RSIT log prosím kontrolu!!

[Hnizdo]

http://www.virustotal.com/cs/analisis/1 ... 1256501789

[Hnizdo]

http://www.virustotal.com/cs/analisis/1 ... 1256501789


Nenalezeno
c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\Bux.to Autoclicker.lnk

[motji]

ty soubory co jste testoval jako první jste testoval až po skriptu na combofix?
Vy máte v pc web cureit?

[Hnizdo]

Ano až po criptu

[Hnizdo]

pc web cureit

Není to Dr.Web?

[motji]

Ano, je. Jestli ho máte v pc, udělejte sken

[Hnizdo]

Nic nenašlo!

[motji]

Když smažu tyto infikované soubory, můžete ty programy přeinstalovat, není to problém?
c:\program files\adobe\acrotray.exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier.exe
c:\program files\Microsoft Office\Office12\groovemonitor.exe
c:\program files\Systweak\Advanced System Protector\asp.exe

[Hnizdo]

Klidne!

[motji]

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

File::
c:\program files\adobe\acrotray.exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier.exe
c:\program files\Microsoft Office\Office12\groovemonitor.exe
c:\program files\Systweak\Advanced System Protector\asp.exe
c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\Bux.to Autoclicker.lnk

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[Hnizdo]

ComboFix 10-01-04.01 - Doma 14.01.2010 16:31:43.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.718 [GMT 1:00]
Spuštěný z: d:\mat\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Doma\Plocha\CFScript.txt
FW: Kaspersky Anti-Hacker *disabled* {0BB8CA15-F396-46C7-9A59-108D852CFEC0}
SP: Spy Emergency *disabled* (Updated) {773EE130-7EFF-422a-B0FB-8A71604A2FF9}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -

FILE ::
"c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\Bux.to Autoclicker.lnk"
"c:\program files\adobe\acrotray.exe"
"c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier.exe"
"c:\program files\Microsoft Office\Office12\groovemonitor.exe"
"c:\program files\Systweak\Advanced System Protector\asp.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier.exe
c:\program files\Microsoft Office\Office12\groovemonitor.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-14 do 2010-01-14 )))))))))))))))))))))))))))))))
.

