Security tool

[motji]

Ted zkuste ten nouzový režim.

[lenienka]

Bohužel při stisku F2-F11 se nic neděje...

[motji]

Zkusím ještě do zítřka něco vymyslet .
Śel Vám někdy ten nouzový režim, zkoušela jste ho někdy?


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Driver::
ICQ Service

Folder::
c:\program files\ICQ6Toolbar

Firefox::
FF - ProfilePath - c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... 2.0.0.1&q=

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Soubor c:\qoobox\ qarantine\c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk.vir vytáhněte z karánteny combofixu a přejmenujte ho - smažte příponu vir a vratte kam patří

[lenienka]

Tak už jsem na to přišla,nouzák jsem nikdy nezkoušela,tak jsem nevěděla jak na to,ale teď pracuji v něm,takže funguje!!!

[motji]

Fajn, tak ještě jednou spustte combofix
Ted už nouzový režinm nepotřebujeme , ale kdyby jste někdy měla zase problém s nějakým podobným virem, tak už víte, jak se do něj dostat

[lenienka]

ComboFix 10-03-01.01 - Lenka 01.03.2010 22:41:30.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3000.1948 [GMT 1:00]
Spuštěný z: c:\users\Lenka\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-01 do 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-03-01 21:49 . 2010-03-01 21:49 -------- d-----w- c:\users\Lenka\AppData\Local\temp
2010-03-01 21:49 . 2010-03-01 21:49 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-01 21:49 . 2010-03-01 21:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-01 17:48 . 2010-03-01 17:48 -------- d-----w- c:\users\Lenka\AppData\Roaming\Malwarebytes
2010-03-01 17:48 . 2010-03-01 17:48 -------- d-----w- c:\programdata\Malwarebytes
2010-03-01 17:48 . 2010-03-01 21:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-01 17:40 . 2010-03-01 17:40 -------- d-----w- c:\program files\CCleaner
2010-03-01 17:20 . 2010-03-01 17:20 -------- d-----w- C:\_OTM
2010-03-01 12:13 . 2010-03-01 19:24 -------- d-----w- c:\program files\trend micro
2010-03-01 12:13 . 2010-03-01 13:10 -------- d-----w- C:\rsit
2010-02-27 13:25 . 2010-02-27 13:25 -------- d-----w- c:\programdata\hps
2010-02-27 12:58 . 2010-02-27 12:58 -------- d-----w- c:\program files\dm
2010-02-27 12:57 . 2010-02-27 12:58 -------- d-----w- c:\program files\Happy Eyes
2010-02-23 19:45 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-23 19:44 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-23 19:44 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-23 19:44 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-23 19:44 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-23 19:44 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-23 19:44 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-23 19:44 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-23 19:44 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-23 19:44 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-23 19:44 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-23 19:43 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-23 19:43 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-02-21 19:00 . 2010-02-21 19:00 50354 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\uninstall.exe
2010-02-21 19:00 . 2010-02-21 19:00 -------- d-----w- c:\users\Lenka\AppData\Roaming\Facebook
2010-02-09 19:03 . 2009-12-11 11:43 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-09 19:03 . 2009-12-11 11:43 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-09 19:01 . 2009-12-04 15:56 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-09 19:01 . 2009-12-04 15:56 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-09 08:58 . 2010-02-09 08:58 -------- d-----w- c:\users\Lenka\AppData\Local\AOL
2010-02-09 08:57 . 2010-02-18 05:47 -------- d-----w- c:\program files\ICQ7.0
2010-02-06 19:38 . 2010-02-06 19:40 -------- d-----w- c:\program files\Fiona Finch and the Finest Flowers
2010-02-06 19:34 . 2010-02-06 19:34 -------- d-----w- c:\program files\bfgclient
2010-02-06 19:32 . 2010-02-06 19:41 -------- d-----w- C:\BigFishGamesCache
2010-02-05 21:27 . 2009-12-16 15:05 471040 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
2010-02-05 21:27 . 2009-12-16 15:05 347136 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-02-05 21:27 . 2009-12-16 15:05 340992 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-02-05 21:27 . 2009-12-16 15:05 43008 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-02-05 21:27 . 2009-12-16 15:05 1452032 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-02-05 19:39 . 2010-03-01 20:37 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-02-05 19:34 . 2010-03-01 20:38 -------- d-----w- c:\program files\COMODO
