Proím o kontolu loga

[wachtel]

Dobrý večer.
Již jsem přeinstaloval systém,Firefox,mám legální AVG a stále při otevírání stránek internetu
8 z 10 jde otevřít až po několikátém odkpepnutí.Prosím o kontrolu loga děkuji.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:36:27, on 1.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\BHROOT\BIN\NT611SVC.EXE
C:\BHROOT\BIN\monitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\PCNetSoftware\RAC Server\RACs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\BHROOT\BIN\PORTMAP.EXE
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\TECDOC_CD\1_2010\db\tbmux32.exe
C:\BHROOT\BIN\DBMANG.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... &gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://quicktimepro.apple.com/?country= ... 0000026883
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - *9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
R3 - URLSearchHook: (no name) - *C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
R3 - URLSearchHook: (no name) - *01E69986-A054-4C52-ABE8-EF63DF1C5211} - (no file)
R3 - URLSearchHook: (no name) - *CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
R3 - URLSearchHook: (no name) - *{9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O2 - BHO: (no name) - {031F120A-BBAF-45d8-B306-375F2A6B9398} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O2 - BHO: (no name) - {F156768E-81EF-470C-9057-481BA8380DBA} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O3 - Toolbar: (no name) - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - (no file)
O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=021210 serial=DR12CNC-8301292-WBN lang=CZ
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON SX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE /FU "C:\DOCUME~1\FIrma\LOCALS~1\Temp\E_S86.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: "C:\PROGRA~1\Google\Google Desktop Search\GoogleDesktopNetwork3.dll"
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: RACServerLogon - C:\WINDOWS\SYSTEM32\RACServerLogon2.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: bh611 - Bell& Howell - C:\BHROOT\BIN\NT611SVC.EXE
O23 - Service: Bell & Howell Monitor Service (BHMonitorService) - Bell & Howell - C:\BHROOT\BIN\monitor.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Bell & Howell Database Manager (dbmang) - Bell & Howell - C:\BHROOT\BIN\DBMANG.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCNetSoftware Remote Administrator Control Server (PCNetSoftware RAC Server) - Miloslav Novotny N+P - C:\Program Files\PCNetSoftware\RAC Server\RACs.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ONC/RPC Portmapper (portmapper) - Bell & Howell - C:\BHROOT\BIN\PORTMAP.EXE
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Transbase TECDOC CD 1_2010 Service - Transaction Software, D 81829 Munich - C:\TECDOC_CD\1_2010\db\tbmux32.exe

--
End of file - 10636 bytes

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[wachtel]

ComboFix 10-02-01.01 - FIrma 01.02.2010 20:56:23.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.893.454 [GMT 1:00]
Spuštěný z: e:\aktovka\PROGRAMY\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2231788756-3839283092-1465718457-1000
c:\$recycle.bin\S-1-5-21-3822956366-3227737751-790636876-1000
c:\$recycle.bin\S-1-5-21-3892962313-3403493411-18111665-1000
c:\recycler\S-1-5-21-1715567821-790525478-725345543-500
c:\recycler\S-1-5-21-1935655697-1085031214-839522115-1003
c:\windows\Fonts\MyriadPro-Regular.otf
c:\windows\msvrc20.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\drivers\RKHit.sys
c:\windows\system32\ieuinit.inf
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\twain_32.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RKHIT


((((((((((((((((((((((((( Soubory vytvořené od 2010-01-01 do 2010-02-01 )))))))))))))))))))))))))))))))
.

