Fb vir-Klasika

[Ramoss]

Zdravíčko,v tuhle dobu klasicky problem s virem na fb,takze myslim ze neni treba nic vic dodavat,predem dekuji za pomoc )
LOG:


Logfile of random's system information tool 1.09 (written by random/random)
Run by Vlastník at 2011-07-26 00:57:40
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (14%) free of 19 GB
Total RAM: 247 MB (14% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:06:47, on 26.7.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\S3apphk.exe
C:\WINDOWS\update.tray-14-0\svchost.exe
C:\WINDOWS\l1rezerv.exe
C:\WINDOWS\systemup.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\update.2\svchost.exe
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\update.1\svchost.exe
C:\WINDOWS\update.2\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\ufa\ufa.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vlastník\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Vlastník.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/#utm_source=icq&u ... um=generic
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: BS Player - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BabylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [wxpdrv] C:\WINDOWS\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\WINDOWS\update.tray-14-0\svchost.exe
O4 - HKLM\..\Run: [7530093.exe] "C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\7530093.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\WINDOWS\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\WINDOWS\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [1681024.exe] "C:\WINDOWS\TEMP\1681024.exe"
O4 - HKLM\..\Run: [7940138.exe] "C:\WINDOWS\TEMP\7940138.exe"
O4 - HKLM\..\Run: [73107504-loader2.exe] "C:\WINDOWS\TEMP\73107504-loader2.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\WINDOWS\l1rezerv.exe"
O4 - HKLM\..\Run: [systemup] "C:\WINDOWS\systemup.exe" stand
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.5\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CCS\Services\Tcpip\..\{A4EBAF2B-7DF6-437D-A86C-680BA55904C1}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS1\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS2\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: srvbtcclient - Unknown owner - C:\WINDOWS\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\WINDOWS\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\WINDOWS\sysdriver32.exe
O23 - Service: wxpdrivers - Unknown owner - C:\WINDOWS\update.1\svchost.exe

--
End of file - 8172 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003UA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Vlastník\Data aplikací\Mozilla\Firefox\Profiles\jpbeibhf.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
CescrtHlpr Object - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [2010-11-07 225720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-11-21 1054520]
{98889811-442D-49dd-99D7-DC866BE87DBC} - Babylon Toolbar - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [2010-11-07 184760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"S3apphk"=C:\WINDOWS\system32\S3apphk.exe [2001-12-04 28672]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"BabylonToolbar"=C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe [2010-11-07 286720]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey []
"wxpdrv"=C:\WINDOWS\services32.exe []
"tray_ico"= []
"tray_ico0"=C:\WINDOWS\update.tray-14-0\svchost.exe [2011-07-25 1185280]
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"7530093.exe"=C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\7530093.exe [2011-07-25 256000]
"sysdriver32.exe"=C:\WINDOWS\sysdriver32.exe [2011-07-25 256000]
"sysdriver32_.exe"=C:\WINDOWS\sysdriver32_.exe [2011-07-25 256000]
"1681024.exe"=C:\WINDOWS\TEMP\1681024.exe [2011-07-25 256000]
"7940138.exe"=C:\WINDOWS\TEMP\7940138.exe [2011-07-25 495616]
"73107504-loader2.exe"=C:\WINDOWS\TEMP\73107504-loader2.exe [2011-07-25 256000]
"l1rezerv.exe"=C:\WINDOWS\l1rezerv.exe [2011-07-25 232960]
"systemup"=C:\WINDOWS\systemup.exe [2011-07-25 114176]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2007-10-29 15360]
"Google Update"=C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-03-12 135664]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ICQ"=C:\Program Files\ICQ7.5\ICQ.exe [2011-06-29 124216]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe"="C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe:*:Enabled:Ultima Online's premier mapping tool."
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Diablo II\D2Loader-1.11b.exe"="C:\Program Files\Diablo II\D2Loader-1.11b.exe:*:Enabled:Diablo II"
"C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe"="C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe:*:Enabled:C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\update.tray-14-0\svchost.exe"="C:\WINDOWS\update.tray-14-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-14-0\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2011-07-26 00:57:43 ----D---- C:\Program Files\trend micro
2011-07-26 00:57:40 ----D---- C:\rsit
2011-07-26 00:07:14 ----A---- C:\WINDOWS\nsreg.dat
2011-07-26 00:02:12 ----D---- C:\Program Files\Mozilla Firefox
2011-07-25 23:02:59 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-25 21:46:52 ----D---- C:\Program Files\ICQ7.5
2011-07-25 17:23:35 ----D---- C:\WINDOWS\ufa
2011-07-25 17:23:35 ----D---- C:\WINDOWS\rpcminer
2011-07-25 17:23:35 ----D---- C:\WINDOWS\phoenix
2011-07-25 17:21:09 ----ASH---- C:\hiberfil.sys
2011-07-25 17:08:30 ----A---- C:\WINDOWS\ddh_iplist.txt
2011-07-25 17:08:08 ----A---- C:\WINDOWS\systemup.exe
2011-07-25 17:06:56 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-07-25 17:06:54 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-07-25 17:06:29 ----HD---- C:\WINDOWS\update.5.0
2011-07-25 17:06:03 ----A---- C:\WINDOWS\l1rezerv.exe
2011-07-25 17:05:07 ----A---- C:\WINDOWS\unrar.exe
2011-07-25 17:04:59 ----HD---- C:\WINDOWS\update.2
2011-07-25 17:03:13 ----A---- C:\WINDOWS\iplist.txt
2011-07-25 17:02:13 ----A---- C:\WINDOWS\sysdriver32_.exe
2011-07-25 17:01:59 ----A---- C:\WINDOWS\sysdriver32.exe
2011-07-25 17:01:43 ----A---- C:\WINDOWS\front_ip_list.txt
2011-07-25 16:58:56 ----D---- C:\WINDOWS\av_ico
2011-07-25 16:57:20 ----HD---- C:\WINDOWS\update.1
2011-07-25 16:56:57 ----HD---- C:\WINDOWS\update.tray-14-0
2011-07-25 16:56:56 ----HD---- C:\WINDOWS\update.tray-14-0-lnk
2011-07-25 16:42:28 ----A---- C:\WINDOWS\winlog-ids.txt
2011-07-25 16:42:28 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-07-16 11:51:18 ----A---- C:\WINDOWS\system32\muweb.dll
2011-07-16 11:51:12 ----A---- C:\WINDOWS\system32\mucltui.dll
2011-07-15 12:54:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2011-07-15 12:49:36 ----D---- C:\Program Files\Microsoft Security Client
2011-07-15 12:43:40 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2011-07-09 22:35:35 ----A---- C:\WINDOWS\DIIUnin.dat
2011-07-09 22:35:26 ----A---- C:\WINDOWS\DIIUnin.pif
2011-07-09 22:35:25 ----A---- C:\WINDOWS\DIIUnin.exe
2011-07-09 22:26:18 ----D---- C:\Program Files\Diablo II
2011-07-09 20:57:28 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntf32.dll
2011-07-08 23:27:27 ----AT---- C:\WINDOWS\system32\SIntf16.dll
2011-07-08 22:48:17 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-07-08 22:47:50 ----D---- C:\Program Files\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-07-08 21:25:08 ----D---- C:\Program Files\uTorrent
2011-07-08 21:24:31 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\uTorrent
2011-07-04 19:39:30 ----D---- C:\Program Files\LogMeIn Hamachi
2011-07-01 18:14:26 ----D---- C:\Program Files\Firefly Studios
2011-06-30 21:02:36 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\BabylonToolbar
2011-06-30 10:09:05 ----D---- C:\Program Files\BabylonToolbar