2010-02-05 19:34 . 2010-02-05 19:34 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-02-05 19:07 . 2010-02-05 19:07 -------- d-----w- c:\program files\uTorrent
2010-02-05 19:06 . 2010-03-01 09:56 -------- d-----w- c:\users\Lenka\AppData\Roaming\uTorrent
2010-02-05 18:46 . 2010-02-05 18:46 -------- d-----w- c:\users\Lenka\AppData\Local\Mozilla
2010-02-04 19:15 . 2010-02-04 19:15 -------- d-----w- c:\users\Lenka\logs
2010-02-04 18:48 . 2010-02-04 18:48 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb32D.tmp.exe
2010-02-01 22:04 . 2010-02-01 22:04 847040 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\axfbootloader.dll
2010-02-01 22:04 . 2010-02-01 22:04 5578752 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 21:46 . 2008-05-09 08:18 598832 ----a-w- c:\windows\system32\perfh005.dat
2010-03-01 21:46 . 2008-05-09 08:18 114992 ----a-w- c:\windows\system32\perfc005.dat
2010-03-01 21:38 . 2008-12-23 19:03 12 ----a-w- c:\windows\bthservsdp.dat
2010-03-01 21:35 . 2009-05-19 20:57 -------- d-----w- c:\program files\Steam
2010-03-01 21:20 . 2009-05-19 20:57 -------- d-----w- c:\program files\Common Files\Steam
2010-03-01 20:38 . 2009-01-29 17:16 5972 ----a-w- c:\users\Lenka\AppData\Local\d3d9caps.dat
2010-03-01 08:29 . 2009-10-22 18:34 -------- d-----w- c:\programdata\CanonIJPLM
2010-02-28 21:30 . 2009-03-13 19:09 -------- d-----w- c:\users\Lenka\AppData\Roaming\Skype
2010-02-27 12:58 . 2008-12-23 19:04 72232 ----a-w- c:\users\Lenka\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-24 08:16 . 2009-10-03 05:28 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-10 21:07 . 2009-10-26 12:11 -------- d-----w- c:\program files\HP Games
2010-02-10 20:49 . 2009-10-26 12:24 1762568 ----a-w- c:\programdata\WildTangent\My HP Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2010-02-10 20:48 . 2009-01-25 13:17 -------- d-----w- c:\users\Lenka\AppData\Roaming\Farm Mania
2010-02-10 06:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-09 09:02 . 2009-10-20 06:29 -------- d-----w- c:\users\Lenka\AppData\Roaming\ICQ
2010-02-09 08:59 . 2008-05-08 22:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-09 08:59 . 2009-10-20 06:30 -------- d-----w- c:\programdata\ICQ
2010-02-06 22:21 . 2009-10-26 12:11 -------- d-----w- c:\programdata\WildTangent
2010-02-06 19:26 . 2009-05-26 07:15 -------- d-----w- c:\program files\Supermarket Mania
2010-02-06 19:24 . 2009-07-29 19:10 -------- d-----w- c:\program files\RealArcade
2010-02-06 19:24 . 2008-05-08 22:38 -------- d-----w- c:\program files\Acer GameZone
2010-02-06 19:23 . 2009-02-21 18:57 -------- d-----w- c:\program files\Magic Farm
2010-02-06 19:18 . 2009-02-16 17:01 -------- d-----w- c:\program files\Alawar
2010-02-05 21:11 . 2009-02-08 18:04 -------- d-----w- c:\programdata\GamesBar
2010-02-05 21:06 . 2009-09-10 20:45 -------- d-----w- c:\program files\iWin.com
2010-02-05 21:06 . 2009-09-10 13:54 -------- d-----w- c:\program files\Supple
2010-02-05 21:03 . 2008-12-29 18:02 -------- d-----w- c:\program files\Play
2010-02-05 19:28 . 2008-05-08 22:30 -------- d-----w- c:\programdata\McAfee
2010-02-03 22:06 . 2009-01-28 21:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-28 19:54 . 2010-01-28 19:54 -------- d-----w- c:\users\Lenka\AppData\Roaming\1morebee
2010-01-27 21:31 . 2009-12-12 20:34 -------- d-----w- c:\programdata\Artist Colony
2010-01-26 21:30 . 2008-12-24 21:47 -------- d-----w- c:\users\Lenka\AppData\Roaming\PlayFirst
2010-01-26 21:30 . 2008-12-24 21:47 -------- d-----w- c:\programdata\PlayFirst
2010-01-26 19:57 . 2010-01-26 19:57 -------- d-----w- c:\program files\IKEA HomePlanner
2010-01-26 19:57 . 2010-01-26 19:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-22 20:27 . 2010-01-22 20:27 -------- d-----w- c:\users\Lenka\AppData\Roaming\Boomzap
2010-01-21 20:46 . 2009-02-08 13:45 -------- d-----w- c:\users\Lenka\AppData\Roaming\Friday's games
2010-01-20 17:42 . 2009-02-06 20:35 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 20:05 . 2009-10-23 17:54 -------- d-----w- c:\programdata\CanonIJ
2010-01-09 18:34 . 2010-01-09 18:34 -------- d-----w- c:\program files\EA GAMES
2010-01-07 18:14 . 2010-01-07 18:10 -------- d-----w- c:\programdata\FarmFrenzy3_America
2010-01-07 18:05 . 2010-01-07 18:05 515848 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-06 15:38 . 2010-02-23 19:44 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-01-06 15:38 . 2010-02-23 19:44 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-01-06 15:38 . 2010-02-23 19:43 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-01-06 15:38 . 2010-02-23 19:43 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-01-05 11:53 . 2010-01-05 11:29 -------- d-----w- c:\program files\Winamp