2010-02-01 19:22 . 2010-02-01 19:23 -------- d-----w- C:\rsit
2010-02-01 18:36 . 2010-02-01 19:22 -------- d-----w- c:\program files\Trend Micro
2010-01-24 06:28 . 2008-06-14 18:00 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-24 06:26 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-24 06:26 . 2009-08-04 17:07 2059904 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-24 06:26 . 2009-08-04 17:07 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-24 06:26 . 2009-08-04 17:07 2182528 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-24 06:26 . 2009-08-04 17:07 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-23 16:43 . 2010-01-23 16:43 -------- d-----w- c:\program files\Symantec
2010-01-22 20:37 . 2004-08-18 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-01-22 20:37 . 2004-08-18 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-01-22 20:35 . 2004-08-18 12:00 86016 -c--a-w- c:\windows\system32\dllcache\imekrmbx.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-21 15:46 . 2007-04-10 19:06 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-01-21 15:46 . 2008-08-08 20:09 86528 ----a-w- c:\windows\system32\E_FLBFCE.DLL
2010-01-21 15:46 . 2007-12-07 20:01 78848 ----a-w- c:\windows\system32\E_FD4BFCE.DLL
2010-01-21 15:42 . 2010-01-21 15:42 -------- d-----w- c:\program files\Epson Software
2010-01-21 15:41 . 2010-01-21 15:41 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-01-21 15:25 . 2008-11-16 23:00 342016 ----a-w- c:\windows\system32\eswiaud.dll
2010-01-21 15:25 . 2010-01-21 15:42 -------- d-----w- c:\program files\epson
2010-01-16 12:09 . 2009-01-15 18:13 245760 ----a-w- c:\program files\Uninstall Ask Toolbar.dll
2010-01-16 12:05 . 2010-01-16 12:05 -------- d-----w- c:\program files\VS Revo Group
2010-01-12 08:10 . 2010-02-01 11:40 40 ---ha-r- c:\windows\ssystda.dat
2010-01-12 08:10 . 2010-01-16 19:12 -------- d-----w- C:\TECDOC_CD
2010-01-08 12:36 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-607
2010-01-08 12:34 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-USB
2010-01-05 17:45 . 2010-01-16 19:12 -------- d-----w- c:\program files\Akordy