======List of files/folders modified in the last 1 month======

2011-07-26 00:57:56 ----D---- C:\WINDOWS\Prefetch
2011-07-26 00:57:43 ----RD---- C:\Program Files
2011-07-26 00:53:35 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Skype
2011-07-26 00:07:22 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Mozilla
2011-07-26 00:07:14 ----D---- C:\WINDOWS
2011-07-26 00:02:41 ----D---- C:\WINDOWS\Temp
2011-07-25 23:29:57 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\ICQ
2011-07-25 23:29:06 ----D---- C:\Program Files\ICQ6Toolbar
2011-07-25 23:28:23 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-25 23:03:03 ----D---- C:\WINDOWS\Debug
2011-07-25 23:02:59 ----D---- C:\WINDOWS\system32
2011-07-25 23:02:47 ----SHD---- C:\WINDOWS\Installer
2011-07-25 22:59:51 ----A---- C:\WINDOWS\win.ini
2011-07-25 22:59:11 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-07-25 22:35:23 ----D---- C:\Program Files\yBook
2011-07-25 21:56:55 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-25 21:56:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2011-07-25 17:19:04 ----A---- C:\boot.ini
2011-07-25 17:09:06 ----SHD---- C:\System Volume Information
2011-07-25 17:09:06 ----D---- C:\WINDOWS\system32\Restore
2011-07-25 17:05:27 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-25 16:54:06 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-25 15:33:57 ----SD---- C:\WINDOWS\Tasks
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot_bak
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot
2011-07-16 12:50:15 ----HD---- C:\WINDOWS\inf
2011-07-15 13:28:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-07-15 12:50:03 ----D---- C:\WINDOWS\system32\drivers
2011-07-15 12:49:59 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-07-15 12:49:41 ----D---- C:\WINDOWS\WinSxS
2011-07-15 12:43:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-15 12:43:15 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-01 22:28:02 ----RD---- C:\Program Files\Skype
2011-07-01 22:27:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-01 22:25:47 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-07-08 218688]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2007-10-29 46336]
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8029.SYS [2001-08-17 19017]
R3 rtl8139;Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2001-08-23 25434]
R3 trid3d;trid3d; C:\WINDOWS\system32\DRIVERS\trid3dm.sys [2001-12-27 149244]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-10-29 20480]
R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2001-11-26 41152]
S1 MpKsl1047e796;MpKsl1047e796; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{BED49947-F43F-4669-9CA3-D138EC92F9CC}\MpKsl1047e796.sys []
S1 MpKsl27c8c293;MpKsl27c8c293; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{EFD25207-59C5-4907-834F-38FF6372FAB4}\MpKsl27c8c293.sys []
S1 MpKsl9ac0efd8;MpKsl9ac0efd8; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{B5347CE3-93D9-471C-8FE1-88755C64AE43}\MpKsl9ac0efd8.sys []
S1 MpKslf2aa1dc5;MpKslf2aa1dc5; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{61E73366-3BE8-4CBE-A3BC-DE66474CA18B}\MpKslf2aa1dc5.sys []
S1 MpKslf634c4fa;MpKslf634c4fa; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{65462644-8149-42BB-81D3-4D701723F5EF}\MpKslf634c4fa.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-10-29 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 srvbtcclient;srvbtcclient; C:\WINDOWS\update.5.0\svchost.exe [2011-07-25 340992]
R2 srviecheck;srviecheck; C:\WINDOWS\update.2\svchost.exe [2011-07-25 495616]
R2 srvsysdriver32;srvsysdriver32; C:\WINDOWS\sysdriver32.exe [2011-07-25 256000]
R2 wxpdrivers;wxpdrivers; C:\WINDOWS\update.1\svchost.exe [2011-07-25 1185280]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[cernohous13]

