Prosím o kontrolu - špatné načítání stránek

[Vicious]

Prosím o kontrolu logu, špatně se mi načítají některé stránky na internetu, trvá to asi třetí den, před tím to fungovalo bez problémů. Děkuji.



Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2010-03-01 15:06:47
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 60 GB (78%) free of 76 GB
Total RAM: 1023 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:59, on 1.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\OO Software\Defrag\oodag.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\totalcmd\TOTALCMD.EXE
C:\Documents and Settings\Petr\Dokumenty\Downloads\Programs\RSIT.exe
C:\Program Files\trend micro\Petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: XoftSpyService - ParetoLogic Inc. - C:\Program Files\Common Files\XoftSpySE\6\xoftspyservice.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Petr/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg

--
End of file - 10543 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\ParetoLogic Update Version3.job
C:\WINDOWS\tasks\XoftSpySE.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2009-05-07 169392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
SnagIt Toolbar Loader - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll [2008-11-06 68936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll [2009-10-19 520192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-21 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-21 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll [2009-10-19 520192]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - Snagit - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll [2008-11-06 211272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [2002-07-10 188416]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-02-24 335872]
"OODefragTray"=C:\Program Files\OO Software\Defrag\oodtray.exe [2009-09-12 2524416]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-02-24 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\uTorrent\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"

======File associations======

.js - open - NOTEPAD.EXE %1
.reg - open - NOTEPAD.EXE %1
.scr - open - NOTEPAD.EXE %1
.vbs - open - NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2010-02-28 09:06:19 ----D---- C:\WINDOWS\SxsCaPendDel
2010-02-28 08:27:08 ----D---- C:\Documents and Settings\Petr\Data aplikací\Apple Computer
2010-02-28 08:24:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-02-28 08:23:31 ----D---- C:\Program Files\Bonjour
2010-02-28 08:21:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-02-28 08:17:31 ----D---- C:\Program Files\Common Files\Apple
2010-02-28 08:17:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2010-02-24 14:05:40 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-21 10:22:14 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2010-02-20 20:19:47 ----D---- C:\Documents and Settings\Petr\Data aplikací\skypePM
2010-02-20 20:16:58 ----D---- C:\Documents and Settings\Petr\Data aplikací\Skype
2010-02-20 20:13:29 ----D---- C:\Program Files\Common Files\Skype
2010-02-20 20:13:20 ----RD---- C:\Program Files\Skype
2010-02-20 20:12:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2010-02-20 18:42:14 ----D---- C:\rsit
2010-02-20 11:57:01 ----A---- C:\WINDOWS\system32\vbuzip10.DLL
2010-02-20 11:57:00 ----A---- C:\WINDOWS\system32\wt_menu.dll
2010-02-20 11:57:00 ----A---- C:\WINDOWS\system32\ssubtmr6.dll
2010-02-20 11:56:55 ----D---- C:\Program Files\Smarty Uninstaller Pro
2010-02-20 09:51:07 ----D---- C:\Documents and Settings\Petr\Data aplikací\Kastner software
2010-02-20 09:45:19 ----D---- C:\Program Files\KASTNER software
2010-02-20 09:45:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\KASTNER software
2010-02-16 18:02:03 ----D---- C:\Program Files\7-Zip
2010-02-16 17:59:12 ----D---- C:\Program Files\StrongDC++
2010-02-16 14:32:01 ----D---- C:\Documents and Settings\Petr\Data aplikací\Thunderbird
2010-02-16 14:31:26 ----D---- C:\Program Files\Mozilla Thunderbird
2010-02-13 12:54:48 ----D---- C:\Program Files\Miranda-0.7.1-DcPack
2010-02-13 11:46:06 ----D---- C:\Documents and Settings\Petr\Data aplikací\CyberLink
2010-02-13 11:42:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\CyberLink
2010-02-13 11:42:11 ----D---- C:\Program Files\Common Files\CyberLink
2010-02-13 11:39:50 ----D---- C:\Program Files\CyberLink
2010-02-13 11:38:27 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-02-10 21:23:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 21:23:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 21:18:27 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 21:18:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 21:18:01 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 21:17:48 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 21:15:29 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 21:15:07 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 21:14:45 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-07 17:02:05 ----D---- C:\RTSStavitel
2010-02-07 09:51:50 ----D---- C:\Program Files\ABAK
2010-02-07 09:50:36 ----A---- C:\WINDOWS\IsUn0405.exe