2010-01-08 19:23 . 2010-01-13 20:42 2 ----a-w- c:\windows\system32\Dvbpws.dll
2010-01-08 16:22 . 2010-01-08 16:22 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-06 21:40 . 2010-01-07 14:50 -------- d-----w- c:\documents and settings\Doma\DoctorWeb
2010-01-05 15:08 . 2010-01-05 15:08 -------- d-----w- C:\rsit
2010-01-04 18:50 . 2010-01-04 18:50 -------- d-----w- c:\program files\Apple Software Update
2010-01-04 18:50 . 2010-01-04 18:50 -------- d-----w- c:\program files\Common Files\Apple
2010-01-04 18:19 . 2010-01-04 19:32 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-12-27 12:38 . 2009-12-27 12:38 -------- d-----w- c:\documents and settings\Doma\PartyPoker_Installer
2009-12-25 11:12 . 2009-12-25 11:12 -------- d-----w- C:\Casino
2009-12-24 17:38 . 2009-12-24 17:38 -------- d-----w- c:\program files\Western Digital
2009-12-24 17:36 . 2009-02-13 11:02 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys
2009-12-24 10:14 . 2009-12-24 10:15 -------- d-----w- c:\program files\10Pips
2009-12-19 10:38 . 2009-12-19 10:38 -------- d-----w- c:\program files\Symantec
2009-12-19 10:37 . 2009-10-01 21:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys
2009-12-19 10:36 . 2009-09-21 19:20 138592 ----a-w- c:\windows\system32\drivers\symsnap.sys
2009-12-19 10:36 . 2009-09-21 19:40 15096 ----a-w- c:\windows\system32\drivers\vproeventmonitor.sys
2009-12-19 10:35 . 2009-05-18 13:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-19 10:35 . 2008-04-17 12:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-12-19 10:35 . 2009-12-19 10:38 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-19 10:04 . 2008-11-10 09:48 17408 ----a-w- c:\windows\system32\SyncBackPro.dll
2009-12-19 10:04 . 2009-01-12 07:15 71096 ----a-w- c:\windows\system32\NMSAccessU.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 16:11 . 2008-11-08 11:27 -------- d-----w- c:\program files\Lx_cats
2010-01-08 18:14 . 2009-11-04 14:58 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-07 20:17 . 2008-08-17 10:23 -------- d-----w- c:\program files\Bonjour
2010-01-07 17:17 . 2009-03-29 08:24 -------- d-----w- c:\program files\SweetIM
2010-01-06 21:23 . 2009-07-06 16:58 -------- d-----w- c:\program files\Windows Defender
2010-01-06 21:23 . 2009-11-19 17:39 -------- d-----w- c:\program files\Hide The IP
2010-01-05 16:15 . 2009-03-09 19:15 -------- d-----w- c:\program files\ICQ6.5
2010-01-05 15:08 . 2008-08-10 19:53 -------- d-----w- c:\program files\Trend Micro
2009-12-27 12:57 . 2009-01-16 16:21 -------- d-----w- c:\program files\PokerStars
2009-12-19 10:36 . 2009-12-19 10:36 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_GenericMount_01009.Wdf
2009-12-19 10:36 . 2009-12-19 10:36 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2009-12-10 04:27 . 2001-10-25 12:00 79062 -c--a-w- c:\windows\system32\perfc005.dat
2009-12-10 04:27 . 2001-10-25 12:00 432004 -c--a-w- c:\windows\system32\perfh005.dat
2009-11-27 16:33 . 2009-11-27 14:58 -------- d-----w- c:\program files\ArcaBit
2009-11-21 16:03 . 2004-08-17 14:49 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 14:32 . 2009-11-21 14:32 -------- d-----w- c:\program files\Common Files\Protexis
2009-11-14 18:01 . 2009-11-14 18:01 8704 ----a-w- c:\windows\system32\SpOrder.dll
2009-11-02 19:42 . 2009-10-03 11:15 195456 -c----w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:43 . 2004-08-17 14:49 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-17 14:49 75776 -c--a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-17 14:49 25088 -c--a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 22:00 265728 -c--a-w- c:\windows\system32\drivers\http.sys
2008-03-09 05:25 . 2009-06-20 09:41 236 -c-ha-w- c:\program files\Common Files\dx.reg
2007-11-09 14:25 . 2008-08-04 11:35 57344 -c--a-w- c:\program files\mozilla firefox\components\MGSHelper.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-01-06_15.27.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-14 15:12 . 2010-01-14 15:12 16384 c:\windows\temp\Perflib_Perfdata_79c.dat
+ 2001-10-25 12:00 . 2009-10-15 16:32 81920 c:\windows\system32\fontsub.dll
- 2001-10-25 12:00 . 2009-06-16 14:40 81920 c:\windows\system32\fontsub.dll
- 2001-10-25 12:00 . 2009-06-16 14:40 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2001-10-25 12:00 . 2009-10-15 16:32 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2010-01-08 18:15 . 2010-01-08 18:15 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2010-01-08 18:15 . 2010-01-08 18:15 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-01-08 18:15 . 2010-01-08 18:15 5120 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
- 2004-08-17 14:49 . 2009-06-16 14:40 119808 c:\windows\system32\t2embed.dll
+ 2004-08-17 14:49 . 2009-10-15 16:32 119808 c:\windows\system32\t2embed.dll
- 2004-08-17 14:49 . 2009-06-16 14:40 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2004-08-17 14:49 . 2009-10-15 16:32 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2004-08-17 14:49 . 2009-11-21 16:03 471552 c:\windows\system32\dllcache\aclayers.dll
+ 2009-11-01 15:04 . 2010-01-13 15:04 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-12-03 13:15 . 2009-12-03 13:15 5004288 c:\windows\Installer\626ad9.msp
+ 2010-01-08 18:15 . 2010-01-08 18:15 1583616 c:\windows\Installer\266106.msi
- 2009-11-01 15:04 . 2009-12-09 18:40 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-11-01 15:04 . 2009-12-09 18:40 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-11-01 15:04 . 2010-01-13 15:04 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-07-23 16:17 . 2010-01-05 00:17 29634504 c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\backupiconoverlayid]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2008-11-13 15:04 238968 ----a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Doma\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-11-14 592]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-05 2002160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"LXBXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll" [2004-11-02 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-10-14 9085760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- d:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0sasnative32