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2024-03-21 11:44 . 2009-03-14 15:11 246272 -c--a-w- c:\windows\UNINST16.EXE
2010-02-01 19:33 . 2008-09-06 14:19 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-31 15:08 . 2004-08-18 12:00 82028 ----a-w- c:\windows\system32\perfc005.dat
2010-01-31 15:08 . 2004-08-18 12:00 438554 ----a-w- c:\windows\system32\perfh005.dat
2010-01-28 18:33 . 2009-02-27 15:58 -------- d-----w- c:\program files\Corel
2010-01-23 16:43 . 2009-10-24 17:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-23 16:27 . 2008-09-06 07:38 -------- d-----w- c:\program files\PowerQuest
2010-01-23 07:25 . 2009-06-20 05:27 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-23 07:25 . 2009-06-20 05:27 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-23 07:25 . 2009-06-20 05:27 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-22 20:32 . 2008-09-07 16:33 22944 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-01-17 16:49 . 2009-12-27 10:05 -------- d-----w- c:\program files\Steinberg
2010-01-17 16:44 . 2009-04-23 16:01 -------- d-----w- c:\program files\SlySoft
2010-01-16 19:10 . 2008-09-13 15:41 -------- d-----w- c:\program files\Glary Registry Repair
2010-01-12 09:01 . 2008-09-14 08:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-06 19:22 . 2009-06-16 17:46 -------- d-----w- c:\program files\Nokia
2009-12-27 14:24 . 2009-12-27 14:14 -------- d-----w- c:\program files\Native Instruments
2009-12-27 10:09 . 2009-12-27 10:09 -------- d-----w- c:\program files\Sonic Foundry Setup
2009-12-22 05:42 . 2004-08-18 12:00 663040 ----a-w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-18 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-19 16:51 . 2009-12-19 17:02 20 ----a-w- C:\RACIO.BAT
2009-12-04 17:13 . 2009-07-11 18:10 -------- d-----w- c:\program files\MediaInfo
2009-11-21 16:46 . 2004-08-18 12:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 14:13 . 2009-11-10 14:13 206848 ----a-w- c:\windows\system32\ltefx13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1693696 ----a-w- c:\windows\system32\LTCLR13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 445440 ----a-w- c:\windows\system32\ltimg13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 265216 ----a-w- c:\windows\system32\LTDIS13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 44032 ----a-w- c:\windows\system32\lttwn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 388608 ----a-w- c:\windows\system32\LFCMP13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 30208 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 246272 ----a-w- c:\windows\system32\LFJ2K13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 182784 ----a-w- c:\windows\system32\Lfpng13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 154112 ----a-w- c:\windows\system32\ltfil13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 453120 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1009664 ----a-w- c:\windows\system32\Ltwvc13n.dll
2009-07-09 16:01 . 2009-07-09 16:01 604 -c-ha-w- c:\program files\STLL Notifier
2003-03-12 03:16 . 2008-09-15 18:55 307200 -c--a-w- c:\program files\internet explorer\plugins\djvu0407.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0409.dll
2003-03-12 03:16 . 2008-09-15 18:55 311296 -c--a-w- c:\program files\internet explorer\plugins\djvu040c.dll
2003-03-12 03:16 . 2008-09-15 18:55 299008 -c--a-w- c:\program files\internet explorer\plugins\djvu0411.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0412.dll
2003-03-12 03:16 . 2008-09-15 18:55 290816 -c--a-w- c:\program files\internet explorer\plugins\djvu0804.dll
2003-03-12 03:15 . 2008-09-15 18:55 122880 -c--a-w- c:\program files\internet explorer\plugins\DjVuCntl.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 12:02 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-01-23 2043160]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe" [2004-06-22 729088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-23 07:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RACServerLogon]
2008-08-12 12:47 62736 -c--a-w- c:\windows\system32\RACServerLogon2.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^RT-Updater.lnk]
path=c:\documents and settings\FIrma\Nabídka Start\Programy\Po spuštění\RT-Updater.lnk
backup=c:\windows\pss\RT-Updater.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneDVDElbyDelay
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pckukacky
