Prosím o kontrolu logu

[Frenki]

Pc výrazně pomalejší,často stránku Opera načte až podruhé.Dík Frenki


Logfile of random's system information tool 1.06 (written by random/random)
Run by vf at 2009-06-16 10:04:00
Systém Microsoft Windows XP Professional Service Pack 2
System drive D: has 5 GB (56%) free of 10 GB
Total RAM: 287 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04:45, on 16.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Documents and Settings\vf.VF-D5864C983A5F\wptcc.exe
D:\WINDOWS\Explorer.EXE
E:\avast\aswUpdSv.exe
E:\avast\ashServ.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
D:\WINDOWS\system32\kernell.dll
D:\WINDOWS\system32\rundll32.exe
E:\avast\ashDisp.exe
D:\Program Files\Postak\Postak.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\IncrediMail\bin\IMApp.exe
E:\avast\ashMaiSv.exe
D:\WINDOWS\system32\ctfmon .exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\IncrediMail\bin\ImNotfy.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\wuauclt.exe
E:\avast\ashWebSv.exe
D:\Program Files\Opera\opera.exe
E:\totalcmd\TOTALCMD.EXE
E:\download\RSIT.exe
D:\Program Files\trend micro\vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - D:\Program Files\Mininova-Vuze\tbMin1.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\Documents and Settings\vf.VF-D5864C983A5F\wptcc.exe \s
O2 - BHO: IHPIEHook Class - {0eceeac0-8a08-11d4-a521-0020af300fc7} - C:\rybfumrn\HPIE.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - D:\WINDOWS\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\office\Office12\GRA8E1~1.DLL
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll
O2 - BHO: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - D:\Program Files\Mininova-Vuze\tbMin1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - D:\Program Files\Postak\SRank.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL
O3 - Toolbar: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - D:\Program Files\Mininova-Vuze\tbMin1.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - D:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [avast!] E:\avast\ashDisp.exe
O4 - HKLM\..\Run: [SMail] "D:\Program Files\Postak\Postak.exe"
O4 - HKCU\..\Run: [IncrediMail] D:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Obsah aplikace OneNote.onetoc2
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\office\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://E:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://E:\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://E:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://E:\Free Download Manager\dlall.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\office\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - D:\WINDOWS\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - D:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - D:\WINDOWS\WebIE.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\office\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\SASWINLO.dll
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\avast\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\avast\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\avast\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - E:\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - D:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - D:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

--
End of file - 7351 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\RegCure Program Check.job
D:\WINDOWS\tasks\RegCure.job
D:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0eceeac0-8a08-11d4-a521-0020af300fc7}]
IHPIEHook Class - C:\rybfumrn\HPIE.dll [2009-02-03 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - D:\WINDOWS\WebIE.dll [2009-05-28 491520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - E:\office\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - E:\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
Mininova-Vuze Toolbar - D:\Program Files\Mininova-Vuze\tbMin1.dll [2009-05-28 2094616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
Ask Toolbar BHO - D:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL [2008-12-04 245760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B71B15CF-3093-459C-B764-AEB2486F2273} - &S-Rank - D:\Program Files\Postak\SRank.dll [2007-05-16 269632]
{FE063DB9-4EC0-403e-8DD8-394C54984B2C} - Ask Toolbar - D:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL [2008-12-04 245760]
{d51d388b-f5dc-471a-a1ce-5e2d671091c0} - Mininova-Vuze Toolbar - D:\Program Files\Mininova-Vuze\tbMin1.dll [2009-05-28 2094616]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - D:\WINDOWS\WebIE.dll [2009-05-28 491520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=E:\avast\ashDisp.exe [2008-11-26 81000]
"SMail"=D:\Program Files\Postak\Postak.exe [2008-02-21 453936]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"=D:\Program Files\IncrediMail\bin\IncMail.exe [2009-02-02 251264]
"fsm"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
E:\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bwxx]
D:\WINDOWS\system32\bwxx.exe [2009-05-28 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2009-06-14 23052]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
D:\Program Files\Eraser\eraser.exe [2006-12-26 643072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
E:\Free Download Manager\fdm.exe [2009-01-31 3399727]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetChat]
D:\DOCUME~1\VFD41D~1.VF-\LOCALS~1\Temp\_tc0\NetChat.exe * []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEXPRESS]
D:\WINDOWS\OETRN.EXE [2009-06-14 23052]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
D:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
D:\Program Files\Google\Gmail Notifier\gnotify.exe [2009-06-12 23052]