======List of files/folders modified in the last 1 months======

2010-03-01 15:06:54 ----D---- C:\WINDOWS\Prefetch
2010-03-01 15:06:51 ----D---- C:\Program Files\trend micro
2010-03-01 14:50:33 ----D---- C:\Program Files\Mozilla Firefox
2010-03-01 14:25:24 ----D---- C:\WINDOWS\Temp
2010-03-01 14:25:22 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-28 20:06:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-28 18:16:37 ----D---- C:\Program Files\Soulseek
2010-02-28 17:58:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\iolo
2010-02-28 17:42:50 ----D---- C:\Documents and Settings\Petr\Data aplikací\DMCache
2010-02-28 11:01:02 ----AD---- C:\WINDOWS
2010-02-28 11:01:02 ----A---- C:\WINDOWS\TRNCOM.INI
2010-02-28 10:47:00 ----D---- C:\Program Files\FreeRapid-0.83u1
2010-02-28 09:18:11 ----RD---- C:\Program Files
2010-02-28 09:17:10 ----SHD---- C:\WINDOWS\Installer
2010-02-28 09:15:47 ----D---- C:\WINDOWS\system32
2010-02-28 09:03:42 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-28 09:03:41 ----HD---- C:\WINDOWS\inf
2010-02-28 08:43:21 ----D---- C:\WINDOWS\system32\drivers
2010-02-28 08:22:47 ----D---- C:\Program Files\Internet Explorer
2010-02-28 08:17:41 ----D---- C:\WINDOWS\WinSxS
2010-02-28 08:17:31 ----D---- C:\Program Files\Common Files
2010-02-28 07:55:32 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-27 09:22:19 ----D---- C:\WINDOWS\system32\config
2010-02-24 18:35:12 ----D---- C:\Documents and Settings\Petr\Data aplikací\.RTS
2010-02-24 14:06:12 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 14:06:09 ----D---- C:\WINDOWS\ie8updates
2010-02-24 14:05:54 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-20 16:08:18 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-02-20 15:57:26 ----D---- C:\Program Files\VS Revo Group
2010-02-18 15:18:07 ----D---- C:\UniScan
2010-02-13 11:55:31 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-11 18:46:42 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-02-10 21:17:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 SbFw;SbFw; C:\WINDOWS\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/02/13 11:42:46]; \??\C:\Program Files\CyberLink\PowerDVD9\000.fcl []
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-01-10 56816]
R2 MVDCODEC;ATI WDM Specialized MVD Codec; C:\WINDOWS\system32\DRIVERS\atinmdxx.sys [2003-10-21 13824]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-02-24 679424]
R3 atinrvxx;ATI WDM Rage Theater Video; C:\WINDOWS\system32\DRIVERS\atinrvxx.sys [2003-10-21 104960]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 HCF_MSFT;HCF_MSFT; C:\WINDOWS\system32\DRIVERS\HCF_MSFT.sys [2001-10-24 907456]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-11-17 47360]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VIAudio;VIA AC'97 Enhanced Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2001-11-08 42752]
S3 a2skgfli;a2skgfli; C:\WINDOWS\system32\drivers\a2skgfli.sys []
S3 aq1pi5m2;aq1pi5m2; C:\WINDOWS\system32\drivers\aq1pi5m2.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Revoflt;Revoflt; C:\WINDOWS\system32\DRIVERS\revoflt.sys [2009-12-30 27064]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-02-24 397312]
R2 ioloFileInfoList;iolo FileInfoList Service; C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2009-08-12 615280]
R2 ioloSystemService;iolo System Service; C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2009-08-12 615280]
R2 O&O Defrag;O&O Defrag; C:\Program Files\OO Software\Defrag\oodag.exe [2009-09-12 1488128]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2009-10-19 1365288]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-02-24 516096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-19 651720]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 XoftSpyService;XoftSpyService; C:\Program Files\Common Files\XoftSpySE\6\xoftspyservice.exe [2009-08-28 582424]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-21 152984]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Tom8sh16]

