Policie ČR

[flipper]

Dobrý den.
Chtěl bych vás požádat o radu ohledně této havěti.
Jen upozorním že tento PC/Notebook není můj, ale kamaráda a tudíž nevím co vše a na co to má v tomo pc.
Ale pro začátek : PC jsem spustil v nouzovém režimu a v něm jsem dal bod obnovení asi 14 dní starý.
PC se restartoval již bez hlášky policie. Následně jsem pc pročistil AdWcleanerem. Níže přidám log.A poté vytvořil log z Rsit.exe - přidám log.
V pc byl nějaký zastaralý antivir , asi AVG - smazal jsem jej - doinstaluji Avast Free.
Poprosil bych vás o kontrolu.Děkuji.


Log z AdWcleaner :

# AdwCleaner v2.202 - Log vytvooen 28/04/2013 v 07:51:18
# Aktualizováno 23/04/2013 Xplode
# Operaení systém : Microsoft Windows XP Service Pack 3 (32 bits)
# Uživatel : Admin - A-41C0B262E5444
# Spuštin systém : Normální
# Spuštino z : D:\Documents and Settings\Admin\Dokumenty\Stažené soubory\adwcleaner.exe
# Volba [Vymazat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Vymazáno : D:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Složka Vymazáno : D:\Program Files\ICQ6Toolbar
Soubor Vymazáno : D:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\searchplugins\icqplugin.xml
Soubor Vymazáno : D:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\searchplugins\MyStart Search.xml
Soubor Vymazáno : D:\Program Files\Mozilla Firefox\.autoreg

***** [Registry] *****

Hodnota Vymazáno : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Klíe Vymazáno : HKCU\Software\ICQToolbar
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Vymazáno : HKCU\Software\XTTB00001

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v8.0.6001.18702

Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://google.icq.com --> hxxp://www.google.com
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Prev Search Bar] = hxxp://google.icq.com/search/search_frame.php --> hxxp://www.google.com
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://google.icq.com/search/search_frame.php --> hxxp://www.google.com
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://www.icq.com/search/results.php?q={searc ... &ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v3.6 (cs)

Soubor : D:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\prefs.js

Vymazáno : user_pref("browser.search.defaultenginename", "MyStart Search");
Vymazáno : user_pref("icqtoolbar.installsource", "1");
Vymazáno : user_pref("icqtoolbar.skip_default_search", "yes");

-\\ Google Chrome v26.0.1410.43

Soubor : D:\Documents and Settings\Admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Preferences

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [4073 octets] - [28/04/2013 07:44:06]
AdwCleaner[R2].txt - [3239 octets] - [28/04/2013 07:48:27]
AdwCleaner[R3].txt - [3299 octets] - [28/04/2013 07:50:32]
AdwCleaner[S1].txt - [3068 octets] - [28/04/2013 07:51:18]

########## EOF - D:\AdwCleaner[S1].txt - [3128 octets] ##########



Log z RSIT :

Logfile of random's system information tool 1.09 (written by random/random)
Run by Admin at 2013-04-28 07:56:29
Microsoft Windows XP Home Edition Service Pack 3
System drive D: has 8 GB (21%) free of 40 GB
Total RAM: 445 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:56:40, on 28.4.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\wltrysvc.exe
D:\WINDOWS\System32\bcmwltry.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\acs.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\WLTRAY.exe
D:\Program Files\Atheros\ACU.exe
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\MMTray.exe
D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray2k.exe
D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtraylsi.exe
D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
D:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
D:\Program Files\GPRSpeed\GPRSpeed Client\NGSpawner.exe
D:\Program Files\GPRSpeed\GPRSpeed Client\GPRSpeed_c.exe
D:\Program Files\Hamachi\hamachi.exe
D:\Program Files\IncrediMail\bin\IMApp.exe
C:\Acer\eManager\anbmServ.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\System32\PAStiSvc.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\RealVNC\VNC4\WinVNC4.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Common Files\PCSuite\Services\NclBTHandler.exe
D:\Documents and Settings\Admin\Dokumenty\Stažené soubory\RSIT.exe
D:\Program Files\trend micro\Admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: 172.17.176.18 PRGEX
O1 - Hosts: 172.17.176.19 PRGDC1
O1 - Hosts: 172.17.176.20 PRGDC2
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] D:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [ACU] "D:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MMTray] "D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\MMTray.exe"
O4 - HKLM\..\Run: [mmtray2k] "D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray2k.exe"
O4 - HKLM\..\Run: [mmtraylsi] "D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtraylsi.exe"
O4 - HKCU\..\Run: [T-Mobile Communication Centre] D:\Program Files\T-Mobile Communication Centre\Centre.exe
O4 - HKCU\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] D:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Admin\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ICQ] "D:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: GPRSpeed Client.lnk = D:\Program Files\GPRSpeed\GPRSpeed Client\NGSpawner.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 4440326828
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - D:\WINDOWS\system32\acs.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - D:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - D:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - D:\WINDOWS\System32\wltrysvc.exe
O24 - Desktop Component 0: (no name) - http://toplist.cz/count.asp?id=505627&l ... ent.title)+'
O24 - Desktop Component 2: (no name) - http://ak.imgag.com/imgag/product/previ ... 7/graphic1

--
End of file - 8890 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-113007714-839522115-1004Core.job
D:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-113007714-839522115-1004UA.job
D:\WINDOWS\tasks\User_Feed_Synchronization-{A340E212-628F-4005-85A6-3E29401406BE}.job