Vítám tě u nás

Stáhni a nainstaluj MBAM zde http://www.download.com/Malwarebytes-An ... tag=button
Spustit > na 3.záložce "Aktualizace" > Kontrola aktualizací
následně na 1.záložce "Kontrolor" -> Úplná kontrola -> Prohledat
po dokončení scanu vyskočí okno Notepad s výsledkem - obsah zkopíruj do své odpovědi
zatím nic nemazat - počkej na posouzení a program nech spuštěný

[Ramoss]

ZDE je obsah protokolu:

Malwarebytes' Anti-Malware
http://www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

26.7.2011 20:13:10
mbam-log-2011-07-26 (20-12-46).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 198073
Uplynulý čas: 1 hodin, 13 minut, 5 sekund

Infikované procesy v paměti: 9
Infikované moduly v paměti: 0
Infikované klíče v registru: 7
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 23

Infikované procesy v paměti:
c:\WINDOWS\update.tray-14-0\svchost.exe (Trojan.Dropper) -> 220 -> No action taken.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> 384 -> No action taken.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 588 -> No action taken.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> 372 -> No action taken.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> 1076 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 344 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 2276 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 1776 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 592 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Delf) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemup (Trojan.Agent) -> Value: systemup -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l1rezerv.exe (Trojan.Agent) -> Value: l1rezerv.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Delf) -> Value: sysdriver32.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Delf) -> Value: sysdriver32_.exe -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\update.tray-14-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\Vlastník\dokumenty\downloads\pic0484583024920502.jpg.scr (Trojan.Buzus) -> No action taken.
c:\documents and settings\Vlastník\local settings\data aplikací\Google\Chrome\user data\Default\Cache\f_0001f2 (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020676.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020677.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020692.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020693.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\Temp\3910053.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\4271742.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\5448881.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\6578619.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\682332.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\8950049.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\9624398.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\update.tray-14-0-lnk\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\Temp\886133721.exe (Trojan.FakeAlert.Gen) -> No action taken.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> No action taken.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.

[cernohous13]

po ukončení scanu -> Zobrazit výsledky -> zkontrolovat zda je vše označeno -> Odstranit označené
vyběhne log, ve kterém budou záznamy tohoto typu:
Infikované adresáře:
C:\Program Files\xxxxxx -> Quarantined and deleted successfully.
ten bych taky rád viděl

Pokračuj ComboFixem

Stáhni si ComboFix
a ulož ho na plochu.
návod na použití: http://www.bleepingcomputer.com/combofi ... t-combofix
Ukonči všechna aktivní okna,vypni Antispy a Antivir a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna a nic nespouštěj
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Kdyby ti po použití ComboFixu systém nenaběhl - při restartu F8 a poslední známá funkční konfigurace

[Ramoss]

LOG MBAM

Malwarebytes' Anti-Malware
http://www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

27.7.2011 15:41:14
mbam-log-2011-07-27 (15-41-14).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 197719
Uplynulý čas: 3 hodin, 3 minut, 1 sekund

Infikované procesy v paměti: 11
Infikované moduly v paměti: 0
Infikované klíče v registru: 7
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 23

Infikované procesy v paměti:
c:\WINDOWS\update.tray-14-0\svchost.exe (Trojan.Dropper) -> 252 -> Unloaded process successfully.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> 384 -> Unloaded process successfully.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 436 -> Unloaded process successfully.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> 376 -> Unloaded process successfully.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> 284 -> Unloaded process successfully.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> 1348 -> Unloaded process successfully.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> 340 -> Unloaded process successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 3612 -> Unloaded process successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 1040 -> Unloaded process successfully.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 756 -> Unloaded process successfully.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 1428 -> Unloaded process successfully.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Delf) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemup (Trojan.Agent) -> Value: systemup -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l1rezerv.exe (Trojan.Agent) -> Value: l1rezerv.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Delf) -> Value: sysdriver32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Delf) -> Value: sysdriver32_.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\update.tray-14-0\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Vlastník\dokumenty\downloads\pic0484583024920502.jpg.scr (Trojan.Buzus) -> Quarantined and deleted successfully.
c:\documents and settings\Vlastník\local settings\data aplikací\Google\Chrome\user data\Default\Cache\f_0001f2 (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020676.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020677.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020692.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{756de51a-60f9-4cee-8c4e-5cca5a49aebc}\RP79\A0020693.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\3910053.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\4271742.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\5448881.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\6578619.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\682332.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\8950049.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\9624398.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\update.tray-14-0-lnk\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\886133721.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> Quarantined and deleted successfully.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> Quarantined and deleted successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Mimochodem ke Combofixu:
V programu jsem postupoval podle návodu a pokaždé když došlo k obrazovce ''Vyhledávám nakažené soubory'' tak se mi vzdycky obrazovka ''freezla'' i s myší,čekal jsem asi hodinu a nic se nedelo,restartoval jsem tedy pc a zkusil znova,stalo se to znova,tak nevím v čem je problém