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Doma^Nabídka Start^Programy^Po spuštění^Bux.to Autoclicker.lnk]
path=c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\Bux.to Autoclicker.lnk
backup=c:\windows\pss\Bux.to Autoclicker.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Doma^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.1.lnk]
path=c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Doma^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Doma\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:22 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
2003-09-17 08:43 57344 -c--a-w- c:\program files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-04 15:01 486856 -c--a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-14 06:37 592 ----a-w- c:\documents and settings\Doma\Local Settings\Data aplikací\Google\Update\googleupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-11-16 15:36 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
2007-09-07 13:44 3100672 -c--a-w- c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 12:01 86016 -c--a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 12:01 1630208 -c--a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
2004-11-08 08:22 60928 -c--a-w- c:\windows\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-12-03 11:47 1205760 -c--a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-07 15:15 348160 -c--a-w- c:\program files\WinFast\WFDTV\WFWIZ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
2006-07-11 14:10 69632 -c--a-w- c:\program files\WinFast\WFDTV\DTVSchdl.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"d:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"d:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"d:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"d:\\Program Files\\Postal 10th\\System\\Postal2.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"d:\\Program Files\\Nero\\Nero 9\\Nero ShowTime\\ShowTime.exe"=
"d:\\Program Files\\FlashGet Network\\FlashGet universal\\flashget .exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Casino\\ParadiseCasino\\casino.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8971:TCP"= 8971:TCP:BitComet 8971 TCP
"8971:UDP"= 8971:UDP:BitComet 8971 UDP
"21155:TCP"= 21155:TCP:BitComet 21155 TCP
"21155:UDP"= 21155:UDP:BitComet 21155 UDP
"12404:TCP"= 12404:TCP:BitComet 12404 TCP
"12404:UDP"= 12404:UDP:BitComet 12404 UDP
"50001:TCP"= 50001:TCP:ArcaVir CommunicationPort (S)
"50000:TCP"= 50000:TCP:ArcaVir CommunicationPort (A)

R0 Klpf;Klpf;c:\windows\system32\drivers\Klpf.sys [4.8.2005 16:19 25139]
R0 Klpid;Klpid;c:\windows\system32\drivers\Klpid.sys [4.8.2005 16:19 31862]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [5.1.2010 7:56 9968]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5.1.2010 7:56 74480]
R1 wfcxacap;WinFast TV PCI Audio Capture Driver;c:\windows\system32\drivers\wfcxacap.sys [24.3.2006 8:20 9856]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [9.3.2009 20:17 222456]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17.4.2007 20:09 11032]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [14.10.2009 14:31 98304]
R2 wfcxatun;WinFast TV Analog Tuner Driver;c:\windows\system32\drivers\wfcxatun.sys [24.3.2006 8:24 31616]
R2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\system32\drivers\wfcxvcap.sys [24.3.2006 8:25 167296]
R3 ABndisMP;ABndisMP;c:\windows\system32\drivers\abndis.sys [27.11.2009 15:59 34312]
R3 GenericMount;Generic Mount Driver;c:\windows\system32\drivers\GenericMount.sys [21.9.2009 20:26 46192]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\system32\drivers\wfcxdtun.sys [24.3.2006 8:23 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\system32\drivers\wfcxtcap.sys [24.3.2006 8:21 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\system32\drivers\wfcxxbar.sys [24.3.2006 8:22 10368]
S2 FlexService;Remote Connections Service;D:\cisvc.exe [17.5.2009 4:16 41984]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 9:58 20480]
S3 4879C;4879C;c:\windows\system32\4879C.sys [12.8.2009 7:47 54624]
S3 ABndis;ABndis Service;c:\windows\system32\drivers\abndis.sys [27.11.2009 15:59 34312]
S3 ATE_PROCMON;ATE_PROCMON;d:\program files\Anti Trojan Elite\ATEPMON.sys [4.11.2009 15:02 5969]
S3 BCASPROT;Advanced System Protector;c:\program files\Systweak\Advanced System Protector\sasprot32.sys [14.11.2009 11:41 6656]
S3 GenericMount Helper Service;GenericMount Helper Service;"d:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe" --> d:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [24.12.2008 17:46 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [24.12.2008 17:46 8320]
S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [24.12.2008 21:03 32377]
S3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [5.1.2010 7:56 7408]
S3 SymSnapService;SymSnapService;"d:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe" --> d:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [?]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [12.3.2009 12:51 548864]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [24.12.2009 18:36 11520]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [19.7.2008 17:50 9446]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8.1.2010 17:22 691696]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75e7b3ff-f05d-11de-b271-001109ed7bee}]
\Shell\AutoRun\command - "F:\WD SmartWare.exe" autoplay=true
.
Obsah adresáře 'Naplánované úlohy'

2010-01-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:37]

2010-01-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-01-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-01 13:21]