2010-01-05 11:29 . 2010-01-05 11:29 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-01-05 11:23 . 2009-11-11 19:22 -------- d-----w- c:\users\Lenka\AppData\Roaming\DVD Flick
2010-01-03 20:38 . 2009-06-24 12:38 -------- d-----w- c:\users\Lenka\AppData\Roaming\BlamGames
2010-01-02 19:19 . 2010-01-02 19:19 -------- d-----w- c:\users\Lenka\AppData\Roaming\Exec
2010-01-02 19:18 . 2010-01-02 19:18 -------- d-----w- c:\programdata\Exec
2010-01-02 19:18 . 2010-01-02 19:18 -------- d-----w- c:\program files\Exec
2010-01-02 06:38 . 2010-01-22 05:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:51 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:51 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:51 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-25 20:02 . 2009-12-25 20:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-08 20:01 . 2010-02-09 19:02 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-09 19:02 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-09 19:02 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-09 19:02 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-04 18:30 . 2010-02-09 19:02 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-09 19:02 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-09 19:02 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-09 19:02 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-09 19:02 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-09 19:02 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-09 19:02 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-09 19:02 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-09 19:02 91136 ----a-w- c:\windows\system32\avifil32.dll
2008-12-24 10:25 . 2008-12-24 10:24 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((( SnapShot@2010-03-01_20.55.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2010-03-01 21:41 78890 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-23 19:23 . 2010-03-01 21:41 20462 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1005736443-1867655075-3420329979-1000_UserData.bin
+ 2008-12-24 00:58 . 2010-03-01 21:39 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-12-24 00:58 . 2010-03-01 20:44 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-01 17:36 . 2010-03-01 20:44 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-01 17:36 . 2010-03-01 21:39 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-12-24 00:58 . 2010-03-01 20:44 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-12-24 00:58 . 2010-03-01 21:39 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-01-31 09:00 . 2010-03-01 21:35 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-01-31 09:00 . 2010-03-01 20:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-01-31 09:00 . 2010-03-01 20:38 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-31 09:00 . 2010-03-01 21:35 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-31 09:00 . 2010-03-01 20:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-01-31 09:00 . 2010-03-01 21:35 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-01 21:38 . 2010-03-01 21:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-03-01 20:44 . 2010-03-01 20:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-03-01 21:38 . 2010-03-01 21:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-03-01 20:44 . 2010-03-01 20:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 13:05 . 2010-03-01 21:41 100286 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2010-03-01 21:46 587178 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-03-01 20:52 587178 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-03-01 20:52 101250 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-03-01 21:46 101250 c:\windows\System32\perfc009.dat
- 2009-05-03 19:16 . 2010-03-01 20:12 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-05-03 19:16 . 2010-03-01 21:37 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 68856]
"Steam"="c:\program files\steam\steam.exe" [2010-02-20 1217872]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2009-12-18 427328]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-03 30192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-01 151552]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-23 122880]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"COMODO livePCsupport"="c:\program files\COMODO\livePCsupport\ELPS.exe" [2009-05-08 689416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):80,4e,dc,4d,53,3d,ca,01