D:\Documents and Settings\vf.VF-D5864C983A5F\Nabídka Start\Programy\Po spuštění
Obsah aplikace OneNote.onetoc2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\SASWINLO.dll [2007-04-19 294912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
D:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32]
WinCtrl32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= []
"{DAE0285D-0788-4E87-985E-01DF2EDE4ACD}"=D:\WINDOWS\system32\Wshxt.dll [2009-02-03 53248]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=E:\office\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot04.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwb20.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Winot04.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Winwb20.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\office\Office12\OUTLOOK.EXE"="E:\office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"E:\office\Office12\GROOVE.EXE"="E:\office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"E:\office\Office12\ONENOTE.EXE"="E:\office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\Program Files\Vuze\Azureus.exe"="D:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"D:\Program Files\IncrediMail\bin\ImApp.exe"="D:\Program Files\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail"
"D:\Program Files\IncrediMail\bin\IncMail.exe"="D:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"D:\Program Files\IncrediMail\bin\ImpCnt.exe"="D:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"D:\Program Files\HS ChatPhone\chatphone.exe"="D:\Program Files\HS ChatPhone\chatphone.exe:*:Enabled:chatphone"
"D:\Documents and Settings\vf.VF-D5864C983A5F\Local Settings\Temp\_tc0\NetChat.exe"="D:\Documents and Settings\vf.VF-D5864C983A5F\Local Settings\Temp\_tc0\NetChat.exe:*:Enabled:NetChat"
"D:\Program Files\Opera\opera.exe"="D:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"D:\Documents and Settings\vf.VF-D5864C983A5F\wptcc.exe"="D:\Documents and Settings\vf.VF-D5864C983A5F\wptcc.exe:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2009-06-16 10:04:10 ----D---- D:\Program Files\trend micro
2009-06-16 10:04:00 ----D---- D:\rsit
2009-06-16 08:43:47 ----D---- D:\WINDOWS\pss
2009-06-11 19:01:21 ----D---- D:\WINDOWS\system32\Adobe
2009-06-11 08:33:12 ----HDC---- D:\WINDOWS\$NtUninstallKB961501$
2009-06-11 08:31:06 ----HDC---- D:\WINDOWS\$NtUninstallKB969897$
2009-06-11 08:30:24 ----HDC---- D:\WINDOWS\$NtUninstallKB969898$
2009-06-11 08:21:41 ----HDC---- D:\WINDOWS\$NtUninstallKB970238$
2009-06-11 08:20:30 ----HDC---- D:\WINDOWS\$NtUninstallKB968537$
2009-05-28 16:26:34 ----A---- D:\WINDOWS\WebIE.dll
2009-05-28 16:26:33 ----A---- D:\WINDOWS\TrnWord.dll
2009-05-28 16:26:31 ----A---- D:\WINDOWS\TrnOutl.dll
2009-05-28 16:26:28 ----A---- D:\WINDOWS\TRNOET.DLL
2009-05-28 16:26:28 ----A---- D:\WINDOWS\TRNOEH.DLL
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe47094969
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe3318418983
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe2079056171
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe1966683688
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe1591299649
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe1219733797
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe1050576431
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn.exe
2009-05-28 16:26:28 ----A---- D:\WINDOWS\oetrn .exe
2009-05-28 16:25:19 ----A---- D:\WINDOWS\WTRDCTM.INI
2009-05-28 16:24:10 ----A---- D:\WINDOWS\UN32P.INI
2009-05-28 16:24:10 ----A---- D:\WINDOWS\UN32.EXE
2009-05-28 16:22:29 ----A---- D:\WINDOWS\MAILTRAN.INI
2009-05-28 16:22:27 ----A---- D:\WINDOWS\TRNCOM.INI
2009-05-28 16:22:18 ----A---- D:\WINDOWS\WTRAN32.INI
2009-05-28 16:22:18 ----A---- D:\WINDOWS\WDICT32.INI
2009-05-28 13:56:17 ----A---- D:\WINDOWS\system32\bwxx.exe
2009-05-28 13:53:13 ----A---- D:\WINDOWS\system32\WinFLsrv.exe
2009-05-28 12:40:35 ----SHD---- D:\Documents and Settings\vf.VF-D5864C983A5F\Data aplikací\.#
2009-05-28 12:40:08 ----D---- D:\Program Files\Folder Lock 6
2009-05-28 12:39:36 ----A---- D:\WINDOWS\Folder Lock 6 Setup Log.txt
2009-05-25 07:51:00 ----HDC---- D:\WINDOWS\$NtUninstallKB925720$
2009-05-24 16:56:14 ----HDC---- D:\WINDOWS\$NtUninstallKB961118$
2009-05-22 12:03:06 ----D---- D:\Documents and Settings\vf.VF-D5864C983A5F\Data aplikací\uniblue
2009-05-22 11:43:47 ----HDC---- D:\Documents and Settings\All Users.WINDOWS\Data aplikací\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-05-22 10:44:59 ----N---- D:\WINDOWS\system32\spmsg2.dll
2009-05-22 10:44:35 ----HDC---- D:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-05-22 10:43:35 ----D---- D:\WINDOWS\system32\cs-CZ
2009-05-22 10:32:45 ----D---- D:\WINDOWS\system32\XPSViewer
2009-05-22 10:31:58 ----D---- D:\WINDOWS\system32\en-US
2009-05-22 10:31:18 ----D---- D:\Program Files\Reference Assemblies
2009-05-22 10:25:49 ----N---- D:\WINDOWS\system32\xpsshhdr.dll
2009-05-22 10:25:49 ----N---- D:\WINDOWS\system32\prntvpt.dll
2009-05-22 10:25:48 ----N---- D:\WINDOWS\system32\xpssvcs.dll
2009-05-22 10:10:55 ----HDC---- D:\WINDOWS\$NtUninstallWIC$
2009-05-22 10:10:19 ----D---- D:\Program Files\MSXML 6.0
2009-05-22 09:51:08 ----RHD---- D:\AHCache