[cernohous13]

Restartuj do nouzového režimu s prací v síti.

Stáhni Rkill z jednoho z odkazů, pokud by ho vir blokoval, zkus stáhnout jiný

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr

Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

-spusť a nechej ho pracovat. Sám se ukončí.

- Teď nesmíš restartovat počítač!

Spusť ComboFix podle předchozího návodu

[Ramoss]

Mohl bych mít ještě jednu rychlou otázečku? jak mám restartovat pc do nouzoveho rezimu s praci v siti??? Pri restartu na cerne obrazovce tam nic takoveho nebylo..

[cernohous13]

Po restartu klikej na F8 (když vyskočí nabídka pro výběr bootovacího média, dej HDD -> Enter a hned zase F8) dostaneš se na výběr režimu

[Ramoss]

Tak jsem postupoval dle návodu,spustil v nouzovem rezimu s praci v siti Rkill a vytvorilo mi to log (muzu pridat) pak jsem spustil Combofix a stalo se mi totez,byla tam opet obrazovka ''Vyhledávám nakažené soubory'' opet jsem cekal hodinu a nic se nedelo,tzn vubec se nezacaly nacitat ty ''fáze'',ale obrazovka se tentokrát nesekla..nevim proc mi to ty faze nechce zacit nacitat..

[cernohous13]

Necháme ComboFix odpočinout - dej mi aktuální RSIT

[Ramoss]