R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [8.5.2008 23:56 61424]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3.3.2008 12:11 16384]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [8.5.2008 23:57 81504]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [8.5.2008 23:54 24576]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [6.4.2008 21:42 50424]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [8.5.2008 23:57 122368]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [25.12.2009 21:02 691696]
S2 gupdate1ca32557f3515b2;Služba Google Update (gupdate1ca32557f3515b2);c:\program files\Google\Update\GoogleUpdate.exe [10.9.2009 21:30 133104]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe --> c:\program files\ICQ6Toolbar\ICQ Service.exe [?]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4.4.2008 2:03 131072]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21.1.2008 3:23 179712]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [23.12.2008 20:02 30192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-10 20:29]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-10 20:29]

2010-03-01 c:\windows\Tasks\User_Feed_Synchronization-{16A7BE2C-AFF1-46E3-B7A8-9544EB37D06E}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0405&s=2&o=vp32&d=1208&m=aspire_5735
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
Trusted Zone: mojebanka.cz\www
Trusted Zone: postovnisporitelna.cz\www
TCP: {8E008CDB-00D9-4A39-88C9-3B521BD09D3A} = 10.16.5.254,93.89.159.2,82.108.56.105
FF - ProfilePath - c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\
FF - prefs.js: browser.search.selectedEngine - Facebook
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - component: c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
FF - component: c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\users\Lenka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 22:49
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-03-01 22:51:56
ComboFix-quarantined-files.txt 2010-03-01 21:51
ComboFix2.txt 2010-03-01 20:57

Před spuštěním: Volných bajtů: 32 378 826 752
Po spuštění: Volných bajtů: 32 329 166 848

- - End Of File - - 169CF86FB3E1C24C4299EBA3D8605EC4

[motji]

Vy jste ho ale měla spustit se skriptem, co jsem psala o dva příspěvky výš .
Prosím pustte ho ještě jednou s tím skriptem

[lenienka]

Jojo pardon, tak tady to je:
ComboFix 10-03-01.01 - Lenka 01.03.2010 23:01:26.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3000.1951 [GMT 1:00]
Spuštěný z: c:\users\Lenka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Lenka\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ICQ Service