2010-01-14 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:37]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = about:blank
uInternet Settings,ProxyServer = 127.0.0.1:8080
uInternet Settings,ProxyOverride = local
IE: &Download All by FlashGet - d:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
IE: &Download by FlashGet - d:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\AdsGone\AdsGone
IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} - {40525A66-DB98-480D-BCF9-7AF88C1AF438} -
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Doma\Data aplikací\Mozilla\Firefox\Profiles\slqp0fm9.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\components\MGSHelper.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: d:\program files\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\program files\DivX\DivX Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
FF - user.js: network.proxy.http_port - 0
FF - user.js: network.proxy.ssl -
FF - user.js: network.proxy.ssl_port - 0
FF - user.js: network.proxy.ftp -
FF - user.js: network.proxy.ftp_port - 0
FF - user.js: network.proxy.gopher -
FF - user.js: network.proxy.gopher_port - 0
FF - user.js: network.proxy.socks_version - 5
FF - user.js: network.proxy.socks -
FF - user.js: network.proxy.socks_port - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-14 16:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,55,dc,84,45,6e,bf,4b,a4,4a,a1,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,55,dc,84,45,6e,bf,4b,a4,4a,a1,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d44da31f-1b91-4186-a802-3464d2e01717}]
@Denied: (Full) (Everyone)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="B75046FBC4D24AB58EAF99BF0D63E55164E64101B26B3C6C800D2585098C21E334EC25E66F090F78BAE965551D7C0C14DF7DD662AD9BE2A101C1986287832EEFD60C2B5796A22DAC1495F073C7A46D69CFB7FAA463FB4631C337ACB3B06C1DAFD81B2CF4E6357E66021BA103F73C8BF46898498F1D572A71EBA8D1C2461B95C76A2E8D28413C313AE087F42DC907365D53447430D65AA4B78EF28F1DC2C394E2AEFB4CA03D18C74381887BE292AD164FAD0242D4BE1824E33519FE92D0826B2FBBDEF6CF220C1721A67459D5D63B25F888C00B93B804E5D45F3F50B95255BF5C1D56B1EB6EBE497609C1457E53A2338FE8113D435BF8FE6FFDFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667BA7FD869164D67945D575E7D6A3B9808BCC7DA64AC511DA6ADB56BB6E2876555C9B432FEF2C4D3A653B2251442AB32B38FB34F15AA7C395E3C5EA27BC5D266CA1ADA5804BDA9DFAF0B87DA5B2C3AEDEC37F5C8AC8E9B8001CB3E80EB4D44C3BB449CC183C64CCBD2C4635640F489C4B704BC561E23753DC946B975D7A9E77B5169326049489C65C67B75A9AB029075F769CD4B119125406CB8CB3541701D0EA94EEAE8D661DFFE384D022A391818C1840000BEDE6D195C8CD27FB6E09A177FD65D29D560932E6C45FC5EF3BC653FF12B03BE8B162815E9426BF738A1855ED75FA4E2624EC5758900F2F764BB7676CE2CD30D50F99C2F459CF8E938A2F2CEA5BCD5A111BDC2F4B171B9CB1D6D410528BAF3FC710005D14C1C9A9D7C39081877DC480626FD38C24893FD6F85411C8251FD0E39955304BCE3348F720B6B4F3E63A273BFAB93B8C5B1D49588C6D8C1DD1F13EA7B28539C81F24F3E57B0F5349802637796EEB8BBBDD8987553CE0952596D0A7D15D711B708644BAE537F460952EFE8146380D81A392BB6B99ECFDBD10A9A66D6699853A1092B760E7FC88184EB4D723196B514939D997A9F4E400EA6D909A031F220948A96B7982D88A700BDB93EB0D730A6BFC8A39AA00C59DA921C879FA3E7BB6A04071102E8012FF5CAB3E2EC4A3549326442D8A65E054A1D0C622349D17965B6040FB0071622CAD323C66385599C8978BD681CBCD936C149578C93F3FD8BA309AB7FFEC63E4D4227FCBD8AB7EB8330DE3D0BA45D2EECF1E4011392136E653FA6C3985AC2F9649417FD41FB3903838E8F07DC790FEA1D21BBC9CE2E9DE1F2931C4C007784D0EA528F035EB0C1955A0DF5F2F2F75A125DADDAA701C68C07C31238F7BB5B163F0C9F419B07738F0E6A24440EC8D0CE1C690594434D135F820C3E0EACB9E209B612B89F8B8FE4624939E2EE99BA88FC729EA9FDFBB91D9AEAA330F384CA3A6F1CEEE7E349B2F6FD1BF16B30890EF8F9"