Dobrý den.

Co znamená "špatně se načítají stránky"?

[Vicious]

Některé stránky se načítají hrozně pomalu, nebo se nenačtou vůbec.

[Tom8sh16]

Stáhněte na plochu ComboFix.
▪ Před použitím ComboFixu je doporučeno vypnout všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary. Mohou zasahovat do činnosti ComboFixu, což může způsobit, že nebude fungovat korektně.
▪ Po spuštění potvrďte podmínky užití.
▪ Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujících se oken.
▪ Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem.
▪ ComboFix je třeba spustit pod účtem s právy administrátora.

[Vicious]

ComboFix 10-02-28.04 - Petr 01.03.2010 19:02:22.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.685 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\regedit.com
c:\windows\system32\taskmgr.com

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-01 do 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-02-28 08:06 . 2010-02-28 08:19 -------- d-----w- c:\windows\SxsCaPendDel
2010-02-28 07:23 . 2010-02-28 08:19 -------- d-----w- c:\program files\Bonjour
2010-02-28 07:17 . 2010-02-28 08:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-21 09:22 . 2010-02-21 09:22 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-02-20 19:19 . 2010-02-20 19:19 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-02-20 19:13 . 2010-02-20 19:13 -------- d-----w- c:\program files\Common Files\Skype
2010-02-20 19:13 . 2010-02-20 19:16 -------- d-----r- c:\program files\Skype
2010-02-20 17:42 . 2010-02-20 17:42 -------- d-----w- C:\rsit
2010-02-20 14:57 . 2009-12-30 10:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2010-02-20 10:57 . 1999-02-09 20:40 188928 ----a-w- c:\windows\system32\vbuzip10.DLL
2010-02-20 10:57 . 2007-08-15 12:09 159744 ----a-w- c:\windows\system32\wt_menu.dll
2010-02-20 10:57 . 2007-08-15 12:09 40960 ----a-w- c:\windows\system32\ssubtmr6.dll
2010-02-20 10:56 . 2010-02-20 10:59 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2010-02-20 08:45 . 2010-02-20 08:45 -------- d-----w- c:\program files\KASTNER software
2010-02-16 17:02 . 2010-02-16 17:02 -------- d-----w- c:\program files\7-Zip
2010-02-16 16:59 . 2010-02-16 17:18 -------- d-----w- c:\program files\StrongDC++
2010-02-16 13:31 . 2010-03-01 16:30 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-13 11:54 . 2010-02-15 15:16 -------- d-----w- c:\program files\Miranda-0.7.1-DcPack
2010-02-13 10:42 . 2010-02-13 10:42 -------- d-----w- c:\program files\Common Files\CyberLink
2010-02-13 10:39 . 2010-02-13 10:42 -------- d-----w- c:\program files\CyberLink
2010-02-13 10:38 . 2010-02-13 10:49 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-02-07 16:02 . 2010-02-24 19:21 -------- d-----w- C:\RTSStavitel
2010-02-07 08:51 . 2010-02-21 08:03 -------- d-----w- c:\program files\ABAK
2010-02-07 08:50 . 1998-01-23 11:19 304640 ----a-w- c:\windows\IsUn0405.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 14:06 . 2010-01-16 07:44 -------- d-----w- c:\program files\trend micro
2010-02-28 17:16 . 2009-12-13 15:08 -------- d-----w- c:\program files\Soulseek
2010-02-28 09:47 . 2009-11-04 13:18 -------- d-----w- c:\program files\FreeRapid-0.83u1
2010-02-20 14:57 . 2009-10-19 17:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-13 10:55 . 2009-10-19 15:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-30 17:33 . 2010-01-30 17:33 -------- d-----w- c:\program files\BearShare Applications
2010-01-30 16:38 . 2010-01-30 16:38 -------- d-----w- c:\program files\eMule
2010-01-30 09:43 . 2010-01-30 09:13 -------- d-----w- c:\program files\Visual Business Cards
2010-01-28 18:07 . 2010-01-28 18:07 -------- d-----w- c:\program files\Avira
2010-01-22 15:23 . 2010-01-22 15:21 -------- d-----w- c:\program files\Milan's GUI