======List of files/folders modified in the last 1 months======

2009-06-16 10:04:10 ----D---- D:\Program Files
2009-06-16 10:04:04 ----D---- D:\WINDOWS\Prefetch
2009-06-16 09:52:26 ----A---- D:\WINDOWS\WINCMD.INI
2009-06-16 09:28:36 ----D---- D:\WINDOWS
2009-06-16 09:26:53 ----HD---- D:\WINDOWS\Temp
2009-06-16 09:23:04 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-06-16 09:20:04 ----A---- D:\WINDOWS\win.ini
2009-06-16 09:20:04 ----A---- D:\WINDOWS\system.ini
2009-06-15 20:03:58 ----A---- D:\WINDOWS\NeroDigital.ini
2009-06-15 10:01:35 ----DC---- D:\WINDOWS\system32\dllcache
2009-06-15 09:45:28 ----D---- D:\WINDOWS\system32\CatRoot2
2009-06-15 09:27:25 ----D---- D:\WINDOWS\system32
2009-06-15 08:37:03 ----SD---- D:\WINDOWS\Tasks
2009-06-14 09:57:46 ----D---- D:\Documents and Settings\vf.VF-D5864C983A5F\Data aplikací\Free Download Manager
2009-06-14 07:40:20 ----D---- D:\Program Files\Eraser
2009-06-14 07:38:10 ----A---- D:\WINDOWS\system32\ctfmon.exe
2009-06-13 12:11:30 ----A---- D:\Documents and Settings\All Users.WINDOWS\Data aplikací\vlc-0.9.9-win32.exe
2009-06-13 09:23:46 ----SHD---- D:\WINDOWS\Installer
2009-06-13 09:23:43 ----D---- D:\Program Files\imeem Uploader
2009-06-13 08:33:54 ----A---- D:\WINDOWS\system32\ctfmon.exe722316251
2009-06-11 19:05:20 ----D---- D:\Documents and Settings\vf.VF-D5864C983A5F\Data aplikací\Adobe
2009-06-11 19:04:57 ----D---- D:\Documents and Settings\vf.VF-D5864C983A5F\Data aplikací\Macromedia
2009-06-11 19:04:47 ----D---- D:\WINDOWS\system32\Macromed
2009-06-11 16:57:52 ----A---- D:\WINDOWS\system32\ctfmon.exe3950226435
2009-06-11 09:00:06 ----A---- D:\WINDOWS\system32\ctfmon.exe732787199
2009-06-11 08:33:32 ----D---- D:\WINDOWS\inf
2009-06-11 08:32:42 ----A---- D:\WINDOWS\imsins.BAK
2009-06-11 08:31:38 ----D---- D:\Program Files\Internet Explorer
2009-06-11 08:30:18 ----HD---- D:\WINDOWS\$hf_mig$
2009-06-01 18:51:12 ----A---- D:\WINDOWS\system32\MRT.exe
2009-05-31 09:28:19 ----A---- D:\WINDOWS\system32\ctfmon.exe3810308101
2009-05-28 13:57:21 ----A---- D:\WINDOWS\system32\ctfmon.exe3832025137
2009-05-24 17:00:39 ----D---- D:\WINDOWS\system32\CatRoot
2009-05-22 12:33:39 ----D---- D:\Program Files\ICQ6Toolbar
2009-05-22 11:13:06 ----RSD---- D:\WINDOWS\assembly
2009-05-22 11:01:47 ----D---- D:\WINDOWS\Microsoft.NET
2009-05-22 10:41:48 ----D---- D:\WINDOWS\system32\mui
2009-05-22 10:38:43 ----D---- D:\WINDOWS\WinSxS
2009-05-22 10:37:31 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2009-05-22 10:32:10 ----D---- D:\Program Files\MSBuild
2009-05-22 10:31:50 ----RSD---- D:\WINDOWS\Fonts
2009-05-22 10:27:20 ----D---- D:\WINDOWS\system32\spool

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; D:\WINDOWS\system32\drivers\Aavmker4.sys [2008-11-26 26944]
R1 aswSP;avast! Self Protection; D:\WINDOWS\system32\drivers\aswSP.sys [2008-11-26 111184]
R1 aswTdi;avast! Network Shield Support; D:\WINDOWS\system32\drivers\aswTdi.sys [2008-11-26 50864]
R1 SASDIFSV;SASDIFSV; \??\C:\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\SASKUTIL.sys []
R1 SbFw;SbFw; D:\WINDOWS\system32\drivers\SbFw.sys [2008-07-16 269736]
R1 sbhips;Sunbelt HIPS Driver; D:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R1 Winhpfile;Winhpfile; \??\C:\rybfumrn\HPFile.sys []
R2 aswFsBlk;aswFsBlk; D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R2 aswMon2;avast! Standard Shield Support; D:\WINDOWS\system32\drivers\aswMon2.sys [2008-11-26 94032]
R2 WinFLdrv;WinFLdrv; D:\WINDOWS\system32\WinFLdrv.sys [2009-05-28 10752]
R2 WinVd32;WinVd32; \??\D:\WINDOWS\system32\WinVd32.sys []
R3 aswRdr;aswRdr; D:\WINDOWS\system32\drivers\aswRdr.sys [2008-11-26 23152]
R3 BthEnum;Ovladač pro Bluetooth Request Block; D:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-04 17024]
R3 BthPan;Bluetooth Device (Personal Area Network); D:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-04 100992]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; D:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-04 18944]
R3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); D:\WINDOWS\system32\drivers\es1371mp.sys [2001-08-17 40704]
R3 G200;G200; D:\WINDOWS\system32\DRIVERS\G200m.sys [2001-10-24 320384]
R3 PCnet;AMD PCNET Compatable Adapter Driver; D:\WINDOWS\system32\DRIVERS\pcntpci5.sys [2001-08-17 35328]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); D:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-04 59648]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; D:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbhub;Rozbočovač umožnující USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); D:\WINDOWS\System32\Drivers\adildr.sys []
S3 adiusbaw;ADSL USB MODEM WAN ADAPTER; D:\WINDOWS\system32\DRIVERS\adiusbaw.sys []
S3 BTHPORT;Ovladač portu Bluetooth; D:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 kvpndev;Kerio VPN adapter; D:\WINDOWS\system32\DRIVERS\kvpndrv.sys [2008-06-24 65024]
S3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer; D:\WINDOWS\system32\DRIVERS\kwflower.sys []
S3 NtApm;Ovladač rozhraní služby NT Apm/Legacy; D:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-10-24 9472]
S3 SASENUM;SASENUM; \??\C:\SASENUM.SYS []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 ACPI;ACPI; D:\WINDOWS\system32\drivers\ACPI.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; E:\avast\aswUpdSv.exe [2008-11-26 18752]
R2 avast! Antivirus;avast! Antivirus; E:\avast\ashServ.exe [2008-11-26 155160]
R2 BthServ;Bluetooth Support Service; D:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 SbPF.Launcher;SbPF.Launcher; D:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-30 95528]
R2 UMWdf;Windows User Mode Driver Framework; D:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; E:\avast\ashMaiSv.exe [2008-11-26 254040]
S2 SPF4;Sunbelt Personal Firewall 4; D:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-30 1361192]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Web Scanner;avast! Web Scanner; E:\avast\ashWebSv.exe [2008-11-26 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; E:\office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 NBService;NBService; E:\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; D:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Dobré poledne
pěkná sbírečka

