Smart fortress 2012

[rogam]

Zdravím,

po velmi dlouhé době PC klidu jsem málem dostal infarkt.

Nechápu, jak se to stalo...jen jsem si odskočil na WC a po návratu zpět pohroma...

Při prohlížení webových stránek, a mám pocit, že za to můžou stránky začínající takto: http://www.playstation.... (a dál si nepamatuji) se mi na monitoru objevilo okno programu Smart fortress 2012 - a že prý mám zavirované PC.

Tato mrcha mi odstavila mi antivirový program (Microsoft essential), zablokovala mi firefox, explorer, nápovědu...skoro vše. Po restartu a několikerém vypnutí se mi podařilo spustit nástroj Obnovení systému, díky čemuž sem teď mohu napsat. Sice je PC jak šnek, firefox nabíhá (tedy spíše nenabíhá) velmi pomalu a neustále se kouše stejně jako ostatní programy...takže zřejmě jsem ten virus, tedy jak teď vím scareware, jen dočasně paralizoval..

Na netu toho česky o Smart fortress moc není, anglicky nějaké návody ovšem na stránkách, u kterých nevím, zdali jim věřit...můžete mi prosím pomoci?

Zde log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Help4 at 2012-05-10 15:48:54
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 3 GB (13%) free of 20 GB
Total RAM: 447 MB (9% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:50:19, on 10.5.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnp325.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Help4\Local Settings\Data aplikací\Akamai\netsession_win.exe
C:\Documents and Settings\Help4\Local Settings\Data aplikací\Akamai\netsession_win.exe
C:\Program Files\LINKMAGIC\LINKMAGIC.EXE
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Documents and Settings\Help4\Plocha\RSIT.exe
C:\Program Files\trend micro\Help4.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Documents and Settings\Help4\Local Settings\Data aplikací\Akamai\netsession_win.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LINKMAGIC.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe

--
End of file - 7311 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13, {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, jqs@sun.com:1.0, {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}:2.12.21.1, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3, cs@dictionaries.addons.mozilla.org:1.0.2, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.15"
prefs.js - "keyword.URL" - "http://search.icq.com/search/afe_result ... r=1.2.6&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.233 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsILegitCheckPlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npLegitCheckPlugin.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default\extensions\
cs@dictionaries.addons.mozilla.org
{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
{20a82645-c095-46ed-80e3-08825760534b}
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

C:\Documents and Settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default\searchplugins\
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-10-18 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd []
"VTTimer"=C:\WINDOWS\system32\VTTimer.exe [2004-10-22 53248]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"snp325"=C:\WINDOWS\vsnp325.exe [2007-05-10 835584]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"VTTrayp"=C:\WINDOWS\system32\VTtrayp.exe [2004-10-12 143360]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-01-03 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 931200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
""= []
"Akamai NetSession Interface"=C:\Documents and Settings\Help4\Local Settings\Data aplikací\Akamai\netsession_win.exe [2012-03-13 3331872]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
LINKMAGIC.lnk - C:\Program Files\LINKMAGIC\LINKMAGIC.EXE
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe:*:Enabled:ESET NOD32 Antivirus"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"VIDC.MPG4"=mpg4c32.dll
"VIDC.MP42"=mpg4c32.dll
"msacm.l3fhg"=mp3fhg.acm
"msacm.divxa32"=divxa32.acm
"VIDC.X264"=x264vfw.dll
"VIDC.DIV3"=DivXc32.dll
"VIDC.DIV4"=DivXc32f.dll
"VIDC.VP70"=vp7vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2012-05-10 15:33:51 ----D---- C:\Program Files\trend micro
2012-05-10 15:33:46 ----D---- C:\rsit
2012-05-10 15:14:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2659262$
2012-05-10 14:04:29 ----SHD---- C:\Config.Msi
2012-05-10 14:01:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2686509$
2012-05-10 14:00:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2695962$
2012-05-10 13:53:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2676562$
2012-05-10 13:04:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\529C53A800015CB70000253BD151FC84
2012-05-02 08:28:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Mozilla
2012-05-02 08:28:19 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-04-16 08:34:35 ----HDC---- C:\WINDOWS\$NtUninstallKB2653956$

