:55:43 ----A---- C:\WINDOWS\PEV.exe
2009-12-05 12:55:43 ----A---- C:\WINDOWS\grep.exe
2009-12-05 12:55:42 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-12-05 12:55:42 ----A---- C:\WINDOWS\SWSC.exe
2009-12-05 12:55:27 ----D---- C:\WINDOWS\ERDNT
2009-12-05 12:39:12 ----D---- C:\WINDOWS\Performance

======List of files/folders modified in the last 1 months======

2010-01-03 13:30:10 ----RD---- C:\Program Files
2010-01-03 13:19:05 ----D---- C:\WINDOWS\Temp
2010-01-03 11:28:08 ----D---- C:\Program Files\Mozilla Firefox
2010-01-02 15:58:23 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-02 15:51:20 ----SHD---- C:\System Volume Information
2010-01-02 15:50:58 ----D---- C:\WINDOWS
2010-01-02 15:49:46 ----RSH---- C:\boot.ini
2010-01-02 15:49:46 ----A---- C:\WINDOWS\win.ini
2010-01-02 15:49:46 ----A---- C:\WINDOWS\system.ini
2010-01-02 15:45:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-01-02 15:24:54 ----D---- C:\WINDOWS\pss
2010-01-02 07:02:43 ----SD---- C:\WINDOWS\Tasks
2010-01-01 20:58:11 ----D---- C:\Documents and Settings\r\Data aplikací\Skype
2010-01-01 00:17:07 ----D---- C:\Hudba
2009-12-31 23:33:47 ----D---- C:\Downloads
2009-12-31 23:33:33 ----D---- C:\Documents and Settings\r\Data aplikací\uTorrent
2009-12-31 11:38:23 ----D---- C:\filmy
2009-12-28 21:52:00 ----SHD---- C:\WINDOWS\Installer
2009-12-23 09:49:02 ----RSD---- C:\WINDOWS\assembly
2009-12-23 09:47:40 ----RSD---- C:\WINDOWS\Fonts
2009-12-23 09:47:37 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-12-23 09:45:25 ----D---- C:\Program Files\Common Files\System
2009-12-17 11:53:52 ----D---- C:\WINDOWS\security
2009-12-17 11:37:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-17 11:37:19 ----D---- C:\WINDOWS\system32\inetsrv
2009-12-17 11:37:18 ----D---- C:\WINDOWS\system32
2009-12-17 11:03:39 ----D---- C:\WINDOWS\system32\drivers
2009-12-17 11:03:06 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-12-17 10:55:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2009-12-17 10:37:54 ----D---- C:\Programy
2009-12-17 10:34:42 ----D---- C:\WINDOWS\Prefetch
2009-12-17 08:23:51 ----D---- C:\Program Files\Common Files
2009-12-17 07:59:42 ----HD---- C:\WINDOWS\inf
2009-12-15 21:30:53 ----SD---- C:\Documents and Settings\r\Data aplikací\Microsoft
2009-12-15 01:52:22 ----D---- C:\ZALOHY
2009-12-15 01:31:26 ----D---- C:\WINDOWS\system32\CatRoot
2009-12-15 01:30:59 ----D---- C:\Program Files\Windows Media Player
2009-12-15 01:12:33 ----D---- C:\Program Files\DivX
2009-12-15 00:49:33 ----D---- C:\WINDOWS\WinSxS
2009-12-14 23:05:07 ----A---- C:\WINDOWS\NeroDigital.ini
2009-12-14 23:03:18 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-14 23:01:44 ----D---- C:\WINDOWS\Help
2009-12-14 22:11:33 ----A---- C:\WINDOWS\iun6002.exe