přes přidat odebrat programy odinstalujte Askbar

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

[Frenki]

Zde je log z Combofix:

ComboFix 09-06-17.02 - vf 18.06.2009 8:26.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.287.106 [GMT 2:00]
Spuštěný z: d:\documents and settings\vf.VF-D5864C983A5F\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081220-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sunbelt Personal Firewall *disabled* {F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}
.
/wow section - STAGE 31
Systém nemůže nalézt uvedenou cestu.


((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\BootSafe.exe
d:\docume~1\VFD41D~1.VF-\LOCALS~1\Temp\MFPL7014.DLL
d:\documents and settings\vf.VF-D5864C983A5F\Local Settings\Temp\MFPL7014.DLL
d:\program files\CMVideoPlugin
d:\windows\system32\basesim32.dll
d:\documents and settings\vf.VF-D5864C983A5F\Local Settings\Temporary Internet Files\SLOVA.WAV
d:\documents and settings\vf.VF-D5864C983A5F\wptcc.exe
d:\windows\kernels8.exe
d:\windows\system32\kr_done1

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-18 do 2009-06-18 )))))))))))))))))))))))))))))))
.

2009-06-16 09:44 . 2009-06-16 09:44 -------- d-----w- d:\documents and settings\LocalService.NT AUTHORITY\Nabídka Start
2009-06-16 08:34 . 2008-12-04 20:15 245760 ----a-w- d:\program files\Uninstall Ask Toolbar.dll
2009-06-16 08:04 . 2009-06-16 08:04 -------- d-----w- d:\program files\trend micro
2009-06-16 08:04 . 2009-06-16 08:05 -------- d-----w- D:\rsit
2009-06-11 17:01 . 2009-06-11 17:02 -------- d-----w- d:\windows\system32\Adobe
2009-05-28 14:26 . 2009-05-28 14:26 491520 ----a-w- d:\windows\WebIE.dll
2009-05-28 14:26 . 2009-05-28 14:26 294912 ----a-w- d:\windows\TrnWord.dll
2009-05-28 14:26 . 2009-05-28 14:26 356352 ----a-w- d:\windows\TrnOutl.dll
2009-05-28 14:26 . 2009-06-14 05:38 23052 ----a-w- d:\windows\oetrn.exe
2009-05-28 14:26 . 2009-05-28 14:26 45056 ----a-w- d:\windows\TRNOEH.DLL
2009-05-28 14:26 . 2009-05-28 14:26 26624 ----a-w- d:\windows\oetrn .exe
2009-05-28 14:26 . 2009-05-28 14:26 200704 ----a-w- d:\windows\TRNOET.DLL
2009-05-28 14:24 . 2009-05-28 14:24 516096 ----a-w- d:\windows\UN32.EXE
2009-05-28 11:56 . 2009-05-28 11:56 29696 ----a-w- d:\windows\system32\bwxx.exe
2009-05-28 11:53 . 2009-05-28 11:53 180224 ----a-w- d:\windows\system32\WinVd32.sys
2009-05-28 11:53 . 2009-05-28 11:53 7680 ----a-w- d:\windows\system32\WinFLsrv.exe
2009-05-28 11:53 . 2009-05-28 11:53 10752 ----a-w- d:\windows\system32\WinFLdrv.sys
2009-05-28 10:40 . 2009-05-28 11:52 -------- d-----w- d:\program files\Folder Lock 6
2009-05-22 08:44 . 2006-06-29 11:07 14048 ------w- d:\windows\system32\spmsg2.dll
2009-05-22 08:43 . 2009-05-22 08:43 -------- d-----w- d:\windows\system32\cs-CZ
2009-05-22 08:32 . 2009-05-22 08:43 -------- d-----w- d:\windows\system32\XPSViewer
2009-05-22 08:31 . 2009-05-22 08:31 -------- d-----w- d:\program files\Reference Assemblies
2009-05-22 08:25 . 2008-07-06 12:06 575488 ------w- d:\windows\system32\xpsshhdr.dll
2009-05-22 08:25 . 2008-07-06 12:06 117760 ------w- d:\windows\system32\prntvpt.dll
2009-05-22 08:25 . 2008-07-06 12:06 1676288 ------w- d:\windows\system32\xpssvcs.dll
2009-05-22 08:10 . 2009-05-22 08:10 -------- d-----w- d:\program files\MSXML 6.0
2009-05-22 07:51 . 2009-05-22 07:51 -------- d--h--r- D:\AHCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 08:32 . 2009-01-12 11:47 -------- d-----w- d:\program files\Share Rapid Uploader
2009-06-15 07:25 . 2008-12-06 06:30 1740 ----a-w- d:\windows\system32\d3d8caps.dat
2009-06-14 05:40 . 2008-12-08 12:10 -------- d-----w- d:\program files\Eraser
2009-06-13 16:20 . 2008-12-08 15:14 1852 ----a-w- d:\windows\system32\d3d9caps.dat
2009-06-13 07:23 . 2009-02-09 09:46 -------- d-----w- d:\program files\imeem Uploader
2009-05-22 10:33 . 2009-04-12 08:31 -------- d-----w- d:\program files\ICQ6Toolbar
2009-05-22 08:37 . 2001-10-25 12:00 83562 ----a-w- d:\windows\system32\perfc005.dat
2009-05-22 08:37 . 2001-10-25 12:00 440812 ----a-w- d:\windows\system32\perfh005.dat
2009-05-22 08:32 . 2008-12-06 16:25 -------- d-----w- d:\program files\MSBuild
2009-05-12 06:24 . 2009-05-12 06:23 -------- d-----w- d:\program files\Common Files\DivX Shared
2009-05-07 15:44 . 2004-08-17 14:49 345088 ----a-w- d:\windows\system32\localspl.dll
2009-05-07 12:34 . 2009-04-12 08:11 -------- d-----w- d:\program files\ICQ6.514_25_11
2009-04-29 04:53 . 2004-08-17 14:49 660480 ----a-w- d:\windows\system32\wininet.dll
2009-04-29 04:53 . 2004-08-17 14:49 81920 ----a-w- d:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-17 14:44 1846656 ----a-w- d:\windows\system32\win32k.sys
2009-04-15 20:25 . 2009-05-12 06:26 9464 ------w- d:\windows\system32\drivers\cdralw2k.sys
2009-04-15 20:25 . 2009-05-12 06:26 9336 ------w- d:\windows\system32\drivers\cdr4_xp.sys
2009-04-15 20:25 . 2009-05-12 06:26 43528 ------w- d:\windows\system32\drivers\PxHelp20.sys
2009-04-15 20:25 . 2009-05-12 06:26 120056 ------w- d:\windows\system32\pxcpyi64.exe
2009-04-15 20:25 . 2009-05-12 06:26 129784 ------w- d:\windows\system32\pxafs.dll
2009-04-15 20:25 . 2009-05-12 06:26 118520 ------w- d:\windows\system32\pxinsi64.exe
2009-04-15 20:24 . 2009-04-15 20:24 90112 ----a-w- d:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- d:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- d:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 ----a-w- d:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 ----a-w- d:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 ----a-w- d:\windows\system32\DivX.dll
2009-04-15 15:18 . 2004-08-17 14:49 584192 ----a-w- d:\windows\system32\rpcrt4.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- d:\program files\opera\program\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- d:\program files\opera\program\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="d:\program files\IncrediMail\bin\IncMail.exe" [2009-02-02 251264]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="e:\avast\ashDisp.exe" [2008-11-26 81000]
"SMail"="d:\program files\Postak\Postak.exe" [2008-02-21 453936]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