=========Mozilla firefox=========

ProfilePath - D:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default

prefs.js - "browser.startup.homepage" - "http://www.centrum.cz/skinit/icq/"
prefs.js - "extensions.enabledItems" - "{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6"
prefs.js - "keyword.URL" - "http://mystart.incredimail.com/?loc=HWF ... AB&search="

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@macromedia.com/FlashPlayer9]
"Description"=Adobe Flash Player 9.0
"Path"=D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

D:\Program Files\Mozilla Firefox\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

D:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

D:\Program Files\Mozilla Firefox\plugins\
flashplayer.xpt
npnul32.dll
nppdf32.dll
NPSWF32.dll
NPSWF32_FlashUtil.exe

D:\Program Files\Mozilla Firefox\searchplugins\
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
D:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2004-02-22 711168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}]
PCTools Site Guard - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 434279]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}]
PCTools Browser Monitor

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"=D:\WINDOWS\system32\WLTRAY []
"ACU"=D:\Program Files\Atheros\ACU.exe [2005-01-31 253952]
"SiSPower"=SiSPower.dll,ModeAgent []
"PCSuiteTrayApplication"=D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [2006-06-15 229376]
"Adobe Photo Downloader"=D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-23 57344]
"SoundMan"=D:\WINDOWS\SOUNDMAN.EXE [2005-02-23 77824]
"MMTray"=D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\MMTray.exe [2003-03-25 53248]
"mmtray2k"=D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray2k.exe [2003-03-25 57344]
"mmtraylsi"=D:\Program Files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtraylsi.exe [2003-03-25 53248]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"T-Mobile Communication Centre"=D:\Program Files\T-Mobile Communication Centre\Centre.exe []
"PcSync"=D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2006-06-27 1449984]
"ctfmon.exe"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"IncrediMail"=D:\Program Files\IncrediMail\bin\IncMail.exe [2008-06-03 243072]
"Google Update"=D:\Documents and Settings\Admin\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-03-11 135664]
"ICQ"=D:\Program Files\ICQ6\ICQ.exe silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
D:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
D:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook]
D:\WINDOWS\system32\keyhook.exe [2005-03-04 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
D:\Program Files\Java\jre1.5.0_09\bin\jusched.exe [2006-10-12 49263]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
D:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-08 688218]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
D:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-08 98394]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
D:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
D:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Utility Tray.lnk]
D:\WINDOWS\system32\sistray.exe [2005-01-04 331776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2
"Themes"=2
"SCardSvr"=3
"mnmsrvc"=3
"helpsvc"=2
"ERSvc"=2

D:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - D:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
GPRSpeed Client.lnk - D:\Program Files\GPRSpeed\GPRSpeed Client\NGSpawner.exe