======List of files/folders modified in the last 1 month======

2012-05-10 15:46:24 ----D---- C:\WINDOWS\Temp
2012-05-10 15:45:21 ----D---- C:\WINDOWS
2012-05-10 15:45:17 ----D---- C:\Program Files\Common Files\Akamai
2012-05-10 15:44:55 ----D---- C:\WINDOWS\system32
2012-05-10 15:44:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-05-10 15:44:10 ----D---- C:\WINDOWS\system32\CatRoot2
2012-05-10 15:33:51 ----RD---- C:\Program Files
2012-05-10 15:14:56 ----SHD---- C:\WINDOWS\Installer
2012-05-10 15:14:25 ----HD---- C:\WINDOWS\inf
2012-05-10 15:14:10 ----D---- C:\WINDOWS\WinSxS
2012-05-10 15:13:43 ----D---- C:\WINDOWS\Microsoft.NET
2012-05-10 15:10:00 ----D---- C:\WINDOWS\system32\XPSViewer
2012-05-10 15:08:51 ----RSD---- C:\WINDOWS\assembly
2012-05-10 14:13:23 ----A---- C:\WINDOWS\system32\MRT.exe
2012-05-10 14:10:03 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-05-10 14:01:06 ----A---- C:\WINDOWS\imsins.BAK
2012-05-10 14:00:54 ----HD---- C:\WINDOWS\$hf_mig$
2012-05-10 13:58:47 ----SD---- C:\WINDOWS\Tasks
2012-05-10 13:54:11 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-05-10 13:50:13 ----D---- C:\WINDOWS\Prefetch
2012-05-10 13:47:19 ----D---- C:\WINDOWS\system32\config
2012-05-10 13:46:52 ----D---- C:\WINDOWS\system32\wbem
2012-05-10 13:46:51 ----D---- C:\WINDOWS\Registration
2012-05-09 12:42:24 ----D---- C:\Program Files\Mozilla Firefox
2012-05-02 13:19:13 ----A---- C:\WINDOWS\ULEAD32.INI
2012-05-02 13:15:29 ----D---- C:\Program Files\Ulead PhotoImpact SE
2012-04-30 08:09:12 ----D---- C:\Program Files\Microsoft Security Client
2012-04-30 08:07:21 ----D---- C:\WINDOWS\system32\drivers
2012-04-23 19:06:54 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-04-18 11:38:26 ----D---- C:\Program Files\EurotelSMS
2012-04-17 09:08:59 ----D---- C:\FBBM
2012-04-16 09:22:50 ----D---- C:\Program Files\Internet Explorer
2012-04-16 09:21:34 ----D---- C:\WINDOWS\ie8updates
2012-04-13 10:22:32 ----A---- C:\WINDOWS\NeroDigital.ini
2012-04-11 15:55:21 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2012-04-11 15:55:02 ----A---- C:\WINDOWS\system32\ntoskrnl.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2008-04-13 46464]
R0 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2012-03-20 171064]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-07-13 91904]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]
R1 MpKsl4d492241;MpKsl4d492241; \??\C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{BD47B2C9-82E1-49B4-A3D2-4D3214B59B05}\MpKsl4d492241.sys []
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-04-25 4030144]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-09-22 43520]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2004-12-07 172672]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2009-05-26 14336]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2005-12-15 1368000]
S3 DrvAgent32;DrvAgent32; \??\C:\WINDOWS\system32\Drivers\DrvAgent32.sys []
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2003-07-29 41984]
S3 MosIrUsb;MosIrUsb.sys; C:\WINDOWS\system32\DRIVERS\MosIrUsb.sys [2004-04-14 20736]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2008-04-13 22016]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2011-05-18 18176]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2011-05-18 23168]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2011-05-18 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2011-05-18 8576]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1039bus.sys [2010-03-15 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1039mdfl.sys [2010-03-15 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1039mdm.sys [2010-03-15 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1039mgmt.sys [2010-03-15 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1039nd5.sys [2010-03-15 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1039obex.sys [2010-03-15 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1039unic.sys [2010-03-15 123504]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SNP325;USB PC Camera (SNPSTD325); C:\WINDOWS\system32\DRIVERS\snp325.sys [2009-01-13 451456]
S3 sonypvs1;Sony Digital Imaging Video2; C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 102220]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2011-05-18 8192]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2011-05-18 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-07-13 132224]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Akamai;Akamai NetSession Interface; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-10-03 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-03-26 11552]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-22 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-23 253088]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-22 136176]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-02 129976]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2011-06-08 633856]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]