"OODEFRAG11.00.00.01WORKSTATION"="85609E2972F9A1F731214CAD294D808F770B1A4B30A0972EB44109C66AC7F7E93B8CF4E3884010DBA37256A15BA8AD002E99943D439123E52D7BE7919D986635856BD0BBD1D35575BDEA91136591F839994ECA731F606584CC2E94D5C46D1F14B6AF38355C339AEB30996F4E8273C3B66CB4379F520499F7E581B0C7DFEAD68B60C098ACB4CE2E766EC2C4F172AB16079A0EB7C5EE689FC58F55C572EFAA64B4D83843CFF18A7EE4B0DC4B73FBFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667C038D530D6EB3452A6A0AC4980AC7933A91EF5081B7A81F8C46A2B400A9F1595A2775BDB96977E63B13574D88307120CECC36678463D3856886C3615A4799F80E82AD97E13344B9F77CB6C69E80EE59CB593AE68E8B871B4B1FBD20413FD3617BE7B25504950128204DF762143ED9186D2BD5B47551453405EE3455B03C0C335ADEAD6A16585A5BA6CCD20F45A69E969899594C7915BD8289F10E6B059B6883D32209C08485229F7BE140C992E28196712129161D8FE50A0F91124DA2E389892BF64BADB089A167177D5F3896D351CA796D01D509954DD61669C80F6CA84DB9F3D25053CEA22B8DF0B5921020000C5D23911199176927625520B0F65B03B8E4E02F46708EE16B101DF8974077E5CBB9A8CB6F86A465665AB1F597AC993633E115E0ADFE543837696D1F5DF5C3601772F1A49C56092A1C9B9A0287F8BD8E450DC13BD803F4EDC50E6ADD16A0E298A47475C759A3F1AD61717A0BCEFD89E0EFCA9570E6E402877DABA3972316A8CF74B1F440A2A164FBE938DDC01B01F3210CFF3539C655A9B108760AAD36202CAAB7CF4B4FBB5385A07596E85003A95197F28BDA72FB3422B4399A92C95402BFEEE210A8762173D933ED78C406C9A3289573989E3B03B720A94AC6B5D78A3017D6AD82708F9BA7F8ADA5140A4987331EEF40CE010AEF226A2692B00D0E577624B309416F5A19F9D02B2DC65C080F99369977BD1A45A64600E8CD6448E66BA6F9FB11CA3845FDBFC7005E55A96BE771E4C66386A100A2DE420ADC49A8FAA008F6A4886255D5896C17F702A831995C7579F6A44423538803EDCDCDCE74685F06D4C2EC2EF9C5A0C5A0EF93D48B2695D0B9E1179EE6981A4B8FB12DB1712EBC5F51C03935FCFD38DF22F888515BF42BE4CB7AC8210F529F36569A75395CCFACF5B61C98D517DDA7E012A6BBD5812CE82EC10F060C39A94DB1AC6DAA7D3BFF072145A6A1BA81E24563A77D074076EDED705FE78E4AF884CDFEE68CF12C82BB0A25B78AFF84C9A0FA29947CD8D970D6780F18EBF38FCE40195C1560B1F6C41C0EEADE1C939A6D5990560FA5A3E861B024F527F29D7D84B8227334D782F3E294C744EEF4BC22622E7AD"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(388)
d:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Celkový čas: 2010-01-14 16:35:44
ComboFix-quarantined-files.txt 2010-01-14 15:35
ComboFix2.txt 2010-01-08 17:39
ComboFix3.txt 2010-01-07 17:26
ComboFix4.txt 2010-01-06 21:37
ComboFix5.txt 2010-01-14 15:31

Před spuštěním: 884 862 976
Po spuštění: 855 900 160

- - End Of File - - D6D9D2DC4B100F9079DA7E5E4538AE53

[motji]

Jak to ted vypadá s počítačem?

[Hnizdo]

Pohodička šlape jako hodinky!!!!!

Už žádne samovyskakovací okna

[motji]

Odinstalujte combofix přes
Start >> Spustit zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.



Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir


Stahněte TFC a použijte
TFC (http://oldtimer.geekstogo.com/TFC.exe)


Stáhněte Ccleaner,viz můj podpis
-nainstalujte a vyčištěte dočasné soubory, i registry

Vložte nový log ze RSIT a řekněte co počítač,jak se chová,už je vše v pořádku?