D:\Documents and Settings\Admin\Nabídka Start\Programy\Po spuštění
hamachi.lnk - D:\Program Files\Hamachi\hamachi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
D:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\RealVNC\VNC4\vncviewer.exe"="D:\Program Files\RealVNC\VNC4\vncviewer.exe:*:Enabled:Run VNC Viewer"
"D:\Program Files\RealVNC\VNC4\winvnc4.exe"="D:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:winvnc4"
"D:\Program Files\RealVNC\VNC4\vncconfig.exe"="D:\Program Files\RealVNC\VNC4\vncconfig.exe:*:Enabled:vncconfig"
"D:\Program Files\GPRSpeed\GPRSpeed Client\GPRSpeed_c.exe"="D:\Program Files\GPRSpeed\GPRSpeed Client\GPRSpeed_c.exe:*:Enabled:NettGain1100_C"
"D:\Program Files\ICQLite\ICQLite.exe"="D:\Program Files\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"D:\Program Files\Windows Media Player\wmplayer.exe"="D:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"D:\Program Files\Internet Explorer\IEXPLORE.EXE"="D:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"D:\WINDOWS\system32\ftp.exe"="D:\WINDOWS\system32\ftp.exe:*:Enabled:Program pro přenos souborů"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\IncrediMail\bin\ImApp.exe"="D:\Program Files\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail"
"D:\Program Files\IncrediMail\bin\IncMail.exe"="D:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"D:\Program Files\IncrediMail\bin\ImpCnt.exe"="D:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"D:\Program Files\ICQ6\ICQ.exe"="D:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\Program Files\BitLord\BitLord.exe"="D:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"D:\Program Files\Hamachi\hamachi.exe"="D:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"D:\Program Files\ICQ6.5\ICQ.exe"="D:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"msacm.iac2"=D:\WINDOWS\system32\iac25_32.ax
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"vidc.avrn"=D:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"=D:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"=D:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"=D:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"vidc.cscd"=D:\PROGRA~1\ACEMEG~1\SystemS\camcodec.dll
"vidc.cvid"=D:\PROGRA~1\ACEMEG~1\SystemS\iccvid.dll
"msacm.trspch"=D:\PROGRA~1\ACEMEG~1\SystemS\tssoft32.acm
"vidc.em2v"=D:\PROGRA~1\ACEMEG~1\SystemS\etxcodec.dll
"vidc.mkvc"=D:\PROGRA~1\ACEMEG~1\SystemS\kmvidc32.dll
"vidc.hfyu"=D:\PROGRA~1\ACEMEG~1\SystemS\huffyuv.dll
"msacm.lameacm"=D:\PROGRA~1\ACEMEG~1\SystemS\lameacm.acm
"msacm.lhacm"=D:\PROGRA~1\ACEMEG~1\SystemS\lhacm.acm
"msacm.l3acm"=D:\PROGRA~1\ACEMEG~1\SystemS\l3codecp.acm
"vidc.sjpg"=D:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.dmb2"=D:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.gepj"=D:\PROGRA~1\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.qpeg"=D:\PROGRA~1\ACEMEG~1\SystemS\Qpeg32.dll
"vidc.q1.0"=D:\PROGRA~1\ACEMEG~1\SystemS\Qpeg32.dll
"msacm.sl_anet"=D:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.tscc"=D:\PROGRA~1\ACEMEG~1\SystemS\tsccvid.dll
"vidc.vifp"=D:\PROGRA~1\ACEMEG~1\SystemS\vfcodec.dll
"vidc.wrpr"=D:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.wnv1"=D:\PROGRA~1\ACEMEG~1\SystemS\wnvplay1.dll
"vidc.advs"=D:\PROGRA~1\ACEMEG~1\SystemS\Adaptec\Dvc.dll
"vidc.aflc"=D:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.afli"=D:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.aasc"=D:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.aas4"=D:\PROGRA~1\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.asv1"=D:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv1.dll
"vidc.asv2"=D:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.asvx"=D:\PROGRA~1\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.vcr1"=D:\PROGRA~1\ACEMEG~1\SystemS\ATI\ativcr1.dll
"vidc.vcr2"=D:\PROGRA~1\ACEMEG~1\SystemS\ATI\ativcr2.dll
"vidc.yv12"=D:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.mwv1"=D:\PROGRA~1\ACEMEG~1\SystemS\Aware\icmw_32.dll
"vidc.bt20"=D:\PROGRA~1\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"vidc.y41p"=D:\PROGRA~1\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"msacm.pcdv"=D:\PROGRA~1\ACEMEG~1\SystemS\Canopus\pcdv.acm
"vidc.cdvc"=D:\PROGRA~1\ACEMEG~1\SystemS\Canopus\CSCCDVC.DLL
"vidc.ddvc"=D:\PROGRA~1\ACEMEG~1\SystemS\Canopus\CSCdvsd.DLL
"vidc.png1"=D:\PROGRA~1\ACEMEG~1\SystemS\Core\COREPN~1.DLL
"msacm.CoreFLAC_ACM"=D:\PROGRA~1\ACEMEG~1\SystemS\Core\COREFL~1.ACM
"vidc.davc"=D:\PROGRA~1\ACEMEG~1\SystemS\dicas\davcvfw.dll
"vidc.div3"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div5"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.mpg3"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div4"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.div6"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.ap41"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.dvx4"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\divx4.dll
"vidc.divx"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"msacm.divxa32"=D:\PROGRA~1\ACEMEG~1\SystemS\DivX\divxa32.acm
"vidc.frwd"=D:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwt"=D:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwa"=D:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwt.dll
"vidc.frwu"=D:\PROGRA~1\ACEMEG~1\SystemS\Forward\frwu.dll
"vidc.glzw"=D:\PROGRA~1\ACEMEG~1\SystemS\Gabest\GLZW.dll
"vidc.gpeg"=D:\PROGRA~1\ACEMEG~1\SystemS\Gabest\GPEG.dll
"vidc.i263"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\i263_32.drv
"vidc.iv30"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv31"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv32"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv33"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv34"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv35"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv36"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv37"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv38"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv39"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv40"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv41"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv42"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv43"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv44"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv45"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv46"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv47"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv48"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv49"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv50"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\ir50_32.dll
"vidc.iyuv"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.ir21"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\IR21_R.DLL
"vidc.rt21"=D:\PROGRA~1\ACEMEG~1\SystemS\Intel\IR21_R.DLL

======List of files/folders created in the last 1 month======

2013-04-28 07:56:31 ----D---- D:\Program Files\trend micro
2013-04-28 07:56:29 ----D---- D:\rsit
2013-04-28 07:51:18 ----A---- D:\AdwCleaner[S1].txt
2013-04-28 07:50:32 ----A---- D:\AdwCleaner[R3].txt
2013-04-28 07:48:27 ----A---- D:\AdwCleaner[R2].txt
2013-04-28 07:44:06 ----A---- D:\AdwCleaner[R1].txt
2013-04-27 20:19:22 ----A---- D:\WINDOWS\zip.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\SWXCACLS.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\SWSC.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\SWREG.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\sed.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\PEV.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\NIRCMD.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\MBR.exe
2013-04-27 20:19:22 ----A---- D:\WINDOWS\grep.exe
2013-04-27 20:19:06 ----SD---- D:\ComboFix
2013-04-27 20:14:34 ----D---- D:\Qoobox
2013-04-27 20:14:01 ----D---- D:\WINDOWS\erdnt
2013-04-11 09:44:42 ----HDC---- D:\WINDOWS\$NtUninstallKB2808735$
2013-04-11 09:44:25 ----HDC---- D:\WINDOWS\$NtUninstallKB2820917$
2013-04-11 09:40:32 ----HDC---- D:\WINDOWS\$NtUninstallKB2813345$
2013-04-11 09:40:11 ----HDC---- D:\WINDOWS\$NtUninstallKB2813170$