-----------------EOF-----------------

[Rudy]

Také zdravím!
Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[rogam]

Heh..včera mi vypadnul net, ale log je níže... něco mě to smazalo, ale dle (ne)funkčnosti firefoxu to zřejmě ještě není zcela v pořádku...zatím moc děkuji

LOG:

• ComboFix 12-05-11.02 - Help4 11.05.2012 8:22.1.1 - x86
  Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.173 [GMT 2:00]
  Spuštěný z: c:\documents and settings\Help4\Plocha\ComboFix.exe
  AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
  AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
  .
  .
  ((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  c:\documents and settings\Help4\WINDOWS
  c:\windows\IsUn0405.exe
  .
  .
  ((((((((((((((((((((((((( Soubory vytvořené od 2012-04-11 do 2012-05-11 )))))))))))))))))))))))))))))))
  .
  .
  2012-05-10 14:28 . 2012-05-10 14:28 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\documents and settings\Help4\Data aplikací\Malwarebytes
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
  2012-05-10 14:21 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
  2012-05-10 14:03 . 2012-04-13 07:36 6734704 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{CC980BAD-54F7-4B30-8906-6C01EE51C967}\mpengine.dll
  2012-05-10 13:53 . 2012-05-10 13:53 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
  2012-05-10 13:33 . 2012-05-10 13:49 -------- d-----w- c:\program files\trend micro
  2012-05-10 13:33 . 2012-05-10 13:35 -------- d-----w- C:\rsit
  2012-05-10 11:54 . 2012-05-10 11:54 -------- d-----w- c:\documents and settings\Help4\Local Settings\Data aplikací\PCHealth
  2012-05-10 11:48 . 2012-04-13 07:36 6734704 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  2012-05-10 11:46 . 2012-05-10 11:46 -------- d-----w- c:\windows\system32\wbem\Repository
  2012-05-10 11:04 . 2012-05-10 11:46 -------- d-----w- c:\documents and settings\All Users\Data aplikací\529C53A800015CB70000253BD151FC84
  2012-05-02 06:28 . 2012-05-02 06:28 -------- d-----w- c:\program files\Mozilla Maintenance Service
  2012-05-02 06:27 . 2012-05-02 06:27 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
  2012-05-02 06:27 . 2012-05-02 06:27 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
  .
  .
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2012-05-10 13:53 . 2012-03-30 06:04 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
  2012-05-10 13:53 . 2011-05-17 05:49 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
  2012-04-11 13:55 . 2004-08-17 15:45 2071296 ----a-w- c:\windows\system32\ntkrnlpa.exe
  2012-04-11 13:55 . 2006-03-02 12:00 1862272 ----a-w- c:\windows\system32\win32k.sys
  2012-04-11 13:55 . 2006-03-02 12:00 2194816 ----a-w- c:\windows\system32\ntoskrnl.exe
  2012-03-20 18:44 . 2012-03-20 18:44 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
  2012-03-01 10:59 . 2006-03-02 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
  2012-03-01 10:59 . 2006-03-02 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
  2012-03-01 10:59 . 2006-03-02 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
  2012-02-29 14:10 . 2006-03-02 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll
  2012-02-29 14:10 . 2006-03-02 12:00 148480 ----a-w- c:\windows\system32\imagehlp.dll
  2012-02-29 12:17 . 2006-03-02 12:00 385024 ----a-w- c:\windows\system32\html.iec
  2012-05-02 06:27 . 2012-02-13 12:08 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
  .
  .
  (((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
  REGEDIT4
  .
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Akamai NetSession Interface"="c:\documents and settings\Help4\Local Settings\Data aplikací\Akamai\netsession_win.exe" [2012-03-13 3331872]
  .
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
  "VTTimer"="VTTimer.exe" [2004-10-22 53248]
  "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
  "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
  "snp325"="c:\windows\vsnp325.exe" [2007-05-10 835584]
  "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
  "VTTrayp"="VTtrayp.exe" [2004-10-12 143360]
  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
  "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
  "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
  "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
  .
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
  .
  c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
  LINKMAGIC.lnk - c:\program files\LINKMAGIC\LINKMAGIC.EXE [2009-5-25 1780224]
  Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
  .
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  @="Service"
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  @="Driver"
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
  @="Service"
  .
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  .
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  .
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
  "c:\\Program Files\\ICQ7.4\\ICQ.exe"=
  "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
  .
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "1050:TCP"= 1050:TCP:Akamai NetSession Interface
  "5000:UDP"= 5000:UDP:Akamai NetSession Interface
  .
  R1 MpKsl3b2f6d47;MpKsl3b2f6d47;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{CC980BAD-54F7-4B30-8906-6C01EE51C967}\MpKsl3b2f6d47.sys [11.5.2012 8:12 29904]
  R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [2.3.2006 14:00 14336]
  R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10.5.2012 16:21 654408]
  R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10.5.2012 16:21 22344]
  S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22.7.2010 10:03 136176]
  S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [30.3.2012 8:04 257696]
  S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [17.6.2007 1:00 14336]
  S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [18.1.2012 12:25 23456]
  S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [18.8.2005 7168]
  S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22.7.2010 10:03 136176]
  S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [10.5.2012 16:28 40776]
  S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14.4.2004 14:52 20736]
  S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2.5.2012 8:28 129976]
  S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [11.7.2011 14:10 137600]
  S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [11.7.2011 14:10 8576]
  S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [16.3.2011 11:37 98672]
  S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [16.3.2011 11:37 14960]
  S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [16.3.2011 11:37 124016]
  S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [16.3.2011 11:37 117872]
  S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [16.3.2011 11:37 25456]
  S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [16.3.2011 11:37 113904]
  S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [16.3.2011 11:37 123504]
  S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [13.1.2009 4:00 451456]
  S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [16.3.2011 11:33 155344]
  .
  --- Ostatní služby/ovladače v paměti ---
  .
  *NewlyCreated* - MPKSL3B2F6D47
  .
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
  Akamai REG_MULTI_SZ Akamai
  .
  Obsah adresáře 'Naplánované úlohy'
  .
  2012-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
  - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 13:53]
  .
  2012-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 08:02]
  .
  2012-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 08:02]
  .
  2012-05-11 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
  - c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
  .
  .
  ------- Doplňkový sken -------
  .
  uStart Page = hxxp://www.seznam.cz/
  uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
  IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
  IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
  IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
  IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
  TCP: DhcpNameServer = 10.0.0.138
  FF - ProfilePath - c:\documents and settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default\
  FF - prefs.js: browser.search.selectedEngine - Google
  FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
  FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=
  .
  - - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
  .
  HKLM-Run-Cmaudio - cmicnfg.cpl
  SafeBoot-WudfPf
  SafeBoot-WudfRd
  AddRemove-DelinvFile_is1 - d:\programy\PurgeIE\unins000.exe
  .
  .
  .
  **************************************************************************
  .
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2012-05-11 08:36
  Windows 5.1.2600 Service Pack 3 NTFS
  .
  skenování skrytých procesů ...
  .
  skenování skrytých položek 'Po spuštění' ...
  .
  skenování skrytých souborů ...
  .
  sken byl úspešně dokončen
  skryté soubory: 0
  .
  **************************************************************************
  .
  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
  "ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"
  .
  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
  "ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"
  .
  Celkový čas: 2012-05-11 08:41:48
  ComboFix-quarantined-files.txt 2012-05-11 06:41
  .
  Před spuštěním: 3 009 966 080
  Po spuštění: 4 277 739 520
  .
  WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
  [boot loader]
  timeout=2
  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
  [operating systems]
  c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
  UnsupportedDebug="do not select this" /debug
  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
  .
  - - End Of File - - 3653686A891ED7D06D92802A0505A1B3