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STICAP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIWatcher
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 -c--a-r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-01-22 09:13 152872 -c--a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-18 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX410 Series]
2008-10-02 00:00 199680 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIFCE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-03-20 15:34 213936 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 14:58 1667584 -c----w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 06:27 570664 -c--a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 17:16 2331936 -c--a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-10-04 08:14 8491008 -c--a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2007-10-04 08:14 81920 -c--a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-10-04 08:14 1626112 -c--a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-12 10:34 1414144 -c--a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 13:57 282624 -c--a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-09-19 10:14 16844800 -c--a-r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-06-19 13:09 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PCNetSoftware\\RAC Server\\RACs.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\APM\\katcd\\apm.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [20.6.2009 6:27 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [20.6.2009 6:27 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [20.6.2009 6:27 108552]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [20.6.2009 6:27 297752]
R2 PCNetSoftware RAC Server;PCNetSoftware Remote Administrator Control Server;c:\program files\PCNetSoftware\RAC Server\RACs.exe [7.9.2008 13:29 3368208]
R2 RACDriver;RAC driver;c:\program files\PCNetSoftware\RAC Server\RACDriver.sys [7.9.2008 13:29 8208]
R2 Transbase TECDOC CD 1_2010 Service;Transbase TECDOC CD 1_2010 Service;c:\tecdoc_cd\1_2010\db\tbmux32.exe [18.11.2009 8:59 356352]
R3 NVHDA;Service for NVIDIA HDMI Audio Driver;c:\windows\system32\drivers\nvhda32.sys [10.11.2007 2:20 29728]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.9.2008 19:44 721904]
S3 PAC7311;Phenix-Q8;c:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 11:48 154752]
S3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [11.9.2008 8:31 54176]
S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-02-01 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-09-14 09:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = hxxp://quicktimepro.apple.com/?country=CZ&language=cs&productName=QuickTime7&operatingSystem=Windows&osVersion=05010200&qtVersion=07138000&cid=AOSA10000026883
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\FIrma\Data aplikací\Mozilla\Firefox\Profiles\3y6xpco8.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-*9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
URLSearchHooks-*C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
URLSearchHooks-*01E69986-A054-4C52-ABE8-EF63DF1C5211} - (no file)
URLSearchHooks-*CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
URLSearchHooks-*ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
URLSearchHooks-*{9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
URLSearchHooks-*{C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
BHO-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
MSConfigStartUp-LogitechCommunicationsManager - c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
AddRemove-Native Instruments - Rig Kontrol 2 Driver - c:\program files\Native Instruments\Rig Kontrol 2 Driver\uninst.exe Software\Native Instruments\Rig Kontrol 2 Driver\Setup



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 21:04
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1482476501-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}*]
"jaoamindjigfeifpjfpa"=hex:62,61,6f,67,00,00
"iaohhfgfciabngbkmo"=hex:6b,61,6e,67,6e,6f,66,63,62,61,66,6b,6e,6f,6b,6a,69,6f,
6f,65,64,6d,00,00
"jaoamindjigfeifpjfdb"=hex:62,61,6b,67,00,00
"haiabhmmoimglhjm"=hex:6b,61,6e,67,6e,6f,66,63,62,61,62,6b,67,68,6a,68,6c,63,
6c,66,61,66,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}\InProcServer32*]
"kamhnpdknigkhogiejlgkc"=hex:62,61,6d,67,00,8e
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\windows\system32\RACServerLogon2.dll