======List of files/folders modified in the last 1 month======

2013-04-28 07:56:31 ----RD---- D:\Program Files
2013-04-28 07:54:26 ----D---- D:\WINDOWS\Temp
2013-04-28 07:54:26 ----D---- D:\WINDOWS
2013-04-28 07:54:05 ----D---- D:\Documents and Settings\Admin\Data aplikací\Hamachi
2013-04-28 07:52:31 ----A---- D:\WINDOWS\SchedLgU.Txt
2013-04-28 07:51:39 ----D---- D:\Program Files\Mozilla Firefox
2013-04-28 07:27:04 ----D---- D:\WINDOWS\system32
2013-04-28 07:27:04 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2013-04-27 21:44:59 ----HD---- D:\WINDOWS\inf
2013-04-27 21:44:53 ----RSHDC---- D:\WINDOWS\system32\dllcache
2013-04-27 21:44:50 ----D---- D:\Program Files\Internet Explorer
2013-04-27 21:44:22 ----D---- D:\WINDOWS\system32\CatRoot2
2013-04-27 21:44:13 ----A---- D:\WINDOWS\imsins.BAK
2013-04-27 21:40:28 ----A---- D:\WINDOWS\system32\MRT.exe
2013-04-27 21:18:54 ----D---- D:\WINDOWS\system32\CatRoot
2013-04-27 21:11:18 ----D---- D:\WINDOWS\system32\drivers
2013-04-27 21:06:16 ----AC---- D:\WINDOWS\m3jpeg.ini
2013-04-27 21:06:15 ----AC---- D:\WINDOWS\m3jp2k.ini
2013-04-27 21:06:12 ----AC---- D:\WINDOWS\mmtvmj.ini
2013-04-27 20:19:32 ----D---- D:\WINDOWS\Prefetch
2013-04-27 19:27:38 ----D---- D:\WINDOWS\system32\config
2013-04-27 19:26:36 ----D---- D:\WINDOWS\system32\wbem
2013-04-27 19:26:34 ----D---- D:\WINDOWS\Registration
2013-04-27 19:14:38 ----A---- D:\WINDOWS\ntbtlog.txt
2013-04-19 11:35:57 ----D---- D:\WINDOWS\network diagnostic
2013-04-11 09:45:03 ----D---- D:\WINDOWS\ie8updates
2013-04-11 09:44:55 ----HD---- D:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 SISAGP;SiS AGP Filter; D:\WINDOWS\system32\DRIVERS\SISAGPX.sys [2003-07-18 36992]
R0 uagp35;Filtr Microsoft AGPv3.5; D:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-13 44672]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 intelppm;Řadič procesoru Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SiSkp;SiSkp; D:\WINDOWS\system32\DRIVERS\srvkp.sys [2005-02-25 13312]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; D:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-11-24 17801]
R2 Aspi32;Aspi32; D:\WINDOWS\system32\drivers\Aspi32.sys [2002-08-14 17005]
R2 BTSERIAL;Bluetooth Serial Driver; \??\D:\WINDOWS\system32\drivers\btserial.sys []
R2 mdmxsdk;mdmxsdk; D:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; D:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; D:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-18 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; D:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-18 55936]
R2 osaio;osaio; \??\D:\WINDOWS\system32\drivers\osaio.sys []
R2 osanbm;osanbm; \??\D:\WINDOWS\system32\drivers\osanbm.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); D:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-02-24 2311680]
R3 BCM43XX;Broadcom 802.11 ovladač síťového adaptéru; D:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2004-12-22 369024]
R3 btaudio;Bluetooth Audio Device; D:\WINDOWS\system32\drivers\btaudio.sys [2006-01-17 328061]
R3 BTKRNL;Bluetooth Bus Enumerator; D:\WINDOWS\system32\DRIVERS\btkrnl.sys [2006-01-17 850474]
R3 GT43XX;GT Combo 802.11g Wireless LAN Adapter Driver GT43XX; D:\WINDOWS\system32\DRIVERS\gtwl5.sys [2005-01-28 266496]
R3 GTEDGWModem;Option NV GTEDGWModem; D:\WINDOWS\system32\DRIVERS\GTEDG.sys [2005-01-28 107904]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC; D:\WINDOWS\system32\DRIVERS\GTEDGNet.sys [2005-01-28 52864]
R3 hamachi;Hamachi Network Interface; D:\WINDOWS\system32\DRIVERS\hamachi.sys [2007-05-11 26056]
R3 HSF_DP;HSF_DP; D:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2004-12-15 1038208]
R3 HSFHWSIS;HSFHWSIS; D:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys [2004-12-15 200576]
R3 OptionWWSC;GT Combo EDGE SIM Card Reader; D:\WINDOWS\system32\DRIVERS\GTEDGSC.sys [2005-01-28 21888]
R3 SiS315;SiS315; D:\WINDOWS\system32\DRIVERS\sisgrp.sys [2005-03-02 240640]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; D:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 32768]
R3 SynTP;Synaptics TouchPad Driver; D:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-08 185824]
R3 winachsf;winachsf; D:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2004-12-15 703232]
S3 BTDriver;Bluetooth Virtual Communications Driver; D:\WINDOWS\system32\DRIVERS\btport.sys [2006-01-17 30459]
S3 BTWDNDIS;Bluetooth LAN Access Server; D:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-01-17 148900]
S3 btwmodem;Bluetooth Modem; D:\WINDOWS\system32\DRIVERS\btwmodem.sys [2006-01-17 30285]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; D:\WINDOWS\System32\Drivers\btwusb.sys [2006-01-17 65688]
S3 CCDECODE;Dekodér Closed Caption; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Ovladač třídy standardu HID; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; D:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Nokia USB Generic;Nokia USB Generic; D:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
S3 Nokia USB Modem;Nokia USB Modem; D:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; D:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
S3 Nokia USB Port;Nokia USB Port; D:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-05-29 13312]
S3 odysseyIM4;Odyssey Network Agent Miniport; D:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2004-06-15 173056]
S3 PAC7311;VGA SoC PC-Camera; D:\WINDOWS\system32\DRIVERS\PA707UCM.SYS [2005-10-18 154752]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; D:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-04 32768]
S3 SLIP;BDA Slip De-Framer; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; D:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACS;Atheros Configuration Service; D:\WINDOWS\system32\acs.exe [2004-12-27 36864]
R2 anbmService;Notebook Manager Service; C:\Acer\eManager\anbmServ.exe [2005-06-06 1273344]
R2 btwdins;Bluetooth Service; D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2006-01-17 266295]
R2 NwSapAgent;Agent SAP; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 STI Simulator;STI Simulator; D:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WinVNC4;VNC Server Version 4; D:\Program Files\RealVNC\VNC4\WinVNC4.exe [2005-03-11 455632]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; D:\WINDOWS\System32\wltrysvc.exe [2004-12-22 65536]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 ServiceLayer;ServiceLayer; D:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; D:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]