Edit 15:15 - odjiždím na víkend pryč, proto budu případně reagovat až v neděli večer.

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\documents and settings\Help4\Local Settings\Data aplikací\Akamai

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Driver::
Akamai

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1050:TCP"=-
"5000:UDP"=-

Firefox::
FF - ProfilePath - c:\documents and settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.2.6&q=

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[rogam]

Zdravim, provedu a hodim sem LOG. Zatim moc diky.

[Rudy]

OK.

[rogam]

Zdravím, mám trochu problém s připojením, tak píši až teď.

Nicméně někde je problém - zkoušel jsem to včera i dnes a výsledek je vždy stejný... combofix se spustí ale PC přestane po cca 15 minutách vydávat jakékoliv známky činnosti a ten to stav by zřejmě trval stále... včera jsem to tak nechal skoro 3 hodiny, dnes znovu více jak hodinu a nic. Pomohl pouze "tvrdý" reset a vrácení do poslední funkční konfigurace (pravděpodobně bod obnovení vytvořený cfx před zahájením činnosti.

[Rudy]

Zkuste ho spustit v nouz. režimu.

[rogam]

OK. Jdu na to.

[rogam]

Tak pomohlo to, akorát zhruba uprostřed procesu mi windows vypsali chybu aplikace/procesu PEV.exe, kterou ukončili.

LOG zde:

