log .hi-jack kontrola

[olcit]

Prosím o kontrolu logu z Hi-jack. Eset mě hlásil vir. Uložil ho do karantény. Já ho smazal, ale pc je teď mnohem pomalejší.
Děkuji.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:42:17, on 10.2.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\VIA\VIAudioi\VDeck\VDECK.EXE
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\O2 Mobilni internet\O2 Mobilni internet.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Users\OTA\Desktop\doctor\hijackthis.exe
C:\Users\OTA\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\OTA\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\OTA\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON SX410 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE /FU "C:\Windows\TEMP\E_S82F4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F5F60B7-5D85-4873-AA9E-9E3B0EE3C31C}: NameServer = 160.218.10.200 160.218.43.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 7256 bytes

[Roli]

Zdravím, tohle fixni v HJT :

R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\OTA\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\OTA\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Stáhni a ulož na plochu ComboFix,

spusť aplikaci pod účtem s administrátorským oprávněním a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

[olcit]

Tak jsem všechno proved podle návodu.

ComboFix 10-02-10.04 - OTA 11.02.2010 2:44.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3036.1809 [GMT 1:00]
Spuštěný z: c:\users\OTA\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
c:\windows\system32\drivers\RKHit.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RKHIT


((((((((((((((((((((((((( Soubory vytvořené od 2010-01-11 do 2010-02-11 )))))))))))))))))))))))))))))))
.