- - - - - - - > 'explorer.exe'(3736)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
c:\bhroot\BIN\NT611SVC.EXE
c:\bhroot\BIN\monitor.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\IoctlSvc.exe
c:\bhroot\BIN\PORTMAP.EXE
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wdfmgr.exe
c:\bhroot\BIN\DBMANG.EXE
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
.
**************************************************************************
.
Celkový čas: 2010-02-01 21:06:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-01 20:06

Před spuštěním: Volných bajtů: 183 770 681 344
Po spuštění: Volných bajtů: 184 300 285 952

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="FIRMA" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="ZALOHY" /noexecute=optin /fastdetect

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 0BB6312320725C78BCF6728A511FF669

[Rudy]

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Regnull::
[HKEY_USERS\S-1-5-21-1482476501-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}\InProcServer32*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[wachtel]

Udělal jsem jak jsi popsal,ale výše popsaný problém přetrvává


ComboFix 10-02-01.02 - FIrma 02.02.2010 16:01:47.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.893.427 [GMT 1:00]
Spuštěný z: e:\aktovka\PROGRAMY\ComboFix.exe
AV: AVG Anti-Virus plus Firewall *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-02 do 2010-02-02 )))))))))))))))))))))))))))))))
.

2010-02-02 12:19 . 2010-02-02 12:19 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-02 12:19 . 2010-02-02 12:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2010-02-02 12:19 . 2010-02-02 12:19 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-02 12:19 . 2010-02-02 12:19 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-02 12:19 . 2010-02-02 12:19 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-02 12:19 . 2010-02-02 12:50 -------- d-----w- c:\windows\system32\drivers\Avg
2010-02-02 12:18 . 2010-02-02 12:18 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2010-02-02 12:18 . 2010-02-02 12:18 29208 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-02-01 19:22 . 2010-02-01 19:23 -------- d-----w- C:\rsit
2010-02-01 18:36 . 2010-02-01 19:22 -------- d-----w- c:\program files\Trend Micro
2010-01-24 06:28 . 2008-06-14 18:00 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-24 06:26 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-24 06:26 . 2009-08-04 17:07 2059904 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-24 06:26 . 2009-08-04 17:07 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-24 06:26 . 2009-08-04 17:07 2182528 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-24 06:26 . 2009-08-04 17:07 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-23 16:43 . 2010-01-23 16:43 -------- d-----w- c:\program files\Symantec
2010-01-22 20:37 . 2004-08-18 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-01-22 20:37 . 2004-08-18 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-01-22 20:35 . 2004-08-18 12:00 86016 -c--a-w- c:\windows\system32\dllcache\imekrmbx.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-21 15:46 . 2007-04-10 19:06 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-01-21 15:46 . 2008-08-08 20:09 86528 ----a-w- c:\windows\system32\E_FLBFCE.DLL
2010-01-21 15:46 . 2007-12-07 20:01 78848 ----a-w- c:\windows\system32\E_FD4BFCE.DLL
2010-01-21 15:42 . 2010-01-21 15:42 -------- d-----w- c:\program files\Epson Software
2010-01-21 15:41 . 2010-01-21 15:41 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-01-21 15:25 . 2008-11-16 23:00 342016 ----a-w- c:\windows\system32\eswiaud.dll
2010-01-21 15:25 . 2010-01-21 15:42 -------- d-----w- c:\program files\epson
2010-01-16 12:09 . 2009-01-15 18:13 245760 ----a-w- c:\program files\Uninstall Ask Toolbar.dll
2010-01-16 12:05 . 2010-01-16 12:05 -------- d-----w- c:\program files\VS Revo Group
2010-01-12 08:10 . 2010-02-02 13:53 40 ---ha-r- c:\windows\ssystda.dat
2010-01-12 08:10 . 2010-01-16 19:12 -------- d-----w- C:\TECDOC_CD
2010-01-08 12:36 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-607
2010-01-08 12:34 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-USB
2010-01-05 17:45 . 2010-01-16 19:12 -------- d-----w- c:\program files\Akordy