• ComboFix 12-05-14.01 - Help4 14.05.2012 18:36:04.2.1 - x86 MINIMAL
  Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.231 [GMT 2:00]
  Spuštěný z: c:\documents and settings\Help4\Plocha\ComboFix.exe
  Použité ovládací přepínače :: c:\documents and settings\Help4\Plocha\CFScript.txt
  AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
  AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
  .
  FILE ::
  "c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
  "c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
  .
  .
  ((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  c:\windows\pkunzip.pif
  c:\windows\pkzip.pif
  c:\windows\system32\dllcache\dlimport.exe
  .
  .
  ((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  -------\Legacy_AKAMAI
  -------\Service_Akamai
  .
  .
  ((((((((((((((((((((((((( Soubory vytvořené od 2012-04-14 do 2012-05-14 )))))))))))))))))))))))))))))))
  .
  .
  2012-05-14 16:51 . 2012-05-14 16:51 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{36864A52-41D7-4A0D-9116-25CFC2EC4B58}\MpKsl8cf71d43.sys
  2012-05-14 09:14 . 2012-04-13 07:36 6734704 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{36864A52-41D7-4A0D-9116-25CFC2EC4B58}\mpengine.dll
  2012-05-11 06:50 . 2012-04-13 07:36 6734704 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  2012-05-10 14:28 . 2012-05-10 14:28 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\documents and settings\Help4\Data aplikací\Malwarebytes
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
  2012-05-10 14:21 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
  2012-05-10 14:21 . 2012-05-10 14:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
  2012-05-10 13:53 . 2012-05-10 13:53 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
  2012-05-10 13:33 . 2012-05-14 09:12 -------- d-----w- c:\program files\trend micro
  2012-05-10 13:33 . 2012-05-10 13:35 -------- d-----w- C:\rsit
  2012-05-10 11:54 . 2012-05-10 11:54 -------- d-----w- c:\documents and settings\Help4\Local Settings\Data aplikací\PCHealth
  2012-05-10 11:46 . 2012-05-10 11:46 -------- d-----w- c:\windows\system32\wbem\Repository
  2012-05-10 11:04 . 2012-05-10 11:46 -------- d-----w- c:\documents and settings\All Users\Data aplikací\529C53A800015CB70000253BD151FC84
  2012-05-02 06:28 . 2012-05-02 06:28 -------- d-----w- c:\program files\Mozilla Maintenance Service
  2012-05-02 06:27 . 2012-05-02 06:27 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
  2012-05-02 06:27 . 2012-05-02 06:27 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
  .
  .
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2012-05-10 13:53 . 2012-03-30 06:04 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
  2012-05-10 13:53 . 2011-05-17 05:49 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
  2012-04-11 13:55 . 2004-08-17 15:45 2071296 ----a-w- c:\windows\system32\ntkrnlpa.exe
  2012-04-11 13:55 . 2006-03-02 12:00 1862272 ----a-w- c:\windows\system32\win32k.sys
  2012-04-11 13:55 . 2006-03-02 12:00 2194816 ----a-w- c:\windows\system32\ntoskrnl.exe
  2012-03-20 18:44 . 2012-03-20 18:44 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
  2012-03-01 10:59 . 2006-03-02 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
  2012-03-01 10:59 . 2006-03-02 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
  2012-03-01 10:59 . 2006-03-02 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
  2012-02-29 14:10 . 2006-03-02 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll
  2012-02-29 14:10 . 2006-03-02 12:00 148480 ----a-w- c:\windows\system32\imagehlp.dll
  2012-02-29 12:17 . 2006-03-02 12:00 385024 ----a-w- c:\windows\system32\html.iec
  2012-05-02 06:27 . 2012-02-13 12:08 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
  .
  .
  ((((((((((((((((((((((((((((( SnapShot@2012-05-11_06.36.33 )))))))))))))))))))))))))))))))))))))))))
  .
  + 2012-05-14 16:51 . 2012-05-14 16:51 16384 c:\windows\temp\Perflib_Perfdata_210.dat
  .
  (((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
  REGEDIT4
  .
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
  "VTTimer"="VTTimer.exe" [2004-10-22 53248]
  "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
  "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
  "snp325"="c:\windows\vsnp325.exe" [2007-05-10 835584]
  "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
  "VTTrayp"="VTtrayp.exe" [2004-10-12 143360]
  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
  "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
  "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
  "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
  .
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
  "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
  .
  c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
  LINKMAGIC.lnk - c:\program files\LINKMAGIC\LINKMAGIC.EXE [2009-5-25 1780224]
  Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
  .
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  @="Service"
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  @="Driver"
  .
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