2009-12-14 20:26:01 ----D---- C:\Program Files\Common Files\DivX Shared
2009-12-14 14:27:17 ----D---- C:\WINDOWS\ShellNew
2009-12-14 14:22:10 ----D---- C:\WINDOWS\system32\config
2009-12-14 14:15:57 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2009-12-14 14:15:29 ----D---- C:\WINDOWS\Media
2009-12-14 14:06:31 ----D---- C:\WINDOWS\Debug
2009-12-10 12:32:59 ----D---- C:\Program Files\Internet Explorer
2009-12-06 08:59:25 ----D---- C:\WINDOWS\Microsoft.NET
2009-12-05 16:12:55 ----D---- C:\WINDOWS\system32\spool
2009-12-05 16:00:13 ----D---- C:\Program Files\Outlook Express
2009-12-05 15:59:59 ----D---- C:\Program Files\Microsoft Silverlight
2009-12-05 15:58:51 ----D---- C:\WINDOWS\ie8updates
2009-12-05 14:27:25 ----D---- C:\Program Files\Setup Files
2009-12-05 14:27:06 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-12-05 14:06:22 ----D---- C:\Disc
2009-12-05 13:57:39 ----D---- C:\Program Files\MSI
2009-12-05 13:54:19 ----D---- C:\Documents and Settings\r\Data aplikací\Notepad++
2009-12-05 13:27:07 ----HD---- C:\Program Files\InstallShield Installation Information
2009-12-05 12:59:17 ----D---- C:\WINDOWS\AppPatch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2007-03-19 15424]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2007-04-09 31548]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2007-03-19 512096]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-06-21 626204]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\System32\DRIVERS\AN983.sys [2001-10-25 36224]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-06-01 3925920]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2004-05-17 12928]
R3 PCAlertDriver;PCAlertDriver; \??\C:\Programy\CoreCenter\NTGLM7X.sys []
R3 RushTopDevice;RushTopDevice; \??\C:\Programy\CoreCenter\RushTop.sys []
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 ATITool;ATITool Overclocking Utility; C:\WINDOWS\system32\DRIVERS\ATITool.sys [2005-09-26 24064]
S1 c3c59ab3;c3c59ab3; C:\WINDOWS\System32\drivers\c3c59ab3.sys []
S1 SpyEmrg;SpyEmrg; C:\WINDOWS\System32\Drivers\spyemrg.sys []
S3 AVFSFilter;AVFSFilter; C:\WINDOWS\system32\DRIVERS\avfsfilter.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\r\LOCALS~1\Temp\catchme.sys []
S3 crystalsysinfo;CrystalSysInfo; \??\C:\Programy\MediaCoder\SysInfo.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 FLASHSYS;FLASHSYS; \??\C:\Program Files\MSI\Live Update 4\LU4\FLASHSYS.sys []
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2004-05-17 33280]
S3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2007-03-19 552064]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-12-24 1181328]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-06-01 155715]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[uniross]