ZDE:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Vlastník at 2011-07-28 18:10:52
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (13%) free of 19 GB
Total RAM: 247 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:11:08, on 28.7.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\S3apphk.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ICQ7.5\ICQ.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Vlastník\Plocha\RSIT.exe
C:\Program Files\trend micro\Vlastník.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/#utm_source=icq&u ... um=generic
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: BS Player - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BabylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [wxpdrv] C:\WINDOWS\services32.exe
O4 - HKLM\..\Run: [7530093.exe] "C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\7530093.exe"
O4 - HKLM\..\Run: [1681024.exe] "C:\WINDOWS\TEMP\1681024.exe"
O4 - HKLM\..\Run: [73107504-loader2.exe] "C:\WINDOWS\TEMP\73107504-loader2.exe"
O4 - HKLM\..\Run: [2256403.exe] "C:\WINDOWS\TEMP\2256403.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\WINDOWS\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\WINDOWS\sysdriver32_.exe" rezerv
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.5\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CCS\Services\Tcpip\..\{A4EBAF2B-7DF6-437D-A86C-680BA55904C1}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS1\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS2\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\pev.cfxxe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6702 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003UA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Vlastník\Data aplikací\Mozilla\Firefox\Profiles\jpbeibhf.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
CescrtHlpr Object - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [2010-11-07 225720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-11-21 1054520]
{98889811-442D-49dd-99D7-DC866BE87DBC} - Babylon Toolbar - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [2010-11-07 184760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"S3apphk"=C:\WINDOWS\system32\S3apphk.exe [2001-12-04 28672]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"BabylonToolbar"=C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe [2010-11-07 286720]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey []
"wxpdrv"=C:\WINDOWS\services32.exe []
"tray_ico"= []
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"7530093.exe"=C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\7530093.exe [2011-07-25 256000]
"1681024.exe"=C:\WINDOWS\TEMP\1681024.exe [2011-07-25 256000]
"73107504-loader2.exe"=C:\WINDOWS\TEMP\73107504-loader2.exe [2011-07-25 256000]
"2256403.exe"=C:\WINDOWS\TEMP\2256403.exe [2011-07-27 502272]
"sysdriver32.exe"=C:\WINDOWS\sysdriver32.exe rezerv []
"sysdriver32_.exe"=C:\WINDOWS\sysdriver32_.exe rezerv []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2007-10-29 15360]
"Google Update"=C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-03-12 135664]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ICQ"=C:\Program Files\ICQ7.5\ICQ.exe [2011-06-29 124216]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe"="C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe:*:Enabled:Ultima Online's premier mapping tool."
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Diablo II\D2Loader-1.11b.exe"="C:\Program Files\Diablo II\D2Loader-1.11b.exe:*:Enabled:Diablo II"
"C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe"="C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe:*:Enabled:C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\update.tray-14-0\svchost.exe"="C:\WINDOWS\update.tray-14-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-14-0\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2011-07-28 13:22:51 ----ASH---- C:\hiberfil.sys
2011-07-28 10:36:17 ----SD---- C:\ComboFix
2011-07-28 10:30:21 ----SHD---- C:\WINDOWS\CSC
2011-07-28 10:30:12 ----A---- C:\WINDOWS\ntbtlog.txt
2011-07-27 22:34:50 ----ASH---- C:\pagefile.sys
2011-07-27 19:22:22 ----A---- C:\Boot.bak
2011-07-27 19:22:15 ----RASHD---- C:\cmdcons
2011-07-27 19:19:36 ----A---- C:\WINDOWS\zip.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWSC.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWREG.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\sed.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\PEV.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\NIRCMD.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\MBR.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\grep.exe
2011-07-27 19:19:24 ----D---- C:\WINDOWS\ERDNT
2011-07-27 19:19:13 ----D---- C:\Qoobox
2011-07-26 12:19:40 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Malwarebytes
2011-07-26 12:19:04 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-07-26 12:19:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2011-07-26 12:18:54 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-07-26 12:18:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-07-26 00:57:43 ----D---- C:\Program Files\trend micro
2011-07-26 00:57:40 ----D---- C:\rsit
2011-07-26 00:07:14 ----A---- C:\WINDOWS\nsreg.dat
2011-07-26 00:02:12 ----D---- C:\Program Files\Mozilla Firefox
2011-07-25 23:02:59 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-25 21:46:52 ----D---- C:\Program Files\ICQ7.5
2011-07-25 17:23:35 ----D---- C:\WINDOWS\ufa
2011-07-25 17:23:35 ----D---- C:\WINDOWS\rpcminer
2011-07-25 17:23:35 ----D---- C:\WINDOWS\phoenix
2011-07-25 17:08:30 ----A---- C:\WINDOWS\ddh_iplist.txt
2011-07-25 17:06:56 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-07-25 17:06:54 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-07-25 17:06:29 ----HD---- C:\WINDOWS\update.5.0
2011-07-25 17:05:07 ----A---- C:\WINDOWS\unrar.exe
2011-07-25 17:04:59 ----HD---- C:\WINDOWS\update.2
2011-07-25 17:03:13 ----A---- C:\WINDOWS\iplist.txt
2011-07-25 17:01:43 ----A---- C:\WINDOWS\front_ip_list.txt
2011-07-25 16:58:56 ----D---- C:\WINDOWS\av_ico
2011-07-25 16:57:20 ----HD---- C:\WINDOWS\update.1
2011-07-25 16:56:57 ----HD---- C:\WINDOWS\update.tray-14-0
2011-07-25 16:56:56 ----HD---- C:\WINDOWS\update.tray-14-0-lnk
2011-07-25 16:42:28 ----A---- C:\WINDOWS\winlog-ids.txt
2011-07-25 16:42:28 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-07-16 11:51:18 ----A---- C:\WINDOWS\system32\muweb.dll
2011-07-16 11:51:12 ----A---- C:\WINDOWS\system32\mucltui.dll
2011-07-15 12:54:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2011-07-15 12:49:36 ----D---- C:\Program Files\Microsoft Security Client
2011-07-15 12:43:40 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2011-07-09 22:35:35 ----A---- C:\WINDOWS\DIIUnin.dat
2011-07-09 22:35:26 ----A---- C:\WINDOWS\DIIUnin.pif
2011-07-09 22:35:25 ----A---- C:\WINDOWS\DIIUnin.exe
2011-07-09 22:26:18 ----D---- C:\Program Files\Diablo II
2011-07-09 20:57:28 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntf32.dll
2011-07-08 23:27:27 ----AT---- C:\WINDOWS\system32\SIntf16.dll
2011-07-08 22:48:17 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-07-08 22:47:50 ----D---- C:\Program Files\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-07-08 21:25:08 ----D---- C:\Program Files\uTorrent
2011-07-08 21:24:31 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\uTorrent
2011-07-04 19:39:30 ----D---- C:\Program Files\LogMeIn Hamachi
2011-07-01 18:14:26 ----D---- C:\Program Files\Firefly Studios
2011-06-30 21:02:36 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\BabylonToolbar
2011-06-30 10:09:05 ----D---- C:\Program Files\BabylonToolbar