  @="Service"
  .
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  .
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  .
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
  "c:\\Program Files\\ICQ7.4\\ICQ.exe"=
  "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
  .
  R1 MpKsl8cf71d43;MpKsl8cf71d43;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{36864A52-41D7-4A0D-9116-25CFC2EC4B58}\MpKsl8cf71d43.sys [14.5.2012 18:51 29904]
  R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10.5.2012 16:21 654408]
  R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10.5.2012 16:21 22344]
  S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22.7.2010 10:03 136176]
  S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [30.3.2012 8:04 257696]
  S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [17.6.2007 1:00 14336]
  S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [18.1.2012 12:25 23456]
  S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [18.8.2005 7168]
  S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22.7.2010 10:03 136176]
  S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [10.5.2012 16:28 40776]
  S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [14.4.2004 14:52 20736]
  S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2.5.2012 8:28 129976]
  S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [11.7.2011 14:10 137600]
  S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [11.7.2011 14:10 8576]
  S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [16.3.2011 11:37 98672]
  S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [16.3.2011 11:37 14960]
  S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [16.3.2011 11:37 124016]
  S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [16.3.2011 11:37 117872]
  S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [16.3.2011 11:37 25456]
  S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [16.3.2011 11:37 113904]
  S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [16.3.2011 11:37 123504]
  S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [13.1.2009 4:00 451456]
  S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [16.3.2011 11:33 155344]
  .
  --- Ostatní služby/ovladače v paměti ---
  .
  *NewlyCreated* - MPKSL8CF71D43
  .
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
  Akamai REG_MULTI_SZ Akamai
  .
  Obsah adresáře 'Naplánované úlohy'
  .
  2012-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
  - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 13:53]
  .
  2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 08:02]
  .
  2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 08:02]
  .
  2012-05-14 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
  - c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
  .
  .
  ------- Doplňkový sken -------
  .
  uStart Page = hxxp://www.seznam.cz/
  uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
  IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
  IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
  IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
  IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
  TCP: DhcpNameServer = 10.0.0.138
  FF - ProfilePath - c:\documents and settings\Help4\Data aplikací\Mozilla\Firefox\Profiles\qf9vf11t.default\
  FF - prefs.js: browser.search.selectedEngine - Google
  FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
  .
  .
  **************************************************************************
  .
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2012-05-14 18:51
  Windows 5.1.2600 Service Pack 3 NTFS
  .
  skenování skrytých procesů ...
  .
  skenování skrytých položek 'Po spuštění' ...
  .
  skenování skrytých souborů ...
  .
  sken byl úspešně dokončen
  skryté soubory: 0
  .
  **************************************************************************
  .
  [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EverestDriver]
  "ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"
  .
  --------------------- Knihovny navázané na běžící procesy ---------------------
  .
  - - - - - - - > 'winlogon.exe'(652)
  c:\windows\system32\adsldpc.dll
  .
  - - - - - - - > 'explorer.exe'(3268)
  c:\windows\system32\msls31.dll
  c:\windows\system32\webcheck.dll
  c:\windows\system32\WPDShServiceObj.dll
  c:\windows\system32\PortableDeviceTypes.dll
  c:\windows\system32\PortableDeviceApi.dll
  .
  ------------------------ Jiné spuštené procesy ------------------------
  .
  c:\program files\Microsoft Security Client\MsMpEng.exe
  c:\program files\Java\jre6\bin\jqs.exe
  c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  c:\windows\system32\VTTimer.exe
  c:\windows\SOUNDMAN.EXE
  c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
  c:\windows\system32\VTtrayp.exe
  .
  **************************************************************************
  .
  Celkový čas: 2012-05-14 19:03:40 - počítač byl restartován
  ComboFix-quarantined-files.txt 2012-05-14 17:03
  ComboFix2.txt 2012-05-11 06:41
  .
  Před spuštěním: 4 140 797 952
  Po spuštění: 4 024 852 480
  .
  - - End Of File - - 1DAA75BC2EA48D963825C33B8E4EC264