trochu to trvalo omlouvam se ale nemohl jsem vypnout nod (opet zustal bezet jako proces nikoli jako aplikace) ....
tady to je



ComboFix 10-01-02.05 - r 03.01.2010 14:45:30.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.723 [GMT 1:00]
Spuštěný z: c:\documents and settings\r\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ctfmon_tk.exe
c:\windows\unins000.dat
c:\windows\unins000.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((( Soubory vytvořené od 2009-12-03 do 2010-01-03 )))))))))))))))))))))))))))))))
.

2010-01-03 13:19 . 2010-01-03 13:19 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-03 12:30 . 2010-01-03 13:19 -------- d-----w- c:\program files\trend micro
2010-01-03 12:30 . 2010-01-03 12:30 -------- d-----w- C:\rsit
2009-12-17 09:35 . 2008-04-14 03:21 23040 ----a-w- c:\windows\system32\AAP.DLL
2009-12-17 09:34 . 2009-03-21 14:09 988160 ----a-w- c:\windows\system32\AAK.dll
2009-12-17 09:34 . 2009-02-09 10:56 684032 ----a-w- c:\windows\system32\AAD.DLL
2009-12-16 11:26 . 2009-12-16 11:26 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-12-14 23:42 . 2009-12-14 23:42 225280 ----a-w- c:\windows\system32\xwr16380.dll
2009-12-14 22:01 . 2009-12-14 22:01 -------- d-----w- c:\program files\Windows Media Connect 2
2009-12-14 22:00 . 2009-12-14 22:00 -------- d-----w- c:\windows\system32\LogFiles
2009-12-14 21:38 . 2009-12-14 21:38 -------- d-----w- c:\program files\Common Files\Apple
2009-12-14 21:38 . 2009-12-14 21:38 -------- d-----w- c:\program files\Apple Software Update
2009-12-14 13:22 . 2008-11-10 10:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2009-12-14 13:22 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2009-12-14 13:18 . 2009-12-23 08:47 -------- d-----w- c:\program files\Microsoft Works
2009-12-05 15:13 . 2009-12-05 15:13 -------- d-----w- c:\program files\Reference Assemblies
2009-12-05 15:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-05 15:12 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-05 15:12 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-12-05 15:12 . 2009-12-05 15:12 -------- d-----w- c:\program files\0bf907516ca8ab236048bd9e
2009-12-05 15:12 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-05 15:12 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-12-05 15:12 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-05 15:12 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-12-05 15:12 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-05 15:12 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-05 15:09 . 2009-12-05 15:09 -------- d-----w- c:\program files\db28559eae194151c979d857
2009-12-05 12:57 . 2009-10-29 07:43 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-05 12:57 . 2009-10-29 07:43 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-05 12:46 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-12-05 12:46 . 2009-07-10 13:28 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-12-05 12:39 . 2009-12-10 11:32 -------- d--h--w- c:\windows\$hf_mig$
2009-12-05 11:39 . 2009-12-05 11:39 -------- d-----w- c:\windows\Performance

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-17 10:03 . 2008-05-16 09:58 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-12-15 00:12 . 2009-08-05 16:52 -------- d-----w- c:\program files\DivX
2009-12-14 22:03 . 2001-10-25 12:00 88938 ----a-w- c:\windows\system32\perfc005.dat
2009-12-14 22:03 . 2001-10-25 12:00 507940 ----a-w- c:\windows\system32\perfh005.dat
2009-12-14 21:11 . 2006-11-30 14:29 737280 ----a-w- c:\windows\iun6002.exe
2009-12-14 19:26 . 2009-08-05 16:52 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-14 13:17 . 2009-12-05 15:13 -------- d-----w- c:\program files\MSBuild
2009-12-14 13:15 . 2009-12-14 13:15 -------- d-----w- c:\program files\Microsoft.NET
2009-12-14 13:13 . 2009-12-14 13:13 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-05 14:59 . 2009-05-24 12:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-05 13:27 . 2006-12-03 14:31 -------- d-----w- c:\program files\Setup Files
2009-12-05 12:57 . 2006-11-30 15:00 -------- d-----w- c:\program files\MSI
2009-12-05 12:27 . 2006-11-30 14:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-26 18:52 . 2009-11-26 18:52 -------- d-----w- c:\program files\MSECache
2009-11-03 07:55 . 2009-11-03 07:55 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 07:43 . 2004-08-23 17:14 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-17 22:49 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-17 22:49 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:34 . 2001-10-25 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 2001-10-25 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 2001-10-25 12:00 150016 ----a-w- c:\windows\system32\rastls.dll
2009-10-11 03:17 . 2008-12-11 06:50 411368 ----a-w- c:\windows\system32\deploytk.dll
2008-03-09 05:25 . 2008-12-11 10:19 236 ---ha-w- c:\program files\Common Files\dx.reg
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-03-19 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CoreCenter.lnk - c:\programy\CoreCenter\CoreCenter.exe [2006-11-30 823296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bootvis.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Hry\\Warcraft III\\war3.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Programy\\QIP\\qip.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\ZALOHY\\utorrent.exe"=
"c:\\Programy\\Office 2000\\Office12\\OUTLOOK.EXE"=
"c:\\Programy\\Office 2000\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"51859:TCP"= 51859:TCP:uTorrent 51859 TCP
"51859:UDP"= 51859:UDP:uTorrent 51859 UDP