======List of files/folders modified in the last 1 month======

2011-07-28 18:10:57 ----D---- C:\WINDOWS\Prefetch
2011-07-28 14:42:33 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-28 10:38:00 ----D---- C:\WINDOWS\system32\drivers
2011-07-28 10:37:52 ----D---- C:\WINDOWS\system32
2011-07-28 10:37:52 ----D---- C:\WINDOWS
2011-07-28 10:37:08 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-27 19:22:23 ----RASH---- C:\boot.ini
2011-07-27 19:13:01 ----D---- C:\WINDOWS\Connection Wizard
2011-07-27 15:41:13 ----D---- C:\WINDOWS\Temp
2011-07-26 12:18:53 ----RD---- C:\Program Files
2011-07-26 10:49:20 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\ICQ
2011-07-26 01:53:46 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Skype
2011-07-26 00:07:22 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Mozilla
2011-07-25 23:29:06 ----D---- C:\Program Files\ICQ6Toolbar
2011-07-25 23:03:03 ----D---- C:\WINDOWS\Debug
2011-07-25 23:02:47 ----SHD---- C:\WINDOWS\Installer
2011-07-25 22:59:51 ----A---- C:\WINDOWS\win.ini
2011-07-25 22:59:11 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-07-25 22:35:23 ----D---- C:\Program Files\yBook
2011-07-25 21:56:55 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-25 21:56:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2011-07-25 17:09:06 ----SHD---- C:\System Volume Information
2011-07-25 17:09:06 ----D---- C:\WINDOWS\system32\Restore
2011-07-25 17:05:27 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-25 15:33:57 ----SD---- C:\WINDOWS\Tasks
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot_bak
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot
2011-07-16 12:50:15 ----HD---- C:\WINDOWS\inf
2011-07-15 13:28:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-07-15 12:49:59 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-07-15 12:49:41 ----D---- C:\WINDOWS\WinSxS
2011-07-15 12:43:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-15 12:43:15 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-01 22:28:02 ----RD---- C:\Program Files\Skype
2011-07-01 22:27:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-01 22:25:47 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-07-08 218688]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2007-10-29 46336]
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8029.SYS [2001-08-17 19017]
R3 rtl8139;Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2001-08-23 25434]
R3 trid3d;trid3d; C:\WINDOWS\system32\DRIVERS\trid3dm.sys [2001-12-27 149244]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-10-29 20480]
R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2001-11-26 41152]
S1 MpKsl1047e796;MpKsl1047e796; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{BED49947-F43F-4669-9CA3-D138EC92F9CC}\MpKsl1047e796.sys []
S1 MpKsl27c8c293;MpKsl27c8c293; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{EFD25207-59C5-4907-834F-38FF6372FAB4}\MpKsl27c8c293.sys []
S1 MpKsl9ac0efd8;MpKsl9ac0efd8; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{B5347CE3-93D9-471C-8FE1-88755C64AE43}\MpKsl9ac0efd8.sys []
S1 MpKslf2aa1dc5;MpKslf2aa1dc5; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{61E73366-3BE8-4CBE-A3BC-DE66474CA18B}\MpKslf2aa1dc5.sys []
S1 MpKslf634c4fa;MpKslf634c4fa; \??\c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{65462644-8149-42BB-81D3-4D701723F5EF}\MpKslf634c4fa.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\catchme.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-10-29 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe []
S2 PEVSystemStart;PEVSystemStart; C:\ComboFix\pev.cfxxe [2011-06-26 256000]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[cernohous13]

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“ (pro Vistu a Win7 – pravým a „Run As Administrator“).
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „Moveit!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\

Script OTM

Kód: Vybrat vše

:Commands
[emptytemp]

:Files
C:\WINDOWS\services32.exe
C:\WINDOWS\TEMP\1681024.exe
C:\WINDOWS\TEMP\73107504-loader2.exe
C:\WINDOWS\TEMP\2256403.exe
C:\WINDOWS\sysdriver32.exe rezerv
C:\WINDOWS\ufa
C:\WINDOWS\rpcminer
C:\WINDOWS\phoenix
C:\WINDOWS\ddh_iplist.txt
C:\WINDOWS\btc_client_iplist.txt
C:\WINDOWS\iecheck_iplist.txt
C:\WINDOWS\update.5.0
C:\WINDOWS\unrar.exe
C:\WINDOWS\update.2
C:\WINDOWS\iplist.txt
C:\WINDOWS\front_ip_list.txt
C:\WINDOWS\av_ico
C:\WINDOWS\update.1
C:\WINDOWS\update.tray-14-0
C:\WINDOWS\update.tray-14-0-lnk
C:\WINDOWS\winlog-ids.txt
C:\WINDOWS\winlog-dirs.txt

:Services
MpKsl1047e796
MpKsl27c8c293
MpKsl9ac0efd8
MpKslf2aa1dc5
MpKslf634c4fa
catchme
PEVSystemStart

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"wxpdrv"=-
"tray_ico"=-
"tray_ico1"=-
"tray_ico2"=-
"tray_ico3"=-
"tray_ico4"=-
"7530093.exe"=-
"1681024.exe"=-
"73107504-loader2.exe"=-
"2256403.exe"=-
"sysdriver32.exe"=-
"sysdriver32_.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe"=-
"C:\WINDOWS\update.1\svchost.exe"=-
"C:\WINDOWS\update.tray-14-0\svchost.exe"=-
"C:\WINDOWS\update.2\svchost.exe"=

[Ramoss]

Zde je log:

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 94984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Vlastník
->Temp folder emptied: 177807084 bytes
->Temporary Internet Files folder emptied: 48994457 bytes
->FireFox cache emptied: 72178569 bytes
->Google Chrome cache emptied: 223077498 bytes
->Flash cache emptied: 5128 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2135952 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32269977 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 65336170 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 593,00 mb