d:\documents and settings\vf.VF-D5864C983A5F\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Obsah aplikace OneNote.onetoc2 [2009-3-13 3656]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{DAE0285D-0788-4E87-985E-01DF2EDE4ACD}"= "d:\windows\system32\Wshxt.dll" [2009-02-03 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 10:41 294912 ----a-w- C:\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot04.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwb20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\office\\Office12\\OUTLOOK.EXE"=
"e:\\office\\Office12\\GROOVE.EXE"=
"e:\\office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"d:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"d:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [4.12.2008 15:33 111184]
R1 SASDIFSV;SASDIFSV;C:\sasdifsv.sys [29.2.2008 16:03 8944]
R1 SASKUTIL;SASKUTIL;C:\SASKUTIL.SYS [29.2.2008 16:03 51440]
R1 SbFw;SbFw;d:\windows\system32\drivers\SbFw.sys [28.12.2008 12:29 269736]
R1 sbhips;Sunbelt HIPS Driver;d:\windows\system32\drivers\sbhips.sys [21.6.2008 5:54 66600]
R1 Winhpfile;Winhpfile;c:\rybfumrn\HPFile.sys [3.2.2009 17:30 16601]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [4.12.2008 15:33 20560]
R2 SbPF.Launcher;SbPF.Launcher;d:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [30.7.2008 11:36 95528]
R2 WinFLdrv;WinFLdrv;d:\windows\system32\WinFLdrv.sys [28.5.2009 13:53 10752]
R3 G200;G200;d:\windows\system32\drivers\G200m.sys [4.12.2008 15:34 320384]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;d:\windows\system32\drivers\SbFwIm.sys [28.12.2008 12:29 65576]
S0 Winot04;Winot04;d:\windows\system32\Drivers\Winot04.sys --> d:\windows\system32\Drivers\Winot04.sys [?]
S0 Winwb20;Winwb20;d:\windows\system32\Drivers\Winwb20.sys --> d:\windows\system32\Drivers\Winwb20.sys [?]
S2 ICQ Service;ICQ Service; [x]
S2 SPF4;Sunbelt Personal Firewall 4;d:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [30.7.2008 11:36 1361192]
S3 kvpndev;Kerio VPN adapter;d:\windows\system32\drivers\kvpndrv.sys [24.6.2008 11:36 65024]
S3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;d:\windows\system32\DRIVERS\kwflower.sys --> d:\windows\system32\DRIVERS\kwflower.sys [?]
S3 NtApm;Ovladač rozhraní služby NT Apm/Legacy;d:\windows\system32\drivers\NtApm.sys [4.12.2008 15:36 9472]
S3 SASENUM;SASENUM;C:\SASENUM.SYS [16.2.2006 16:51 4096]
.
Obsah adresáře 'Naplánované úlohy'

2009-06-18 d:\windows\Tasks\RegCure Program Check.job
- e:\regcure\RegCure.exe [2008-11-27 01:11]