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [30.11.2006 15:30 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [30.11.2006 15:30 5248]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27.10.2009 8:48 64288]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [19.3.2007 16:18 15424]
S1 c3c59ab3;c3c59ab3;c:\windows\system32\drivers\c3c59ab3.sys --> c:\windows\system32\drivers\c3c59ab3.sys [?]
S1 SpyEmrg;SpyEmrg;c:\windows\system32\Drivers\spyemrg.sys --> c:\windows\system32\Drivers\spyemrg.sys [?]
S3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys --> c:\windows\system32\DRIVERS\avfsfilter.sys [?]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [5.12.2009 14:28 9216]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24.9.2009 12:17 1181328]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - RUSHTOPDEVICE
*Deregistered* - RushTopDevice
.
Obsah adresáře 'Naplánované úlohy'

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:01]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:01]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:01]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:01]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:01]
.
.
------- Doplňkový sken -------
.
uStart Page = About:Blank
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Excel - c:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
IE: Otevřít obrázek v aplikaci &Microsoft PhotoDraw - c:\progra~1\MICROS~2\Office\1029\phdintl.dll/phdContext.htm
FF - ProfilePath - c:\documents and settings\r\Data aplikací\Mozilla\Firefox\Profiles\a94coikj.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programy\Adobe\Reader\browser\nppdf32.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Spybot - Search & Destroy_is1 - c:\windows\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 14:50
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86466488]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7640f28
\Driver\ACPI -> ACPI.sys @ 0xf748dcb8
\Driver\atapi -> 0x86466488
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: ADMtek AN983 based ethernet adapter -> SendCompleteHandler -> NDIS.sys @ 0xf7315b0a
PacketIndicateHandler -> NDIS.sys @ 0xf7320a21
SendHandler -> NDIS.sys @ 0xf7315949
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3864)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Eset\nod32krn.exe
c:\windows\System32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-01-03 14:52:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-03 13:52

Před spuštěním: Volných bajtů: 69 515 964 416
Po spuštění: Volných bajtů: 69 484 158 976

- - End Of File - - E3F215E45617B17C02744335BAFEFAB4

[BoRy]

Mel sem podobny problem, ve spravce uloh/procesy sem mel jako spusteny proces iexplorer.exe a to dokonce nekolikrat. Po patrani na netu mi byl doporucen ComboFix, ktery problem vyresil. Ale postup nemusi byt vzdy stejny.
Toto je citace od anonima z jineho fora - "iexplore.exe" nie je to isté, ako "explorer.exe" Mal som podobný problém, dostala sa mi aplikácia iexplore.exe, pravdepodobne z net-u, cca. týždeň bežala na pozadí a driemala, až kým sa nepokúsila otvárať niečo, čo nemala, potom ho NOD32 identifikoval, ako "Trójskeho koňa" a vymazal ho. Odvtedy nie je problém. Rada znie: Aktualizovať Windows, zapnutý Firewall, nainštalovaný a aktualizovaný antivír, naištalovaný a aktualizovaný nejaký antispysoft napr.AD-AWARE,SPY BOOT... a samozrejme na net pristupovať z konta s obmedzenými právomocami, nie s "ADMINISTRÁTORSKÝMI".

[uniross]

tak ono to vypada, ze je to ted s ie poresene,
kdyz vypnu noda tak tam prozmenu zustane on ... jinak mi samozrejme slo i o celou ocistu - nekdy se sekne pc cele a je potreba restart na tvrdo .. nekdy polevi a jede po chvilce normalne, atd ..

[Rudy]

Ještě bych prosil kontrolu MBR: http://www2.gmer.net/mbr/mbr.exe . Po akci dejte log. V logu CF již nic nebezpečného nevidím.

[uniross]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

[Rudy]

MBR je v pořádku.

[uniross]

dobra uvidime vyzkousime
zatim dekuji ..

[Rudy]

Nemáte zač!