2010-02-10 19:59 . 2010-02-10 19:59 -------- d-----w- c:\users\OTA\AppData\Local\ShredderChess
2010-02-10 19:59 . 2010-02-10 19:59 -------- d-----w- c:\users\OTA\AppData\Roaming\ShredderChess
2010-02-10 19:59 . 2010-02-10 19:59 -------- d-----w- c:\program files\ShredderChess
2010-02-10 19:21 . 2010-02-10 19:21 22 ----a-w- c:\windows\REGBK00.ZIP
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\zts2.exe
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\system32\vcmgcd32.dll
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\system32\systems.txt
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\system32\iifgfgf.dll
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\rundll16.exe
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\rundl132.dll
2010-02-10 19:21 . 2010-02-10 19:21 -------- d---a-w- c:\windows\logo1_.exe
2010-02-10 13:53 . 2010-02-10 13:53 -------- d-----w- c:\users\OTA\AppData\Local\ESET
2010-02-10 02:32 . 2010-02-10 02:32 -------- d-----w- c:\users\OTA\AppData\Local\ChessBase
2010-02-10 02:31 . 2010-02-10 06:43 -------- d-----w- c:\users\OTA\AppData\Roaming\ChessBase
2010-02-10 02:31 . 2010-02-10 02:31 -------- d-----w- c:\program files\Common Files\ChessBase
2010-02-08 12:04 . 2010-02-08 12:04 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-02-08 11:49 . 2010-02-08 11:56 -------- d-----w- c:\users\OTA\AppData\Roaming\CopyToDvd
2010-02-08 04:15 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-02-08 04:15 . 2006-10-26 18:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-02-08 04:13 . 2010-02-08 04:13 -------- d-----w- c:\program files\Microsoft Works
2010-02-08 04:12 . 2010-02-08 04:12 -------- d-----w- c:\windows\PCHEALTH
2010-02-08 04:12 . 2010-02-08 04:12 -------- d-----w- c:\program files\Microsoft.NET
2010-02-08 04:10 . 2010-02-08 04:10 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-08 04:10 . 2010-02-08 04:10 -------- d-----w- c:\users\OTA\AppData\Local\Microsoft Help
2010-02-08 04:09 . 2010-02-08 04:09 -------- d-----w- C:\MSOCache
2010-02-08 02:53 . 2009-01-09 11:46 39776 ----a-w- c:\windows\system32\DfSdkBt64.exe
2010-02-08 02:53 . 2009-01-09 11:46 33632 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-02-08 01:22 . 2010-02-08 02:36 -------- d-----w- c:\users\OTA\AppData\Roaming\SoftMaker
2010-02-07 19:19 . 2010-02-07 19:19 -------- d-----w- c:\users\OTA\AppData\Roaming\Sachy
2010-02-07 16:51 . 2010-02-07 16:51 -------- d-----w- c:\users\OTA\AppData\Roaming\AnvSoft
2010-02-07 16:50 . 2010-02-07 16:50 -------- d-----w- c:\program files\AnvSoft
2010-02-07 07:46 . 2010-02-07 07:47 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-07 07:16 . 2010-02-07 07:23 -------- d-----w- c:\programdata\SuperMP3Download
2010-02-07 07:16 . 2010-02-07 07:16 -------- d-----w- c:\users\OTA\AppData\Roaming\SuperMP3Download
2010-02-07 06:16 . 2010-02-07 06:16 -------- d-----w- c:\programdata\Azureus
2010-02-07 06:16 . 2010-02-10 07:16 -------- d-----w- c:\users\OTA\AppData\Roaming\Azureus
2010-02-07 06:15 . 2010-02-07 07:47 -------- d-----w- c:\program files\Vuze
2010-02-07 02:13 . 2010-02-07 02:13 -------- d-----w- c:\program files\Common Files\LightScribe
2010-02-06 20:38 . 2010-02-07 07:05 -------- d-----w- c:\users\OTA\AppData\Local\Ashampoo Movie Shrink & Burn 3
2010-02-06 19:35 . 2010-02-06 19:35 -------- d-----w- c:\users\OTA\AppData\Local\Real
2010-02-06 19:35 . 2009-04-02 14:21 84480 ----a-w- c:\windows\system32\ff_vfw.dll
2010-02-06 19:35 . 2008-06-08 22:58 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2010-02-03 06:35 . 2010-02-03 06:43 -------- d-----w- c:\users\OTA\you tube
2010-02-03 06:34 . 2008-12-04 20:42 815104 ----a-w- c:\windows\system32\xvidcore.dll
2010-02-03 06:34 . 2008-12-04 20:46 180224 ----a-w- c:\windows\system32\xvidvfw.dll
2010-02-03 06:34 . 2010-02-03 06:34 -------- d-----w- c:\program files\Xvid
2010-02-03 06:34 . 2010-02-03 06:34 -------- d-----w- c:\program files\FDRLab
2010-01-30 15:45 . 2010-01-30 15:45 -------- d-----w- c:\users\OTA\AppData\Local\MyDownloader
2010-01-30 15:44 . 2010-02-03 05:52 -------- d-----w- C:\Downloads
2010-01-30 15:43 . 2010-01-30 15:43 -------- d-----w- c:\program files\vSoft
2010-01-27 12:00 . 2010-01-27 12:00 -------- d-----w- c:\program files\FastStone Image Viewer
2010-01-27 11:46 . 2010-01-27 11:46 -------- d-----w- c:\users\OTA\AppData\Roaming\FastStone
2010-01-22 08:59 . 2009-12-16 11:44 834048 ----a-w- c:\windows\system32\wininet.dll
2010-01-22 08:58 . 2009-12-18 13:01 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-21 13:35 . 2010-01-21 13:35 -------- d-----w- c:\program files\Audacity
2010-01-21 13:28 . 2010-01-21 13:28 215542 ----a-w- c:\windows\MP3Producer Uninstaller.exe
2010-01-21 13:28 . 2010-01-21 13:28 -------- d-----w- c:\program files\MP3Producer
2010-01-21 13:24 . 2010-01-21 13:24 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-01-21 13:24 . 2010-01-21 13:25 -------- d-----w- c:\users\OTA\AppData\Roaming\Vso
2010-01-21 13:24 . 2004-05-26 20:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-01-21 13:24 . 2006-09-16 18:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-01-21 13:24 . 2010-01-21 13:26 -------- d-----w- c:\program files\Video Convert Premier
2010-01-13 02:20 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 02:20 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 01:48 . 2009-10-14 23:35 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-10 13:50 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-10 07:19 . 2009-09-16 18:46 -------- d-----w- c:\programdata\Microsoft Help
2010-02-10 06:57 . 2009-10-14 21:47 108432 ----a-w- c:\users\OTA\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-10 06:44 . 2009-09-16 19:47 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-10 06:43 . 2010-02-10 02:31 -------- d-----w- c:\users\OTA\AppData\Roaming\ChessBase
2010-02-10 06:43 . 2009-09-16 19:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-10 06:19 . 2008-04-17 10:34 598832 ----a-w- c:\windows\system32\perfh005.dat
2010-02-10 06:19 . 2008-04-17 10:34 114992 ----a-w- c:\windows\system32\perfc005.dat
2010-02-10 02:31 . 2010-02-10 02:31 -------- d-----w- c:\program files\Common Files\ChessBase
2010-02-08 05:51 . 2009-10-15 00:15 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-08 05:25 . 2009-10-15 09:28 -------- d-----w- c:\users\OTA\AppData\Roaming\OpenOffice.org2
2010-02-08 04:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild
2010-02-08 02:55 . 2009-10-15 01:31 -------- d-----w- c:\program files\Ashampoo
2010-02-08 01:25 . 2009-03-23 10:13 4096 ----a-w- c:\users\OTA\AppData\Roaming\SoftMaker\ofres10.dll
2010-02-07 06:52 . 2009-09-16 19:05 -------- d-----w- c:\programdata\Norton
2010-02-07 06:40 . 2009-09-16 19:05 -------- d-----w- c:\programdata\Symantec
2010-02-06 20:55 . 2009-10-16 16:39 -------- d-----w- c:\programdata\page
2010-02-04 20:36 . 2009-10-15 09:37 1 ----a-w- c:\users\OTA\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-01-30 15:43 . 2010-01-30 15:43 22486 ----a-r- c:\users\OTA\AppData\Roaming\Microsoft\Installer\{9CC5E685-58F5-4238-AA90-C803BCC6ED8B}\_F4AF5EC7408E04EBDA6B74.exe
2010-01-30 15:43 . 2010-01-30 15:43 22486 ----a-r- c:\users\OTA\AppData\Roaming\Microsoft\Installer\{9CC5E685-58F5-4238-AA90-C803BCC6ED8B}\_70EB9FE87C2B18A55FCA7A.exe
2010-01-21 13:24 . 2010-01-21 13:24 81920 ----a-w- c:\users\OTA\AppData\Roaming\ezpinst.exe
2010-01-21 13:24 . 2010-01-21 13:24 81920 ----a-w- c:\users\OTA\AppData\Roaming\ezpinst.exe
2010-01-21 13:24 . 2010-01-21 13:24 47360 ----a-w- c:\users\OTA\AppData\Roaming\pcouffin.sys
2010-01-21 13:24 . 2010-01-21 13:24 47360 ----a-w- c:\users\OTA\AppData\Roaming\pcouffin.sys
2010-01-17 12:08 . 2009-09-16 19:02 -------- d-----w- c:\program files\CyberLink
2010-01-17 12:08 . 2009-09-16 19:03 53319 ----a-w- c:\programdata\Temp\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\PostBuild.exe
2010-01-17 12:07 . 2009-09-16 19:02 -------- d-----w- c:\programdata\CyberLink
2010-01-17 12:06 . 2009-09-16 19:03 36864 ----a-w- c:\programdata\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe
2010-01-17 12:04 . 2009-09-16 19:58 -------- d-----w- c:\program files\ASUS
2010-01-14 10:12 . 2009-11-04 01:32 181120 ------w- c:\windows\system32\MpSigStub.exe
2009-12-11 11:43 . 2010-02-10 03:12 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-11 11:43 . 2010-02-10 03:12 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-12-08 20:01 . 2010-02-10 03:12 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-10 03:12 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-10 03:12 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-10 03:12 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-04 18:30 . 2010-02-10 03:12 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-10 03:12 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-10 03:12 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-10 03:12 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-10 03:12 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-10 03:12 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-10 03:12 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-10 03:12 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-10 03:12 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-12-04 15:56 . 2010-02-10 03:12 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-12-04 15:56 . 2010-02-10 03:12 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-30 21:07 . 2009-11-30 21:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-19 02:57 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-09-16 18:52 . 2009-09-16 18:52 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
2009-10-05 17:34 150768 ----a-w- c:\users\OTA\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-05 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-05 150552]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-03-23 17149952]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-12-29 159744]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-02-06 1593344]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-09-16 3054136]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-03-06 424352]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-30 149280]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