2009-06-16 d:\windows\Tasks\RegCure.job
- e:\regcure\RegCure.exe [2008-11-27 01:11]

2009-06-18 d:\windows\Tasks\WGASetup.job
- d:\windows\system32\KB905474\wgasetup.exe [2009-04-01 20:18]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-fsm - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.sznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - e:\office\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://e:\free download manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://e:\free download manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://e:\free download manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://e:\free download manager\dlall.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - d:\windows\WebIE.dll
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-18 08:49
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{05ca3395-d647-4904-b996-193422908c6f}]
@Denied: (Full) (Everyone)
"Model"=dword:00000034
"Therad"=dword:00000012
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,0e,c8,ca,7b,91,
0f,52,51,05,98,32,02,34,2b,da,61,8a,fc,da,94,ae,ab,8b,ad,ab,f0,80,36,44,4c,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0fe10440-d8cb-4393-8d1e-d2a5ee146087}]
@Denied: (Full) (Everyone)
"Model"=dword:00000003
"Therad"=dword:0000001c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e4,1d,af,e3,29,50,9f,78,66,15,fa,a4,0c,9c,0c,0c,9e,88,1c,45,07,
62,c8,e3,ba,2f,07,ff,22,5c,b3,94,a3,80,94,8d,64,5b,0f,a5,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):89,a5,18,53,29,46,60,3d,91,59,8c,d4,d4,50,99,fd,1c,2e,4c,ff,82,
9b,9d,38,d7,38,95,2e,99,8b,36,8c,5b,7d,81,2f,93,ef,1b,06,00,00,00,00,00,00,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(844)
C:\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2212)
d:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\avast\aswUpdSv.exe
e:\avast\ashServ.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\wdfmgr.exe
d:\windows\system32\kernell.dll
e:\avast\ashMaiSv.exe
d:\program files\IncrediMail\bin\ImApp.exe
d:\program files\IncrediMail\bin\ImNotfy.exe
e:\avast\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2009-06-18 9:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-18 07:03

Před spuštěním: 5 652 344 832
Po spuštění: 5 648 273 408

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

232 --- E O F --- 2009-06-11 06:33

[motji]

Dejte soubor otestovat na http://www.virustotal.com
d:\windows\system32\bwxx.exe
d:\windows\oetrn .exe
d:\windows\system32\WinVd32.sys
d:\windows\system32\WinFLsrv.exe
d:\windows\system32\WinFLdrv.sys
d:\windows\system32\Drivers\Winot04.sys
d:\windows\system32\Drivers\Winwb20.sys
Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
Sem vložte link s výsledky.

[Frenki]

http://www.virustotal.com/cs/analisis/1 ... 1245318340
http://www.virustotal.com/cs/analisis/e ... 1245318590
http://www.virustotal.com/cs/analisis/1 ... 1245318716
Zatím posílám tři linky,nevím jestli to dělám dobře u prvního to hlásilo 26 parchantů.

[Frenki]

http://www.virustotal.com/cs/analisis/7 ... 1245319453
http://www.virustotal.com/cs/analisis/7 ... 1245319634
zbývající dva pc nenašel

[motji]

ještě prosím otestujte tento subor
d:\windows\system32\kernell.dll

O hlídacím psovi v pc asi víte ?

[motji]

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

KillAll::
File:: 
d:\windows\system32\bwxx.exe
d:\windows\system32\Drivers\Winot04.sys
d:\windows\system32\Drivers\Winwb20.sys
d:\windows\system32\kernell.dll
d:\windows\system32\d3d8caps.dat
d:\windows\system32\d3d9caps.dat

Registry:: 
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot04.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwb20.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Winot04.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Winwb20.sys]

Driver:: 
Winot04
Winwb20
ICQ Service

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[Frenki]

http://www.virustotal.com/cs/analisis/5 ... 1245320920
JJ hlídacího psa jsem instaloval

[motji]

Pak je to v pořádku
Provedte skript co je o příspěvek výš

[Frenki]

Provedl jsem,Combo se spustil,pak zmizel,tak asi běží,poprvé běžel asi půl hodiny.Já musím ve čtvrt na dvě do práce.Když do té doby skončí,pošlu log a pokračovali by jsme zýtra zatím moc dík. Frenki

[Frenki]

Takže provedeno. Povedlo se až na potřetí poprvé PC zkolaboval,podruhé došlo k vyjímce,potřetí jsem povolil aktualizaci CF a je to tu:

ComboFix 09-06-18.02 - vf 19.06.2009 9:45.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.287.123 [GMT 2:00]
Spuštěný z: d:\documents and settings\vf.VF-D5864C983A5F\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\vf.VF-D5864C983A5F\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 081220-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sunbelt Personal Firewall *disabled* {F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}

FILE ::
"d:\windows\system32\bwxx.exe"
"d:\windows\system32\d3d8caps.dat"
"d:\windows\system32\d3d9caps.dat"
"d:\windows\system32\Drivers\Winot04.sys"
"d:\windows\system32\Drivers\Winwb20.sys"
"d:\windows\system32\kernell.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service
-------\Service_Winot04
-------\Service_Winwb20


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-19 do 2009-06-19 )))))))))))))))))))))))))))))))
.