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-01 do 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-03-01 22:06 . 2010-03-01 22:08 -------- d-----w- c:\users\Lenka\AppData\Local\temp
2010-03-01 22:06 . 2010-03-01 22:06 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-01 17:48 . 2010-03-01 17:48 -------- d-----w- c:\users\Lenka\AppData\Roaming\Malwarebytes
2010-03-01 17:48 . 2010-03-01 17:48 -------- d-----w- c:\programdata\Malwarebytes
2010-03-01 17:48 . 2010-03-01 21:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-01 17:40 . 2010-03-01 17:40 -------- d-----w- c:\program files\CCleaner
2010-03-01 17:20 . 2010-03-01 17:20 -------- d-----w- C:\_OTM
2010-03-01 12:13 . 2010-03-01 19:24 -------- d-----w- c:\program files\trend micro
2010-03-01 12:13 . 2010-03-01 13:10 -------- d-----w- C:\rsit
2010-02-27 13:25 . 2010-02-27 13:25 -------- d-----w- c:\programdata\hps
2010-02-27 12:58 . 2010-02-27 12:58 -------- d-----w- c:\program files\dm
2010-02-27 12:57 . 2010-02-27 12:58 -------- d-----w- c:\program files\Happy Eyes
2010-02-23 19:45 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-23 19:44 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-23 19:44 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-23 19:44 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-23 19:44 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-23 19:44 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-23 19:44 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-23 19:44 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-23 19:44 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-23 19:44 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-23 19:44 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-23 19:43 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-23 19:43 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-02-21 19:00 . 2010-02-21 19:00 -------- d-----w- c:\users\Lenka\AppData\Roaming\Facebook
2010-02-09 19:03 . 2009-12-11 11:43 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-09 19:03 . 2009-12-11 11:43 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-09 19:01 . 2009-12-04 15:56 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-09 19:01 . 2009-12-04 15:56 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-09 08:58 . 2010-02-09 08:58 -------- d-----w- c:\users\Lenka\AppData\Local\AOL
2010-02-09 08:57 . 2010-02-18 05:47 -------- d-----w- c:\program files\ICQ7.0
2010-02-06 19:38 . 2010-02-06 19:40 -------- d-----w- c:\program files\Fiona Finch and the Finest Flowers
2010-02-06 19:34 . 2010-02-06 19:34 -------- d-----w- c:\program files\bfgclient
2010-02-06 19:32 . 2010-02-06 19:41 -------- d-----w- C:\BigFishGamesCache
2010-02-05 19:39 . 2010-03-01 20:37 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-02-05 19:34 . 2010-03-01 20:38 -------- d-----w- c:\program files\COMODO
2010-02-05 19:34 . 2010-02-05 19:34 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-02-05 19:07 . 2010-02-05 19:07 -------- d-----w- c:\program files\uTorrent
2010-02-05 19:06 . 2010-03-01 09:56 -------- d-----w- c:\users\Lenka\AppData\Roaming\uTorrent
2010-02-05 18:46 . 2010-02-05 18:46 -------- d-----w- c:\users\Lenka\AppData\Local\Mozilla
2010-02-04 19:15 . 2010-02-04 19:15 -------- d-----w- c:\users\Lenka\logs