-----------------EOF-----------------

[vyosek]

Zdravim

A s tim ComboFixem se tam delalo co

[flipper]

To opravdu nevím.
Popisuji jen to co jsem děla já. S ComboFixem jsem nic nedělal.
Počítač jsem dostal do rukou dnes

[vyosek]

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

• Provedte aktualizaci
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[flipper]

MBAM Log:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2013.04.28.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Admin :: A-41C0B262E5444 [administrátor]

Ochrana: Povolena

28.4.2013 11:48:54
MBAM-log-2013-04-28 (14-39-19).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 301222
Uplynulý čas: 1 hodin, 50 minut, 47 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop|id (Malware.Trace) -> Data: 608555723427 -> Nebyla provedena žádná instrukce.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop|host (Malware.Trace) -> Data: 206.51.238.230 -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Services|del (Malware.Trace) -> Data: -> Nebyla provedena žádná instrukce.

Nalezené datové položky v registru: 1
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Špatný: (1) Dobrý: (0) -> Nebyla provedena žádná instrukce.

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 5
D:\Documents and Settings\Admin\Dokumenty\Hudba\3 hity\Track03.exe (Spyware.Passwords) -> Nebyla provedena žádná instrukce.
D:\System Volume Information\_restore{538D75D9-4B2E-428F-A5D6-39F91F72EC15}\RP625\A0197530.exe (Spyware.Passwords) -> Nebyla provedena žádná instrukce.
D:\System Volume Information\_restore{538D75D9-4B2E-428F-A5D6-39F91F72EC15}\RP625\A0197532.exe (Spyware.Passwords) -> Nebyla provedena žádná instrukce.
D:\Documents and Settings\All Users\Data aplikací\lsass.exe (Trojan.Delf) -> Nebyla provedena žádná instrukce.
D:\WINDOWS\system32\ieunitdrf.inf (Malware.Trace) -> Nebyla provedena žádná instrukce.

(konec)

[vyosek]

Nalezy MBAMu smazte, objevi se log, ten rad uvidim

[flipper]

Log MBAM:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
http://www.malwarebytes.org

Verze: v2013.04.28.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Admin :: A-41C0B262E5444 [administrátor]

Ochrana: Zakázána

29.4.2013 11:45:45
mbam-log-2013-04-29 (11-45-45).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 299479
Uplynulý čas: 55 minut, 55 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop|id (Malware.Trace) -> Data: 608555723427 -> Přesun do karantény a smazání se zdařilo.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop|host (Malware.Trace) -> Data: 206.51.238.230 -> Přesun do karantény a smazání se zdařilo.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Services|del (Malware.Trace) -> Data: -> Přesun do karantény a smazání se zdařilo.

Nalezené datové položky v registru: 1
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Špatný: (1) Dobrý: (0) -> Přesun do karantény a opravení se zdařilo.

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 5
D:\Documents and Settings\Admin\Dokumenty\Hudba\3 hity\Track03.exe (Spyware.Passwords) -> Přesun do karantény a smazání se zdařilo.
D:\System Volume Information\_restore{538D75D9-4B2E-428F-A5D6-39F91F72EC15}\RP625\A0197530.exe (Spyware.Passwords) -> Přesun do karantény a smazání se zdařilo.
D:\System Volume Information\_restore{538D75D9-4B2E-428F-A5D6-39F91F72EC15}\RP625\A0197532.exe (Spyware.Passwords) -> Přesun do karantény a smazání se zdařilo.
D:\Documents and Settings\All Users\Data aplikací\lsass.exe (Trojan.Delf) -> Přesun do karantény a smazání se zdařilo.
D:\WINDOWS\system32\ieunitdrf.inf (Malware.Trace) -> Přesun do karantény a smazání se zdařilo.