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2024-03-21 11:44 . 2009-03-14 15:11 246272 -c--a-w- c:\windows\UNINST16.EXE
2010-02-02 14:53 . 2008-09-06 14:19 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-31 15:08 . 2004-08-18 12:00 82028 ----a-w- c:\windows\system32\perfc005.dat
2010-01-31 15:08 . 2004-08-18 12:00 438554 ----a-w- c:\windows\system32\perfh005.dat
2010-01-28 18:33 . 2009-02-27 15:58 -------- d-----w- c:\program files\Corel
2010-01-23 16:43 . 2009-10-24 17:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-23 16:27 . 2008-09-06 07:38 -------- d-----w- c:\program files\PowerQuest
2010-01-22 20:32 . 2008-09-07 16:33 22944 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-01-17 16:49 . 2009-12-27 10:05 -------- d-----w- c:\program files\Steinberg
2010-01-17 16:44 . 2009-04-23 16:01 -------- d-----w- c:\program files\SlySoft
2010-01-16 19:10 . 2008-09-13 15:41 -------- d-----w- c:\program files\Glary Registry Repair
2010-01-12 09:01 . 2008-09-14 08:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-06 19:22 . 2009-06-16 17:46 -------- d-----w- c:\program files\Nokia
2009-12-27 14:24 . 2009-12-27 14:14 -------- d-----w- c:\program files\Native Instruments
2009-12-27 10:09 . 2009-12-27 10:09 -------- d-----w- c:\program files\Sonic Foundry Setup
2009-12-22 05:42 . 2004-08-18 12:00 663040 ------w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-18 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-19 16:51 . 2009-12-19 17:02 20 ----a-w- C:\RACIO.BAT
2009-12-04 17:13 . 2009-07-11 18:10 -------- d-----w- c:\program files\MediaInfo
2009-11-21 16:46 . 2004-08-18 12:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 14:13 . 2009-11-10 14:13 206848 ----a-w- c:\windows\system32\ltefx13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1693696 ----a-w- c:\windows\system32\LTCLR13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 445440 ----a-w- c:\windows\system32\ltimg13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 265216 ----a-w- c:\windows\system32\LTDIS13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 44032 ----a-w- c:\windows\system32\lttwn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 388608 ----a-w- c:\windows\system32\LFCMP13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 30208 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 246272 ----a-w- c:\windows\system32\LFJ2K13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 182784 ----a-w- c:\windows\system32\Lfpng13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 154112 ----a-w- c:\windows\system32\ltfil13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 453120 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1009664 ----a-w- c:\windows\system32\Ltwvc13n.dll
2009-07-09 16:01 . 2009-07-09 16:01 604 -c-ha-w- c:\program files\STLL Notifier
2003-03-12 03:16 . 2008-09-15 18:55 307200 -c--a-w- c:\program files\internet explorer\plugins\djvu0407.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0409.dll
2003-03-12 03:16 . 2008-09-15 18:55 311296 -c--a-w- c:\program files\internet explorer\plugins\djvu040c.dll
2003-03-12 03:16 . 2008-09-15 18:55 299008 -c--a-w- c:\program files\internet explorer\plugins\djvu0411.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0412.dll
2003-03-12 03:16 . 2008-09-15 18:55 290816 -c--a-w- c:\program files\internet explorer\plugins\djvu0804.dll
2003-03-12 03:15 . 2008-09-15 18:55 122880 -c--a-w- c:\program files\internet explorer\plugins\DjVuCntl.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-02-02_07.02.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-02 14:40 . 2010-02-02 14:40 16384 c:\windows\Temp\Perflib_Perfdata_7e8.dat
+ 2010-02-02 12:18 . 2010-02-02 12:18 337408 c:\windows\Installer\468de.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe" [2004-06-22 729088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-02-02 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-02-02 12:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RACServerLogon]
2008-08-12 12:47 62736 -c--a-w- c:\windows\system32\RACServerLogon2.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^RT-Updater.lnk]
path=c:\documents and settings\FIrma\Nabídka Start\Programy\Po spuštění\RT-Updater.lnk
backup=c:\windows\pss\RT-Updater.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 -c--a-r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-01-22 09:13 152872 -c--a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-18 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX410 Series]
2008-10-02 00:00 199680 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIFCE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-03-20 15:34 213936 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 14:58 1667584 -c----w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 06:27 570664 -c--a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 17:16 2331936 -c--a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-10-04 08:14 8491008 -c--a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2007-10-04 08:14 81920 -c--a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-10-04 08:14 1626112 -c--a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-12 10:34 1414144 -c--a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 13:57 282624 -c--a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-09-19 10:14 16844800 -c--a-r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-06-19 13:09 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PCNetSoftware\\RAC Server\\RACs.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\APM\\katcd\\apm.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2.2.2010 13:19 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2.2.2010 13:19 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2.2.2010 13:19 108552]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2.2.2010 13:18 298776]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2.2.2010 13:18 1366904]
R2 PCNetSoftware RAC Server;PCNetSoftware Remote Administrator Control Server;c:\program files\PCNetSoftware\RAC Server\RACs.exe [7.9.2008 13:29 3368208]
R2 RACDriver;RAC driver;c:\program files\PCNetSoftware\RAC Server\RACDriver.sys [7.9.2008 13:29 8208]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2.2.2010 13:18 29208]
R3 NVHDA;Service for NVIDIA HDMI Audio Driver;c:\windows\system32\drivers\nvhda32.sys [10.11.2007 2:20 29728]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.9.2008 19:44 721904]
S2 Transbase TECDOC CD 1_2010 Service;Transbase TECDOC CD 1_2010 Service;c:\tecdoc_cd\1_2010\db\tbmux32.exe [18.11.2009 8:59 356352]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2.2.2010 13:18 29208]
S3 PAC7311;Phenix-Q8;c:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 11:48 154752]
S3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [11.9.2008 8:31 54176]
S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-02-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-09-14 09:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = hxxp://quicktimepro.apple.com/?country=CZ&language=cs&productName=QuickTime7&operatingSystem=Windows&osVersion=05010200&qtVersion=07138000&cid=AOSA10000026883
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\FIrma\Data aplikací\Mozilla\Firefox\Profiles\3y6xpco8.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-02 16:07
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1482476501-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}*]
"jaoamindjigfeifpjfpa"=hex:62,61,6f,67,00,00
"iaohhfgfciabngbkmo"=hex:6b,61,6e,67,6e,6f,66,63,62,61,66,6b,6e,6f,6b,6a,69,6f,
6f,65,64,6d,00,00
"jaoamindjigfeifpjfdb"=hex:62,61,6b,67,00,00
"haiabhmmoimglhjm"=hex:6b,61,6e,67,6e,6f,66,63,62,61,62,6b,67,68,6a,68,6c,63,
6c,66,61,66,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}\InProcServer32*]
"kamhnpdknigkhogiejlgkc"=hex:62,61,6d,67,00,8e
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1376)
c:\windows\system32\RACServerLogon2.dll