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 22:06 . 2008-12-23 19:03 12 ----a-w- c:\windows\bthservsdp.dat
2010-03-01 21:46 . 2008-05-09 08:18 598832 ----a-w- c:\windows\system32\perfh005.dat
2010-03-01 21:46 . 2008-05-09 08:18 114992 ----a-w- c:\windows\system32\perfc005.dat
2010-03-01 21:35 . 2009-05-19 20:57 -------- d-----w- c:\program files\Steam
2010-03-01 21:20 . 2009-05-19 20:57 -------- d-----w- c:\program files\Common Files\Steam
2010-03-01 20:38 . 2009-01-29 17:16 5972 ----a-w- c:\users\Lenka\AppData\Local\d3d9caps.dat
2010-03-01 08:29 . 2009-10-22 18:34 -------- d-----w- c:\programdata\CanonIJPLM
2010-02-28 21:30 . 2009-03-13 19:09 -------- d-----w- c:\users\Lenka\AppData\Roaming\Skype
2010-02-27 12:58 . 2008-12-23 19:04 72232 ----a-w- c:\users\Lenka\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-24 08:16 . 2009-10-03 05:28 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-21 19:00 . 2010-02-21 19:00 50354 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\uninstall.exe
2010-02-10 21:07 . 2009-10-26 12:11 -------- d-----w- c:\program files\HP Games
2010-02-10 20:49 . 2009-10-26 12:24 1762568 ----a-w- c:\programdata\WildTangent\My HP Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2010-02-10 20:48 . 2009-01-25 13:17 -------- d-----w- c:\users\Lenka\AppData\Roaming\Farm Mania
2010-02-10 06:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-09 09:02 . 2009-10-20 06:29 -------- d-----w- c:\users\Lenka\AppData\Roaming\ICQ
2010-02-09 08:59 . 2008-05-08 22:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-09 08:59 . 2009-10-20 06:30 -------- d-----w- c:\programdata\ICQ
2010-02-06 22:21 . 2009-10-26 12:11 -------- d-----w- c:\programdata\WildTangent
2010-02-06 19:26 . 2009-05-26 07:15 -------- d-----w- c:\program files\Supermarket Mania
2010-02-06 19:24 . 2009-07-29 19:10 -------- d-----w- c:\program files\RealArcade
2010-02-06 19:24 . 2008-05-08 22:38 -------- d-----w- c:\program files\Acer GameZone
2010-02-06 19:23 . 2009-02-21 18:57 -------- d-----w- c:\program files\Magic Farm
2010-02-06 19:18 . 2009-02-16 17:01 -------- d-----w- c:\program files\Alawar
2010-02-05 21:11 . 2009-02-08 18:04 -------- d-----w- c:\programdata\GamesBar
2010-02-05 21:06 . 2009-09-10 20:45 -------- d-----w- c:\program files\iWin.com
2010-02-05 21:06 . 2009-09-10 13:54 -------- d-----w- c:\program files\Supple
2010-02-05 21:03 . 2008-12-29 18:02 -------- d-----w- c:\program files\Play
2010-02-05 19:28 . 2008-05-08 22:30 -------- d-----w- c:\programdata\McAfee
2010-02-04 18:48 . 2010-02-04 18:48 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb32D.tmp.exe
2010-02-03 22:06 . 2009-01-28 21:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-01 22:04 . 2010-02-01 22:04 847040 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\axfbootloader.dll
2010-02-01 22:04 . 2010-02-01 22:04 5578752 ----a-w- c:\users\Lenka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
2010-01-28 19:54 . 2010-01-28 19:54 -------- d-----w- c:\users\Lenka\AppData\Roaming\1morebee
2010-01-27 21:31 . 2009-12-12 20:34 -------- d-----w- c:\programdata\Artist Colony
2010-01-26 21:30 . 2008-12-24 21:47 -------- d-----w- c:\users\Lenka\AppData\Roaming\PlayFirst
2010-01-26 21:30 . 2008-12-24 21:47 -------- d-----w- c:\programdata\PlayFirst
2010-01-26 19:57 . 2010-01-26 19:57 -------- d-----w- c:\program files\IKEA HomePlanner
2010-01-26 19:57 . 2010-01-26 19:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-22 20:27 . 2010-01-22 20:27 -------- d-----w- c:\users\Lenka\AppData\Roaming\Boomzap
2010-01-21 20:46 . 2009-02-08 13:45 -------- d-----w- c:\users\Lenka\AppData\Roaming\Friday's games
2010-01-20 17:42 . 2009-02-06 20:35 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 20:05 . 2009-10-23 17:54 -------- d-----w- c:\programdata\CanonIJ
2010-01-09 18:34 . 2010-01-09 18:34 -------- d-----w- c:\program files\EA GAMES
2010-01-07 18:14 . 2010-01-07 18:10 -------- d-----w- c:\programdata\FarmFrenzy3_America
2010-01-07 18:05 . 2010-01-07 18:05 515848 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-06 15:38 . 2010-02-23 19:44 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-01-06 15:38 . 2010-02-23 19:44 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-01-06 15:38 . 2010-02-23 19:43 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-01-06 15:38 . 2010-02-23 19:43 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-01-05 11:53 . 2010-01-05 11:29 -------- d-----w- c:\program files\Winamp
2010-01-05 11:29 . 2010-01-05 11:29 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-01-05 11:23 . 2009-11-11 19:22 -------- d-----w- c:\users\Lenka\AppData\Roaming\DVD Flick
2010-01-03 20:38 . 2009-06-24 12:38 -------- d-----w- c:\users\Lenka\AppData\Roaming\BlamGames
2010-01-02 19:19 . 2010-01-02 19:19 -------- d-----w- c:\users\Lenka\AppData\Roaming\Exec
2010-01-02 19:18 . 2010-01-02 19:18 -------- d-----w- c:\programdata\Exec
2010-01-02 19:18 . 2010-01-02 19:18 -------- d-----w- c:\program files\Exec
2010-01-02 06:38 . 2010-01-22 05:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:51 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:51 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:51 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-25 20:02 . 2009-12-25 20:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-16 15:05 . 2010-02-05 21:27 471040 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
2009-12-16 15:05 . 2010-02-05 21:27 347136 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-12-16 15:05 . 2010-02-05 21:27 340992 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-12-16 15:05 . 2010-02-05 21:27 43008 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-12-16 15:05 . 2010-02-05 21:27 1452032 ----a-w- c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-12-08 20:01 . 2010-02-09 19:02 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-09 19:02 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-09 19:02 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-09 19:02 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-04 18:30 . 2010-02-09 19:02 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-09 19:02 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-09 19:02 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-09 19:02 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-09 19:02 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-09 19:02 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-09 19:02 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-09 19:02 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-09 19:02 91136 ----a-w- c:\windows\system32\avifil32.dll
2008-12-24 10:25 . 2008-12-24 10:24 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 68856]
"Steam"="c:\program files\steam\steam.exe" [2010-02-20 1217872]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2009-12-18 427328]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-03 30192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-01 151552]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-23 122880]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"COMODO livePCsupport"="c:\program files\COMODO\livePCsupport\ELPS.exe" [2009-05-08 689416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):80,4e,dc,4d,53,3d,ca,01