2009-06-16 09:44 . 2009-06-16 09:44 -------- d-----w- d:\documents and settings\LocalService.NT AUTHORITY\Nabídka Start
2009-06-16 08:34 . 2008-12-04 20:15 245760 ----a-w- d:\program files\Uninstall Ask Toolbar.dll
2009-06-16 08:04 . 2009-06-16 08:04 -------- d-----w- d:\program files\trend micro
2009-06-16 08:04 . 2009-06-16 08:05 -------- d-----w- D:\rsit
2009-06-11 17:01 . 2009-06-11 17:02 -------- d-----w- d:\windows\system32\Adobe
2009-05-28 14:26 . 2009-05-28 14:26 491520 ----a-w- d:\windows\WebIE.dll
2009-05-28 14:26 . 2009-05-28 14:26 294912 ----a-w- d:\windows\TrnWord.dll
2009-05-28 14:26 . 2009-05-28 14:26 356352 ----a-w- d:\windows\TrnOutl.dll
2009-05-28 14:26 . 2009-06-14 05:38 23052 ----a-w- d:\windows\oetrn.exe
2009-05-28 14:26 . 2009-05-28 14:26 45056 ----a-w- d:\windows\TRNOEH.DLL
2009-05-28 14:26 . 2009-05-28 14:26 26624 ----a-w- d:\windows\oetrn .exe
2009-05-28 14:26 . 2009-05-28 14:26 200704 ----a-w- d:\windows\TRNOET.DLL
2009-05-28 14:24 . 2009-05-28 14:24 516096 ----a-w- d:\windows\UN32.EXE
2009-05-28 11:53 . 2009-05-28 11:53 180224 ----a-w- d:\windows\system32\WinVd32.sys
2009-05-28 11:53 . 2009-05-28 11:53 7680 ----a-w- d:\windows\system32\WinFLsrv.exe
2009-05-28 11:53 . 2009-05-28 11:53 10752 ----a-w- d:\windows\system32\WinFLdrv.sys
2009-05-28 10:40 . 2009-05-28 11:52 -------- d-----w- d:\program files\Folder Lock 6
2009-05-22 08:44 . 2006-06-29 11:07 14048 ------w- d:\windows\system32\spmsg2.dll
2009-05-22 08:43 . 2009-05-22 08:43 -------- d-----w- d:\windows\system32\cs-CZ
2009-05-22 08:32 . 2009-05-22 08:43 -------- d-----w- d:\windows\system32\XPSViewer
2009-05-22 08:31 . 2009-05-22 08:31 -------- d-----w- d:\program files\Reference Assemblies
2009-05-22 08:25 . 2008-07-06 12:06 575488 ------w- d:\windows\system32\xpsshhdr.dll
2009-05-22 08:25 . 2008-07-06 12:06 117760 ------w- d:\windows\system32\prntvpt.dll
2009-05-22 08:25 . 2008-07-06 12:06 1676288 ------w- d:\windows\system32\xpssvcs.dll
2009-05-22 08:10 . 2009-05-22 08:10 -------- d-----w- d:\program files\MSXML 6.0
2009-05-22 07:51 . 2009-05-22 07:51 -------- d--h--r- D:\AHCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 08:32 . 2009-01-12 11:47 -------- d-----w- d:\program files\Share Rapid Uploader
2009-06-14 05:40 . 2008-12-08 12:10 -------- d-----w- d:\program files\Eraser
2009-06-13 07:23 . 2009-02-09 09:46 -------- d-----w- d:\program files\imeem Uploader
2009-05-22 10:33 . 2009-04-12 08:31 -------- d-----w- d:\program files\ICQ6Toolbar
2009-05-22 08:37 . 2001-10-25 12:00 83562 ----a-w- d:\windows\system32\perfc005.dat
2009-05-22 08:37 . 2001-10-25 12:00 440812 ----a-w- d:\windows\system32\perfh005.dat
2009-05-22 08:32 . 2008-12-06 16:25 -------- d-----w- d:\program files\MSBuild
2009-05-12 06:24 . 2009-05-12 06:23 -------- d-----w- d:\program files\Common Files\DivX Shared
2009-05-07 15:44 . 2004-08-17 14:49 345088 ----a-w- d:\windows\system32\localspl.dll
2009-05-07 12:34 . 2009-04-12 08:11 -------- d-----w- d:\program files\ICQ6.514_25_11
2009-04-29 04:53 . 2004-08-17 14:49 660480 ----a-w- d:\windows\system32\wininet.dll
2009-04-29 04:53 . 2004-08-17 14:49 81920 ----a-w- d:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-17 14:44 1846656 ----a-w- d:\windows\system32\win32k.sys
2009-04-15 20:25 . 2009-05-12 06:26 9464 ------w- d:\windows\system32\drivers\cdralw2k.sys
2009-04-15 20:25 . 2009-05-12 06:26 9336 ------w- d:\windows\system32\drivers\cdr4_xp.sys
2009-04-15 20:25 . 2009-05-12 06:26 43528 ------w- d:\windows\system32\drivers\PxHelp20.sys
2009-04-15 20:25 . 2009-05-12 06:26 120056 ------w- d:\windows\system32\pxcpyi64.exe
2009-04-15 20:25 . 2009-05-12 06:26 129784 ------w- d:\windows\system32\pxafs.dll
2009-04-15 20:25 . 2009-05-12 06:26 118520 ------w- d:\windows\system32\pxinsi64.exe
2009-04-15 20:24 . 2009-04-15 20:24 90112 ----a-w- d:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- d:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- d:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 ----a-w- d:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 ----a-w- d:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 ----a-w- d:\windows\system32\DivX.dll
2009-04-15 15:18 . 2004-08-17 14:49 584192 ----a-w- d:\windows\system32\rpcrt4.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- d:\program files\opera\program\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- d:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-06-19_07.19.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-19 08:02 . 2009-06-19 08:02 16384 d:\windows\Temp\Perflib_Perfdata_774.dat
+ 2009-06-19 08:03 . 2009-06-19 08:03 16384 d:\windows\Temp\Perflib_Perfdata_580.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="d:\program files\IncrediMail\bin\IncMail.exe" [2009-02-02 251264]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="e:\avast\ashDisp.exe" [2008-11-26 81000]
"SMail"="d:\program files\Postak\Postak.exe" [2008-02-21 453936]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