(konec)

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Photo Downloader"=-
  "MMTray"=-
  "mmtray2k"=-
  "mmtraylsi"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "PcSync"=-
  "IncrediMail"=-
  "Google Update"=-
  "ICQ"=-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[flipper]

ComboFix 13-04-27.04 - Admin 30.04.2013 13:01:49.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.445.165 [GMT 2:00]
Spuštěný z: d:\documents and settings\Admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Admin\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\AUTORUN.INF
d:\documents and settings\Admin\84785_norton.exe
d:\windows\EventSystem.log
d:\windows\iun6002.exe
d:\windows\pkunzip.pif
d:\windows\pkzip.pif
d:\windows\system32\CddbCdda.dll
d:\windows\system32\SET64.tmp
d:\windows\system32\SET66.tmp
d:\windows\system32\SET75.tmp
d:\windows\system32\URTTemp
d:\windows\system32\URTTemp\fusion.dll
d:\windows\system32\URTTemp\mscoree.dll
d:\windows\system32\URTTemp\mscoree.dll.local
d:\windows\system32\URTTemp\mscorsn.dll
d:\windows\system32\URTTemp\mscorwks.dll
d:\windows\system32\URTTemp\msvcr71.dll
d:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_HOST_GENERIC_PROCESS
-------\Legacy_SEAGATE_COMMUNICATION
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-28 do 2013-04-30 )))))))))))))))))))))))))))))))
.
.
2013-04-28 08:52 . 2013-04-28 08:52 -------- d-----w- d:\documents and settings\Admin\Data aplikací\Malwarebytes
2013-04-28 08:51 . 2013-04-28 08:51 -------- d-----w- d:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-04-28 08:51 . 2013-04-28 08:51 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2013-04-28 08:51 . 2013-04-04 12:50 22856 ----a-w- d:\windows\system32\drivers\mbam.sys
2013-04-28 07:08 . 2013-03-06 22:32 228600 ----a-w- d:\windows\system32\aswBoot.exe
2013-04-28 07:05 . 2013-04-28 07:05 -------- d-----w- d:\program files\AVAST Software
2013-04-28 07:04 . 2013-04-28 15:29 -------- d-----w- d:\documents and settings\All Users\Data aplikací\AVAST Software
2013-04-28 05:56 . 2013-04-28 05:56 -------- d-----w- d:\program files\trend micro
2013-04-28 05:56 . 2013-04-28 05:56 -------- d-----w- D:\rsit
2013-04-27 17:45 . 2013-04-27 17:45 -------- d-sh--w- d:\documents and settings\NetworkService\IETldCache
2013-04-27 17:26 . 2013-04-27 17:26 -------- d-----w- d:\windows\system32\wbem\Repository
2013-04-27 17:15 . 2013-04-27 17:15 -------- d-----w- d:\documents and settings\Administrator\IETldCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-08 08:36 . 2004-08-18 12:00 293376 ----a-w- d:\windows\system32\winsrv.dll
2013-03-07 15:56 . 2004-08-17 15:45 2072192 ----a-w- d:\windows\system32\ntkrnlpa.exe
2013-03-07 15:56 . 2004-08-18 12:00 2195584 ----a-w- d:\windows\system32\ntoskrnl.exe
2013-03-02 02:08 . 2004-08-18 12:00 916480 ----a-w- d:\windows\system32\wininet.dll
2013-03-02 02:08 . 2004-08-18 12:00 43520 ----a-w- d:\windows\system32\licmgr10.dll
2013-03-02 02:08 . 2004-08-18 12:00 1469440 ----a-w- d:\windows\system32\inetcpl.cpl
2013-03-02 01:57 . 2004-08-18 12:00 1867264 ----a-w- d:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-18 12:00 385024 ----a-w- d:\windows\system32\html.iec
2013-02-27 07:58 . 2006-11-23 19:17 2067456 ----a-w- d:\windows\system32\mstscax.dll
2013-02-12 00:32 . 2008-04-13 18:56 12928 ------w- d:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-18 12:00 12928 ----a-w- d:\windows\system32\drivers\usb8023.sys
2013-02-05 20:15 . 2004-08-18 12:00 916480 ----a-w- d:\windows\system32\wininet(3).dll
2013-02-05 20:15 . 2004-08-18 12:00 1212928 ----a-w- d:\windows\system32\urlmon(3).dll
2013-02-05 20:15 . 2004-08-18 12:00 105984 ----a-w- d:\windows\system32\url(3).dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="d:\windows\system32\WLTRAY" [X]
"ACU"="d:\program files\Atheros\ACU.exe" [2005-01-31 253952]
"SiSPower"="SiSPower.dll" [2005-02-25 49152]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 77824]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\D:^Documents and Settings^Admin^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=d:\documents and settings\Admin\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=d:\windows\pss\hamachi.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk
backup=d:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^GPRSpeed Client.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\GPRSpeed Client.lnk
backup=d:\windows\pss\GPRSpeed Client.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Utility Tray.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Utility Tray.lnk