[Rudy]

Log již vypadá čistý. Nastala nějaká změna?

[rogam]

Zdá se, že se PC chová standardně...
Sice je pomalý, ale to je problém malé operační paměti...nicméně co tak zkouším, tak se zdá, že vše funguje jako dříve. Mnohokrát Vám děkuji.

Jen bych měl ještě jeden malý dotaz...náhodou netušíte co je to ten smart fortres zač a kde jsem k němu mohl přijít, když je ME stále spuštěný...?

[Rudy]

Smart fortress 2012 je fake antivir a chytil jste ho ne nějakém zavirovaném webu. Tyhle šmejdy se dokáží do PC dostat i přes rezidentní štít tím, že ho na okamžik vypnou. RAM je na dolní hranici pro systém XP, 1024MB by bylo rozhodně lepší.

[rogam]

Děkuji za info. O té paměti vím, ale nějak se nemůžu dokopat k nápravě

Jen se ještě zeptám, a už mizím ... existuje proti nim nějaká obrana? Pochopil bych, kdybych lezl na nějaké pochybné stránky, ale chytit to na stránkách/fóru o PS3 je docela nečekané...

[Rudy]

Tam bych to také nečekal. Je možné, že stránky byly něčím infikovány, nebo jste si někde kliknul. Antivir by měl napadené stránky hlásit a rovněž některé prohlížeče (třeba Firefox) mají databázi nebezpečných webů.