d:\documents and settings\vf.VF-D5864C983A5F\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Obsah aplikace OneNote.onetoc2 [2009-3-13 3656]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{DAE0285D-0788-4E87-985E-01DF2EDE4ACD}"= "d:\windows\system32\Wshxt.dll" [2009-02-03 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 10:41 294912 ----a-w- C:\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\office\\Office12\\OUTLOOK.EXE"=
"e:\\office\\Office12\\GROOVE.EXE"=
"e:\\office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"d:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"d:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"d:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [4.12.2008 15:33 111184]
R1 SASDIFSV;SASDIFSV;C:\sasdifsv.sys [29.2.2008 16:03 8944]
R1 SASKUTIL;SASKUTIL;C:\SASKUTIL.SYS [29.2.2008 16:03 51440]
R1 SbFw;SbFw;d:\windows\system32\drivers\SbFw.sys [28.12.2008 12:29 269736]
R1 sbhips;Sunbelt HIPS Driver;d:\windows\system32\drivers\sbhips.sys [21.6.2008 5:54 66600]
R1 Winhpfile;Winhpfile;c:\rybfumrn\HPFile.sys [3.2.2009 17:30 16601]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [4.12.2008 15:33 20560]
R2 SbPF.Launcher;SbPF.Launcher;d:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [30.7.2008 11:36 95528]
R2 WinFLdrv;WinFLdrv;d:\windows\system32\WinFLdrv.sys [28.5.2009 13:53 10752]
R3 G200;G200;d:\windows\system32\drivers\G200m.sys [4.12.2008 15:34 320384]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;d:\windows\system32\drivers\SbFwIm.sys [28.12.2008 12:29 65576]
S2 SPF4;Sunbelt Personal Firewall 4;d:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [30.7.2008 11:36 1361192]
S3 kvpndev;Kerio VPN adapter;d:\windows\system32\drivers\kvpndrv.sys [24.6.2008 11:36 65024]
S3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;d:\windows\system32\DRIVERS\kwflower.sys --> d:\windows\system32\DRIVERS\kwflower.sys [?]
S3 NtApm;Ovladač rozhraní služby NT Apm/Legacy;d:\windows\system32\drivers\NtApm.sys [4.12.2008 15:36 9472]
S3 SASENUM;SASENUM;C:\SASENUM.SYS [16.2.2006 16:51 4096]
.
Obsah adresáře 'Naplánované úlohy'

2009-06-19 d:\windows\Tasks\RegCure Program Check.job
- e:\regcure\RegCure.exe [2008-11-27 01:11]

2009-06-16 d:\windows\Tasks\RegCure.job
- e:\regcure\RegCure.exe [2008-11-27 01:11]

2009-06-19 d:\windows\Tasks\WGASetup.job
- d:\windows\system32\KB905474\wgasetup.exe [2009-04-01 20:18]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.sznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - e:\office\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://e:\free download manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://e:\free download manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://e:\free download manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://e:\free download manager\dlall.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - d:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - d:\windows\WebIE.dll
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 10:05
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


d:\docume~1\VFD41D~1.VF-\LOCALS~1\Temp\Perflib_Perfdata_55c.dat 16384 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{05ca3395-d647-4904-b996-193422908c6f}]
@Denied: (Full) (Everyone)
"Model"=dword:00000034
"Therad"=dword:00000012
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,0e,c8,ca,7b,91,
0f,52,51,05,98,32,02,34,2b,da,61,8a,fc,da,94,ae,ab,8b,ad,ab,f0,80,36,44,4c,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0fe10440-d8cb-4393-8d1e-d2a5ee146087}]
@Denied: (Full) (Everyone)
"Model"=dword:00000003
"Therad"=dword:0000001c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e4,1d,af,e3,29,50,9f,78,66,15,fa,a4,0c,9c,0c,0c,9e,88,1c,45,07,
62,c8,e3,ba,2f,07,ff,22,5c,b3,94,a3,80,94,8d,64,5b,0f,a5,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):89,a5,18,53,29,46,60,3d,91,59,8c,d4,d4,50,99,fd,1c,2e,4c,ff,82,
9b,9d,38,d7,38,95,2e,99,8b,36,8c,5b,7d,81,2f,93,ef,1b,06,00,00,00,00,00,00,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(844)
C:\SASWINLO.dll

- - - - - - - > 'explorer.exe'(480)
d:\windows\system32\msi.dll
d:\windows\system32\shdoclc.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\avast\aswUpdSv.exe
e:\avast\ashServ.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\wdfmgr.exe
e:\avast\ashMaiSv.exe
d:\program files\IncrediMail\bin\ImApp.exe
d:\program files\IncrediMail\bin\ImNotfy.exe
d:\windows\system32\wscntfy.exe
e:\avast\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2009-06-19 10:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-19 08:19
ComboFix2.txt 2009-06-18 07:03

Před spuštěním: 5 237 354 496
Po spuštění: 5 227 880 448

230 --- E O F --- 2009-06-11 06:33

[motji]

Jak to vypadá s pc?

[Frenki]

No řekl bych že běží daleko lépe

[motji]

Odinstalujte combofix přes
Start >> Spustit zkopírujte do okénka:

ComboFix /u

stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir

Stáhněte Ccleaner,viz můj podpis
-nainstalujte a vyčištěte dočasné soubory, i registry


Klikněte mi do podpisu na SVI a podle návodu zapněte a vypněte obnovu systému, někdy se tam viry schovávají

Vložte nový log ze RSIT a řekněte co počítač,jak se chová,už je vše v pořádku?

Vyčištěte cache prohlížeče

Udělejte sken se SAS, viz můj podpis