R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [8.5.2008 23:56 61424]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3.3.2008 12:11 16384]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [8.5.2008 23:57 81504]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [8.5.2008 23:54 24576]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [6.4.2008 21:42 50424]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [8.5.2008 23:57 122368]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4.4.2008 2:03 131072]
S2 gupdate1ca32557f3515b2;Služba Google Update (gupdate1ca32557f3515b2);c:\program files\Google\Update\GoogleUpdate.exe [10.9.2009 21:30 133104]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21.1.2008 3:23 179712]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [23.12.2008 20:02 30192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-10 20:29]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-10 20:29]

2010-03-01 c:\windows\Tasks\User_Feed_Synchronization-{16A7BE2C-AFF1-46E3-B7A8-9544EB37D06E}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0405&s=2&o=vp32&d=1208&m=aspire_5735
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
Trusted Zone: mojebanka.cz\www
Trusted Zone: postovnisporitelna.cz\www
TCP: {8E008CDB-00D9-4A39-88C9-3B521BD09D3A} = 10.16.5.254,93.89.159.2,82.108.56.105
FF - ProfilePath - c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\
FF - prefs.js: browser.search.selectedEngine - Facebook
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
FF - component: c:\users\Lenka\AppData\Roaming\Mozilla\Firefox\Profiles\a8ehjb18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\users\Lenka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 23:08
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x858AC1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8a9a0d24
\Driver\ACPI -> acpi.sys @ 0x807b6d68
\Driver\atapi -> 0x858ac1f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(2592)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conime.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-03-01 23:13:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-01 22:13
ComboFix2.txt 2010-03-01 21:51
ComboFix3.txt 2010-03-01 20:57

Před spuštěním: Volných bajtů: 32 367 898 624
Po spuštění: Volných bajtů: 32 157 167 616

- - End Of File - - 582313E87C525776484D3DDC39576848

[motji]

Tak v posledním logu z combofixu se něco objevilo, co musím ověřit, ještě Vás chviličku potrápím .

Používáte Daemon nebo alcohol?

[lenienka]

Daemon v počítači mám,ale nepoužívám ho.

[motji]

Tak ho ted odinstalujte, zkreslil by výsledky Gmeru, a uvidíme
Já tu budu zítra dopoledne a pak zase večer


odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC
- spusťte gmer


Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde

[lenienka]

SPTD mi po spuštění píše:
C:\Users\Lenka\Desktop\SPTDinst-v162-x86.exe není platná aplikace typu Win32.

[motji]

Možná nefunguje na vistách .

Stahněte http://www.jpshortstuff.247fixes.com/Defogger.exe
- zmáčkněte tlačítko disable,
-restartujte pc,



Pak pokračujte s Gmerem, pokud by Gmer nešel nebo zlobil v běžném režimu, zkuste ho spustit v nouzovém.

[lenienka]

Výsledek Gmeru,doufám,že to je celý,ale už to nic nedělalo:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-02 00:00:04
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Lenka\AppData\Local\Temp\pgrdypow.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Společnost Microsoft)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

[motji]

Podívejte se pořádně na návod ke Gmeru co je v odkaze, potřebuji ještě druhý log