- - - - - - - > 'explorer.exe'(2848)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-02-02 16:09:20
ComboFix-quarantined-files.txt 2010-02-02 15:09
ComboFix2.txt 2010-02-02 07:03
ComboFix3.txt 2010-02-01 20:06

Před spuštěním: Volných bajtů: 184 230 174 720
Po spuštění: Volných bajtů: 184 197 730 304

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - BCCE7853173737B66275162CF314810B

[Rudy]

Podle údajů v hlavičcce logu nebyl CF spuštěn skriptem. Takže znovu.

Skript, který uložíte jako CFSCript.txt:

Regnull::
[HKEY_USERS\S-1-5-21-1482476501-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{33A8D63C-C48A-E2FC-DA9F-7BDC4391646B}\InProcServer32*]

Dále proveďte přesně toto:

[wachtel]

Je to již v pořádku?

ComboFix 10-02-01.05 - FIrma 02.02.2010 20:20:21.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.893.320 [GMT 1:00]
Spuštěný z: e:\aktovka\PROGRAMY\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\FIrma\Plocha\CFScript.txt
AV: AVG Anti-Virus plus Firewall *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Vbshell.tlb

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-02 do 2010-02-02 )))))))))))))))))))))))))))))))
.

2010-02-02 12:19 . 2010-02-02 16:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2010-02-02 12:19 . 2010-02-02 12:19 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-02 12:19 . 2010-02-02 12:19 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-02 12:19 . 2010-02-02 16:33 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-02 12:19 . 2010-02-02 16:33 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-02 12:19 . 2010-02-02 12:50 -------- d-----w- c:\windows\system32\drivers\Avg
2010-02-02 12:18 . 2010-02-02 12:18 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2010-02-02 12:18 . 2010-02-02 12:18 29208 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-02-01 19:22 . 2010-02-01 19:23 -------- d-----w- C:\rsit
2010-02-01 18:36 . 2010-02-01 19:22 -------- d-----w- c:\program files\Trend Micro
2010-01-24 06:28 . 2008-06-14 18:00 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-24 06:26 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-24 06:26 . 2009-08-04 17:07 2059904 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-24 06:26 . 2009-08-04 17:07 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-24 06:26 . 2009-08-04 17:07 2182528 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-24 06:26 . 2009-08-04 17:07 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-23 16:43 . 2010-01-23 16:43 -------- d-----w- c:\program files\Symantec
2010-01-22 20:37 . 2004-08-18 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-01-22 20:37 . 2004-08-18 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-01-22 20:35 . 2004-08-18 12:00 86016 -c--a-w- c:\windows\system32\dllcache\imekrmbx.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-22 20:22 . 2004-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-21 15:46 . 2007-04-10 19:06 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-01-21 15:46 . 2008-08-08 20:09 86528 ----a-w- c:\windows\system32\E_FLBFCE.DLL
2010-01-21 15:46 . 2007-12-07 20:01 78848 ----a-w- c:\windows\system32\E_FD4BFCE.DLL
2010-01-21 15:42 . 2010-01-21 15:42 -------- d-----w- c:\program files\Epson Software
2010-01-21 15:41 . 2010-01-21 15:41 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-01-21 15:25 . 2008-11-16 23:00 342016 ----a-w- c:\windows\system32\eswiaud.dll
2010-01-21 15:25 . 2010-01-21 15:42 -------- d-----w- c:\program files\epson
2010-01-16 12:09 . 2009-01-15 18:13 245760 ----a-w- c:\program files\Uninstall Ask Toolbar.dll
2010-01-16 12:05 . 2010-01-16 12:05 -------- d-----w- c:\program files\VS Revo Group
2010-01-12 08:10 . 2010-02-02 13:53 40 ---ha-r- c:\windows\ssystda.dat
2010-01-12 08:10 . 2010-01-16 19:12 -------- d-----w- C:\TECDOC_CD
2010-01-08 12:36 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-607
2010-01-08 12:34 . 2010-01-16 19:10 -------- d-----w- C:\VAG-COM-USB
2010-01-05 17:45 . 2010-01-16 19:12 -------- d-----w- c:\program files\Akordy