c:\users\OTA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATKOSD2]
2009-03-04 17:26 8392704 ----a-w- c:\program files\ASUS\ATKOSD2\ATKOSD2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):09,84,1f,90,e0,55,ca,01

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 8:21 468224]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\System32\drivers\ETD.sys [13.3.2009 4:11 140800]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\System32\drivers\viahduaa.sys [20.3.2009 7:21 984064]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [8.2.2010 3:53 410976]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21.1.2008 3:23 21504]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\System32\drivers\SRS_PremiumSound_i386.sys [16.9.2009 21:01 230952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-02-11 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-11 02:50
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\VDeck\VDeck.exe -r???????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(1916)
c:\windows\system32\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\TUProgSt.exe
c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe
c:\program files\ASUS\ATK Hotkey\HControl.exe
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\system32\conime.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2010-02-11 02:54:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-11 01:54

Před spuštěním: Volných bajtů: 103 272 308 736
Po spuštění: Volných bajtů: 103 015 727 104

- - End Of File - - D9532663D008F1C17149BCE913D44EF4




Ještě jsem zapoměl: než naběhne Hijackthis, tak se otevře okno v anglině. Bohu-žel nevím, co to znamená.

[Roli]

K tomu oknu, upozornění že ve Vistě se musí HJT spouštět jako administrátor.


Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Pak použij Mbam z mého podpisu.