========== FILES ==========
File/Folder C:\WINDOWS\services32.exe not found.
File/Folder C:\WINDOWS\TEMP\1681024.exe not found.
File/Folder C:\WINDOWS\TEMP\73107504-loader2.exe not found.
File/Folder C:\WINDOWS\TEMP\2256403.exe not found.
File/Folder C:\WINDOWS\sysdriver32.exe rezerv not found.
C:\WINDOWS\ufa folder moved successfully.
C:\WINDOWS\rpcminer folder moved successfully.
C:\WINDOWS\phoenix\kernels\poclbm folder moved successfully.
C:\WINDOWS\phoenix\kernels\phatk folder moved successfully.
C:\WINDOWS\phoenix\kernels folder moved successfully.
C:\WINDOWS\phoenix folder moved successfully.
C:\WINDOWS\ddh_iplist.txt moved successfully.
C:\WINDOWS\btc_client_iplist.txt moved successfully.
C:\WINDOWS\iecheck_iplist.txt moved successfully.
C:\WINDOWS\update.5.0 folder moved successfully.
C:\WINDOWS\unrar.exe moved successfully.
C:\WINDOWS\update.2 folder moved successfully.
C:\WINDOWS\iplist.txt moved successfully.
C:\WINDOWS\front_ip_list.txt moved successfully.
C:\WINDOWS\av_ico folder moved successfully.
C:\WINDOWS\update.1 folder moved successfully.
C:\WINDOWS\update.tray-14-0 folder moved successfully.
C:\WINDOWS\update.tray-14-0-lnk folder moved successfully.
C:\WINDOWS\winlog-ids.txt moved successfully.
C:\WINDOWS\winlog-dirs.txt moved successfully.
========== SERVICES/DRIVERS ==========
Service MpKsl1047e796 stopped successfully!
Service MpKsl1047e796 deleted successfully!
Service MpKsl27c8c293 stopped successfully!
Service MpKsl27c8c293 deleted successfully!
Service MpKsl9ac0efd8 stopped successfully!
Service MpKsl9ac0efd8 deleted successfully!
Service MpKslf2aa1dc5 stopped successfully!
Service MpKslf2aa1dc5 deleted successfully!
Service MpKslf634c4fa stopped successfully!
Service MpKslf634c4fa deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
Service PEVSystemStart stopped successfully!
Service PEVSystemStart deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\wxpdrv deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico2 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico3 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico4 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\7530093.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\1681024.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\73107504-loader2.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\2256403.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sysdriver32.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sysdriver32_.exe deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\Vlastník\Dokumenty\Downloads\Flash-Player.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\update.1\svchost.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\update.tray-14-0\svchost.exe deleted successfully.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\"C:\WINDOWS\update.2\svchost.exe"| /E : value set successfully!

OTM by OldTimer - Version 3.1.18.0 log created on 07282011_220832

Files moved on Reboot...

Registry entries deleted on Reboot...

[cernohous13]

Tak dej aktuální RSIT a napiš jaké jsou s PC ještě problémy

[Ramoss]

LOG:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Vlastník at 2011-07-28 23:59:55
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (16%) free of 19 GB
Total RAM: 247 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:00:03, on 29.7.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\S3apphk.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ICQ7.5\ICQ.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Vlastník\Plocha\RSIT.exe
C:\Program Files\trend micro\Vlastník.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/#utm_source=icq&u ... um=generic
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: BS Player - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [BabylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.5\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CCS\Services\Tcpip\..\{A4EBAF2B-7DF6-437D-A86C-680BA55904C1}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS1\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O17 - HKLM\System\CS2\Services\Tcpip\..\{7EE152CB-A48D-4726-B4F0-A01A82655D29}: NameServer = 81.92.155.1,81.92.155.101
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5842 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-261478967-1801674531-1003UA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Vlastník\Data aplikací\Mozilla\Firefox\Profiles\jpbeibhf.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
CescrtHlpr Object - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [2010-11-07 225720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files\BS_Player\prxtbBS_0.dll [2011-01-17 175912]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-11-21 1054520]
{98889811-442D-49dd-99D7-DC866BE87DBC} - Babylon Toolbar - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [2010-11-07 184760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"S3apphk"=C:\WINDOWS\system32\S3apphk.exe [2001-12-04 28672]
"BabylonToolbar"=C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe [2010-11-07 286720]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2007-10-29 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ICQ"=C:\Program Files\ICQ7.5\ICQ.exe [2011-06-29 124216]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe"="C:\Documents and Settings\Vlastník\Plocha\UO\uoam.exe:*:Enabled:Ultima Online's premier mapping tool."
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Diablo II\D2Loader-1.11b.exe"="C:\Program Files\Diablo II\D2Loader-1.11b.exe:*:Enabled:Diablo II"
"C:\WINDOWS\update.2\svchost.exe"=""
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2011-07-28 22:08:32 ----D---- C:\_OTM
2011-07-28 13:22:51 ----ASH---- C:\hiberfil.sys
2011-07-28 10:36:17 ----SD---- C:\ComboFix
2011-07-28 10:30:21 ----SHD---- C:\WINDOWS\CSC
2011-07-28 10:30:12 ----A---- C:\WINDOWS\ntbtlog.txt
2011-07-27 22:34:50 ----ASH---- C:\pagefile.sys
2011-07-27 19:22:22 ----A---- C:\Boot.bak
2011-07-27 19:22:15 ----RASHD---- C:\cmdcons
2011-07-27 19:19:36 ----A---- C:\WINDOWS\zip.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWSC.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\SWREG.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\sed.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\PEV.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\NIRCMD.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\MBR.exe
2011-07-27 19:19:36 ----A---- C:\WINDOWS\grep.exe
2011-07-27 19:19:24 ----D---- C:\WINDOWS\ERDNT
2011-07-27 19:19:13 ----D---- C:\Qoobox
2011-07-26 12:19:40 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Malwarebytes
2011-07-26 12:19:04 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-07-26 12:19:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2011-07-26 12:18:54 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-07-26 12:18:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-07-26 00:57:43 ----D---- C:\Program Files\trend micro
2011-07-26 00:57:40 ----D---- C:\rsit
2011-07-26 00:07:14 ----A---- C:\WINDOWS\nsreg.dat
2011-07-26 00:02:12 ----D---- C:\Program Files\Mozilla Firefox
2011-07-25 23:02:59 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-25 21:46:52 ----D---- C:\Program Files\ICQ7.5
2011-07-16 11:51:18 ----A---- C:\WINDOWS\system32\muweb.dll
2011-07-16 11:51:12 ----A---- C:\WINDOWS\system32\mucltui.dll
2011-07-15 12:54:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2011-07-15 12:49:36 ----D---- C:\Program Files\Microsoft Security Client
2011-07-15 12:43:40 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2011-07-09 22:35:35 ----A---- C:\WINDOWS\DIIUnin.dat
2011-07-09 22:35:26 ----A---- C:\WINDOWS\DIIUnin.pif
2011-07-09 22:35:25 ----A---- C:\WINDOWS\DIIUnin.exe
2011-07-09 22:26:18 ----D---- C:\Program Files\Diablo II
2011-07-09 20:57:28 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
2011-07-08 23:27:28 ----AT---- C:\WINDOWS\system32\SIntf32.dll
2011-07-08 23:27:27 ----AT---- C:\WINDOWS\system32\SIntf16.dll
2011-07-08 22:48:17 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-07-08 22:47:50 ----D---- C:\Program Files\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\DAEMON Tools Lite
2011-07-08 22:47:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-07-08 21:25:08 ----D---- C:\Program Files\uTorrent
2011-07-08 21:24:31 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\uTorrent
2011-07-04 19:39:30 ----D---- C:\Program Files\LogMeIn Hamachi
2011-07-01 18:14:26 ----D---- C:\Program Files\Firefly Studios
2011-06-30 21:02:36 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\BabylonToolbar
2011-06-30 10:09:05 ----D---- C:\Program Files\BabylonToolbar