backup=d:\windows\pss\Utility Tray.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-23 18:33 57344 ----a-w- d:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-10 22:56 135664 ----atw- d:\documents and settings\Admin\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
2008-06-03 15:25 243072 ----a-w- d:\program files\IncrediMail\bin\IncMail.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2003-03-25 04:49 53248 -c--a-w- d:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtray2k]
2003-03-25 04:49 57344 -c--a-w- d:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray2k.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtraylsi]
2003-03-25 04:49 53248 -c--a-w- d:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtraylsi.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
2006-06-27 14:21 1449984 ----a-w- d:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook]
2005-03-04 12:13 32768 ----a-w- d:\windows\system32\Keyhook.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2004-10-08 13:43 688218 ----a-w- d:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2004-10-08 13:44 98394 ----a-w- d:\program files\Synaptics\SynTP\SynTPLpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2 (0x2)
"Themes"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"helpsvc"=2 (0x2)
"ERSvc"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\vncconfig.exe"=
"d:\\Program Files\\GPRSpeed\\GPRSpeed Client\\GPRSpeed_c.exe"=
"d:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"d:\\WINDOWS\\system32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"d:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"d:\\Program Files\\BitLord\\BitLord.exe"=
"d:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\Program Files\\ICQ6.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5800:TCP"= 5800:TCP:5800
"5900:TCP"= 5900:TCP:5900
.
R3 GT43XX;GT Combo 802.11g Wireless LAN Adapter Driver GT43XX;d:\windows\system32\drivers\gtwl5.SYS [23.11.2006 22:15 266496]
R3 GTEDGWModem;Option NV GTEDGWModem;d:\windows\system32\drivers\GTEDG.sys [25.11.2006 10:32 107904]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;d:\windows\system32\drivers\GTEDGNet.sys [25.11.2006 10:32 52864]
R3 HSFHWSIS;HSFHWSIS;d:\windows\system32\drivers\HSFHWSIS.sys [24.11.2006 9:04 200576]
R3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [28.4.2013 10:51 22856]
R3 OptionWWSC;GT Combo EDGE SIM Card Reader;d:\windows\system32\drivers\GTEDGSC.sys [25.11.2006 10:32 21888]
S2 MBAMService;MBAMService;d:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.4.2013 10:51 701512]
S3 PAC7311;VGA SoC PC-Camera;d:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 11:48 154752]
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-30 d:\windows\Tasks\User_Feed_Synchronization-{A340E212-628F-4005-85A6-3E29401406BE}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - d:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - d:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/skinit/icq/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=HWFSSep08FFAB&search=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-avgnt - d:\program files\Avira\AntiVir Desktop\avgnt.exe
MSConfigStartUp-ICQ - d:\program files\ICQ6\ICQ.exe
MSConfigStartUp-T-Mobile Communication Centre - d:\program files\T-Mobile Communication Centre\Centre.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-30 13:49
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2488)
d:\progra~1\WINDOW~2\wmpband.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\btncopy.dll
d:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
d:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
d:\windows\system32\ConnAPI.DLL
d:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
d:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\windows\System32\wltrysvc.exe
d:\windows\System32\bcmwltry.exe
d:\windows\system32\acs.exe
c:\acer\eManager\anbmServ.exe
d:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
d:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
d:\windows\System32\PAStiSvc.exe
d:\program files\RealVNC\VNC4\WinVNC4.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\WLTRAY.exe
d:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Celkový čas: 2013-04-30 13:53:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-04-30 11:53
.
Před spuštěním: 8 842 506 240
Po spuštění: Volných bajtů: 10 925 170 688
.
- - End Of File - - BCEB9304218D5A63F9717AD8973B73F3