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2024-03-21 11:44 . 2009-03-14 15:11 246272 -c--a-w- c:\windows\UNINST16.EXE
2010-02-02 17:14 . 2008-09-06 14:19 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-31 15:08 . 2004-08-18 12:00 82028 ----a-w- c:\windows\system32\perfc005.dat
2010-01-31 15:08 . 2004-08-18 12:00 438554 ----a-w- c:\windows\system32\perfh005.dat
2010-01-28 18:33 . 2009-02-27 15:58 -------- d-----w- c:\program files\Corel
2010-01-23 16:43 . 2009-10-24 17:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-23 16:27 . 2008-09-06 07:38 -------- d-----w- c:\program files\PowerQuest
2010-01-22 20:32 . 2008-09-07 16:33 22944 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-01-17 16:49 . 2009-12-27 10:05 -------- d-----w- c:\program files\Steinberg
2010-01-17 16:44 . 2009-04-23 16:01 -------- d-----w- c:\program files\SlySoft
2010-01-16 19:10 . 2008-09-13 15:41 -------- d-----w- c:\program files\Glary Registry Repair
2010-01-12 09:01 . 2008-09-14 08:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-06 19:22 . 2009-06-16 17:46 -------- d-----w- c:\program files\Nokia
2009-12-27 14:24 . 2009-12-27 14:14 -------- d-----w- c:\program files\Native Instruments
2009-12-27 10:09 . 2009-12-27 10:09 -------- d-----w- c:\program files\Sonic Foundry Setup
2009-12-22 05:42 . 2004-08-18 12:00 663040 ------w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-18 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-19 16:51 . 2009-12-19 17:02 20 ----a-w- C:\RACIO.BAT
2009-11-21 16:46 . 2004-08-18 12:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 14:13 . 2009-11-10 14:13 206848 ----a-w- c:\windows\system32\ltefx13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1693696 ----a-w- c:\windows\system32\LTCLR13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 445440 ----a-w- c:\windows\system32\ltimg13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 265216 ----a-w- c:\windows\system32\LTDIS13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 44032 ----a-w- c:\windows\system32\lttwn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 388608 ----a-w- c:\windows\system32\LFCMP13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 30208 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 246272 ----a-w- c:\windows\system32\LFJ2K13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 182784 ----a-w- c:\windows\system32\Lfpng13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 154112 ----a-w- c:\windows\system32\ltfil13n.DLL
2009-11-10 14:13 . 2009-11-10 14:13 453120 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-11-10 14:13 . 2009-11-10 14:13 1009664 ----a-w- c:\windows\system32\Ltwvc13n.dll
2009-07-09 16:01 . 2009-07-09 16:01 604 -c-ha-w- c:\program files\STLL Notifier
2003-03-12 03:16 . 2008-09-15 18:55 307200 -c--a-w- c:\program files\internet explorer\plugins\djvu0407.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0409.dll
2003-03-12 03:16 . 2008-09-15 18:55 311296 -c--a-w- c:\program files\internet explorer\plugins\djvu040c.dll
2003-03-12 03:16 . 2008-09-15 18:55 299008 -c--a-w- c:\program files\internet explorer\plugins\djvu0411.dll
2003-03-12 03:16 . 2008-09-15 18:55 303104 -c--a-w- c:\program files\internet explorer\plugins\djvu0412.dll
2003-03-12 03:16 . 2008-09-15 18:55 290816 -c--a-w- c:\program files\internet explorer\plugins\djvu0804.dll
2003-03-12 03:15 . 2008-09-15 18:55 122880 -c--a-w- c:\program files\internet explorer\plugins\DjVuCntl.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-02-02_07.02.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-02 14:40 . 2010-02-02 14:40 16384 c:\windows\Temp\Perflib_Perfdata_7e8.dat
+ 2010-02-02 12:18 . 2010-02-02 12:18 337408 c:\windows\Installer\468de.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe" [2004-06-22 729088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-02-02 2000152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-02-02 16:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RACServerLogon]
2008-08-12 12:47 62736 -c--a-w- c:\windows\system32\RACServerLogon2.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Corel MEDIA FOLDERS INDEXER 8.LNK]
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^FIrma^Nabídka Start^Programy^Po spuštění^RT-Updater.lnk]
path=c:\documents and settings\FIrma\Nabídka Start\Programy\Po spuštění\RT-Updater.lnk
backup=c:\windows\pss\RT-Updater.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 -c--a-r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-01-22 09:13 152872 -c--a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-18 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX410 Series]
2008-10-02 00:00 199680 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIFCE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-03-20 15:34 213936 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 14:58 1667584 -c----w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 06:27 570664 -c--a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 17:16 2331936 -c--a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-10-04 08:14 8491008 -c--a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2007-10-04 08:14 81920 -c--a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-10-04 08:14 1626112 -c--a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-12 10:34 1414144 -c--a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 13:57 282624 -c--a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-09-19 10:14 16844800 -c--a-r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-06-19 13:09 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PCNetSoftware\\RAC Server\\RACs.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\APM\\katcd\\apm.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2.2.2010 13:19 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2.2.2010 13:19 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2.2.2010 13:19 108552]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2.2.2010 13:18 297752]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2.2.2010 13:18 1370488]
R2 PCNetSoftware RAC Server;PCNetSoftware Remote Administrator Control Server;c:\program files\PCNetSoftware\RAC Server\RACs.exe [7.9.2008 13:29 3368208]
R2 RACDriver;RAC driver;c:\program files\PCNetSoftware\RAC Server\RACDriver.sys [7.9.2008 13:29 8208]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2.2.2010 13:18 29208]
R3 NVHDA;Service for NVIDIA HDMI Audio Driver;c:\windows\system32\drivers\nvhda32.sys [10.11.2007 2:20 29728]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.9.2008 19:44 721904]
S2 Transbase TECDOC CD 1_2010 Service;Transbase TECDOC CD 1_2010 Service;c:\tecdoc_cd\1_2010\db\tbmux32.exe [18.11.2009 8:59 356352]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2.2.2010 13:18 29208]
S3 PAC7311;Phenix-Q8;c:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 11:48 154752]
S3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [11.9.2008 8:31 54176]
S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-02-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-09-14 09:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = hxxp://quicktimepro.apple.com/?country=CZ&language=cs&productName=QuickTime7&operatingSystem=Windows&osVersion=05010200&qtVersion=07138000&cid=AOSA10000026883
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\FIrma\Data aplikací\Mozilla\Firefox\Profiles\3y6xpco8.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-02 20:26
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1376)
c:\windows\system32\RACServerLogon2.dll
.
Celkový čas: 2010-02-02 20:28:33
ComboFix-quarantined-files.txt 2010-02-02 19:28
ComboFix2.txt 2010-02-02 15:53
ComboFix3.txt 2010-02-02 15:09
ComboFix4.txt 2010-02-02 07:03
ComboFix5.txt 2010-02-02 19:18

Před spuštěním: Volných bajtů: 184 087 998 464
Po spuštění: Volných bajtů: 184 048 345 088

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - F0F35FB9193A805A202510D9E2210131

[Rudy]

Ano, log již vypadá čistý.