======List of files/folders modified in the last 1 month======

2011-07-28 22:32:02 ----D---- C:\WINDOWS\Prefetch
2011-07-28 22:14:48 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-28 22:09:31 ----D---- C:\WINDOWS
2011-07-28 22:09:30 ----D---- C:\WINDOWS\Temp
2011-07-28 22:09:29 ----D---- C:\WINDOWS\system32
2011-07-28 10:38:00 ----D---- C:\WINDOWS\system32\drivers
2011-07-28 10:37:08 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-27 19:22:23 ----RASH---- C:\boot.ini
2011-07-27 19:13:01 ----D---- C:\WINDOWS\Connection Wizard
2011-07-26 12:18:53 ----RD---- C:\Program Files
2011-07-26 10:49:20 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\ICQ
2011-07-26 01:53:46 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Skype
2011-07-26 00:07:22 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\Mozilla
2011-07-25 23:29:06 ----D---- C:\Program Files\ICQ6Toolbar
2011-07-25 23:03:03 ----D---- C:\WINDOWS\Debug
2011-07-25 23:02:47 ----SHD---- C:\WINDOWS\Installer
2011-07-25 22:59:51 ----A---- C:\WINDOWS\win.ini
2011-07-25 22:59:11 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-07-25 22:35:23 ----D---- C:\Program Files\yBook
2011-07-25 21:56:55 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-25 21:56:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2011-07-25 17:09:06 ----SHD---- C:\System Volume Information
2011-07-25 17:09:06 ----D---- C:\WINDOWS\system32\Restore
2011-07-25 17:05:27 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-25 15:33:57 ----SD---- C:\WINDOWS\Tasks
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot_bak
2011-07-16 12:50:31 ----D---- C:\WINDOWS\system32\CatRoot
2011-07-16 12:50:15 ----HD---- C:\WINDOWS\inf
2011-07-15 13:28:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-07-15 12:49:59 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-07-15 12:49:41 ----D---- C:\WINDOWS\WinSxS
2011-07-15 12:43:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-15 12:43:15 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-01 22:28:02 ----RD---- C:\Program Files\Skype
2011-07-01 22:27:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-01 22:25:47 ----D---- C:\Documents and Settings\Vlastník\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-07-08 218688]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2007-10-29 46336]
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8029.SYS [2001-08-17 19017]
R3 rtl8139;Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2001-08-23 25434]
R3 trid3d;trid3d; C:\WINDOWS\system32\DRIVERS\trid3dm.sys [2001-12-27 149244]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-10-29 20480]
R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2001-11-26 41152]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-10-29 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

No krom toho viru nevím,jake by mel mit muj pc problemy,mozna jeste to ze byl strasne pomaly v posledni dobe,ale mam za to ze to bude tím virem =)

Pokud možno upřesněte prosím co konkretne mate na mysli,nevim co si pod tím predstavit. Děkuji