[vyosek]

Jeste jeden skript pro CF, postup stejny

Kód: Vybrat vše

KillAll::

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtray2k]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtraylsi]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5800:TCP"=-
"5900:TCP"=-

File::
 d:\windows\Tasks\User_Feed_Synchronization-{A340E212-628F-4005-85A6-3E29401406BE}.job

Firefox::
FF - ProfilePath - d:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=HWF ... AB&search=

ClearJavaCache::

Reboot::

[flipper]

ComboFix 13-04-27.04 - Admin 30.04.2013 20:48:39.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.445.49 [GMT 2:00]
Spuštěný z: d:\documents and settings\Admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Admin\Plocha\CFScript.txt
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
FILE ::
"d:\windows\Tasks\User_Feed_Synchronization-{A340E212-628F-4005-85A6-3E29401406BE}.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-28 do 2013-04-30 )))))))))))))))))))))))))))))))
.
.
2013-04-28 08:52 . 2013-04-28 08:52 -------- d-----w- d:\documents and settings\Admin\Data aplikací\Malwarebytes
2013-04-28 08:51 . 2013-04-28 08:51 -------- d-----w- d:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-04-28 08:51 . 2013-04-28 08:51 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2013-04-28 08:51 . 2013-04-04 12:50 22856 ----a-w- d:\windows\system32\drivers\mbam.sys
2013-04-28 07:08 . 2013-03-06 22:32 228600 ----a-w- d:\windows\system32\aswBoot.exe
2013-04-28 07:05 . 2013-04-28 07:05 -------- d-----w- d:\program files\AVAST Software
2013-04-28 07:04 . 2013-04-28 15:29 -------- d-----w- d:\documents and settings\All Users\Data aplikací\AVAST Software
2013-04-28 05:56 . 2013-04-28 05:56 -------- d-----w- d:\program files\trend micro
2013-04-28 05:56 . 2013-04-28 05:56 -------- d-----w- D:\rsit
2013-04-27 17:45 . 2013-04-27 17:45 -------- d-sh--w- d:\documents and settings\NetworkService\IETldCache
2013-04-27 17:26 . 2013-04-27 17:26 -------- d-----w- d:\windows\system32\wbem\Repository
2013-04-27 17:15 . 2013-04-27 17:15 -------- d-----w- d:\documents and settings\Administrator\IETldCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-08 08:36 . 2004-08-18 12:00 293376 ----a-w- d:\windows\system32\winsrv.dll
2013-03-07 15:56 . 2004-08-17 15:45 2072192 ----a-w- d:\windows\system32\ntkrnlpa.exe
2013-03-07 15:56 . 2004-08-18 12:00 2195584 ----a-w- d:\windows\system32\ntoskrnl.exe
2013-03-02 02:08 . 2004-08-18 12:00 916480 ----a-w- d:\windows\system32\wininet.dll
2013-03-02 02:08 . 2004-08-18 12:00 43520 ----a-w- d:\windows\system32\licmgr10.dll
2013-03-02 02:08 . 2004-08-18 12:00 1469440 ----a-w- d:\windows\system32\inetcpl.cpl
2013-03-02 01:57 . 2004-08-18 12:00 1867264 ----a-w- d:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-18 12:00 385024 ----a-w- d:\windows\system32\html.iec
2013-02-27 07:58 . 2006-11-23 19:17 2067456 ----a-w- d:\windows\system32\mstscax.dll
2013-02-12 00:32 . 2008-04-13 18:56 12928 ------w- d:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-18 12:00 12928 ----a-w- d:\windows\system32\drivers\usb8023.sys
2013-02-05 20:15 . 2004-08-18 12:00 916480 ----a-w- d:\windows\system32\wininet(3).dll
2013-02-05 20:15 . 2004-08-18 12:00 1212928 ----a-w- d:\windows\system32\urlmon(3).dll
2013-02-05 20:15 . 2004-08-18 12:00 105984 ----a-w- d:\windows\system32\url(3).dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="d:\windows\system32\WLTRAY" [X]
"ACU"="d:\program files\Atheros\ACU.exe" [2005-01-31 253952]
"SiSPower"="SiSPower.dll" [2005-02-25 49152]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 77824]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\D:^Documents and Settings^Admin^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=d:\documents and settings\Admin\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=d:\windows\pss\hamachi.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk
backup=d:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^GPRSpeed Client.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\GPRSpeed Client.lnk
backup=d:\windows\pss\GPRSpeed Client.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Utility Tray.lnk]
path=d:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Utility Tray.lnk
backup=d:\windows\pss\Utility Tray.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook]
2005-03-04 12:13 32768 ----a-w- d:\windows\system32\Keyhook.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2004-10-08 13:43 688218 ----a-w- d:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2004-10-08 13:44 98394 ----a-w- d:\program files\Synaptics\SynTP\SynTPLpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2 (0x2)
"Themes"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"helpsvc"=2 (0x2)
"ERSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"d:\\Program Files\\RealVNC\\VNC4\\vncconfig.exe"=
"d:\\Program Files\\GPRSpeed\\GPRSpeed Client\\GPRSpeed_c.exe"=
"d:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"d:\\WINDOWS\\system32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"d:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"d:\\Program Files\\BitLord\\BitLord.exe"=
"d:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\Program Files\\ICQ6.5\\ICQ.exe"=
.
R3 GT43XX;GT Combo 802.11g Wireless LAN Adapter Driver GT43XX;d:\windows\system32\drivers\gtwl5.SYS [23.11.2006 22:15 266496]
R3 GTEDGWModem;Option NV GTEDGWModem;d:\windows\system32\drivers\GTEDG.sys [25.11.2006 10:32 107904]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;d:\windows\system32\drivers\GTEDGNet.sys [25.11.2006 10:32 52864]
R3 HSFHWSIS;HSFHWSIS;d:\windows\system32\drivers\HSFHWSIS.sys [24.11.2006 9:04 200576]
R3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [28.4.2013 10:51 22856]
R3 OptionWWSC;GT Combo EDGE SIM Card Reader;d:\windows\system32\drivers\GTEDGSC.sys [25.11.2006 10:32 21888]
S2 MBAMService;MBAMService;d:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.4.2013 10:51 701512]
S3 PAC7311;VGA SoC PC-Camera;d:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 11:48 154752]
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-30 d:\windows\Tasks\User_Feed_Synchronization-{A340E212-628F-4005-85A6-3E29401406BE}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - d:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 10.4.30.250
FF - ProfilePath - d:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\y9vy8h9o.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/skinit/icq/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-01 00:23
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2764)
d:\progra~1\WINDOW~2\wmpband.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\btncopy.dll
d:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
d:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
d:\windows\system32\ConnAPI.DLL
d:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
d:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\windows\System32\wltrysvc.exe
d:\windows\System32\bcmwltry.exe
d:\windows\system32\acs.exe
c:\acer\eManager\anbmServ.exe
d:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
d:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
d:\windows\System32\PAStiSvc.exe
d:\program files\RealVNC\VNC4\WinVNC4.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\WLTRAY.exe
d:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Celkový čas: 2013-05-01 00:27:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-04-30 22:27
ComboFix2.txt 2013-04-30 11:53
.
Před spuštěním: Volných bajtů: 10 949 632 000
Po spuštění: Volných bajtů: 10 937 139 200
.
- - End Of File - - EB3B66CD6AA0DFA6DB7AD401C327A6DF

[vyosek]

Fajn, jak se chova PC

[flipper]

Notebook je v pořádku.
Jestli je to vše , tak Vám moc děkuji za pomoc.

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

[flipper]

Děkuji moc za poskytnuté rady