2010-01-16 14:50 . 2010-01-16 14:50 -------- d-----w- c:\program files\Trojan Remover
2010-01-16 11:57 . 2010-01-16 11:57 626688 ----a-w- c:\windows\system32\msvcr80.dll
2010-01-16 11:57 . 2010-01-16 11:57 548864 ----a-w- c:\windows\system32\msvcp80.dll
2010-01-16 11:57 . 2010-01-16 11:57 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-01-15 08:45 . 2010-01-15 08:45 28672 ----a-w- c:\windows\system32\eEmpty.exe
2010-01-10 11:49 . 2010-01-10 11:49 -------- d-----w- c:\program files\XemiComputers
2010-01-10 09:40 . 2009-10-19 14:25 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-31 16:50 . 2008-04-13 22:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2008-04-14 06:52 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2009-10-19 13:23 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2008-04-14 06:51 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 15:46 . 2001-10-25 11:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2009-12-09 15:46 . 2001-10-25 11:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2009-12-09 10:11 . 2008-04-14 08:06 2068224 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:11 . 2008-04-14 06:07 2191360 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-10-19 18:21 . 2009-10-19 18:21 11963 ----a-w- c:\program files\un_Internet Download Manager_16575.txt
2008-09-28 20:00 . 2009-10-19 18:21 439440 ----a-w- c:\program files\un_Internet Download Manager_16575.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-07-10 188416]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-02-24 335872]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2009-09-11 2524416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"OEXPRESS"=c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" /s
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [19.10.2009 14:54 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 3:54 66600]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/02/13 11:42];c:\program files\CyberLink\PowerDVD9\000.fcl [1.9.2009 16:59 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [28.1.2010 19:07 108289]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19.10.2009 19:30 615280]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19.10.2009 19:30 615280]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 6:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 6:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [19.10.2009 14:54 65576]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.10.2009 17:37 721904]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [20.2.2010 15:57 27064]
S3 XoftSpyService;XoftSpyService;c:\program files\Common Files\XoftSpySE\6\xoftspyservice.exe [28.8.2009 22:15 582424]
.
Obsah adresáře 'Naplánované úlohy'

2009-10-19 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-28 21:15]

2009-10-19 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE6\XoftSpySELauncher.exe [2009-08-28 21:13]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.bearshare.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\i7ggokpx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
------- Asociace souborů -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 19:15
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{39abad19-8b0c-4f2d-bae1-e538624126d9}]
@Denied: (Full) (Everyone)
"Model"=dword:0000001b
"Therad"=dword:00000002
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):22,18,d2,6e,e5,7d,f8,d6,1e,34,75,98,56,83,88,22,c9,d3,6e,e9,1b,
b6,29,8b,9d,38,05,0a,3d,97,85,38,1b,20,0d,4d,c8,59,a1,26,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="0E328AD4C75DDD42BB973746E813A429F1C47A030E4BC2C1845EF750CA39DB5A4A1708717F34FD1ED86D6293A2E2162056C6650397B67E42D14D64B814BA96E13CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452C038D530D6EB3452A6A0AC4980AC79339C9399482ECC4C15AD75DE315DD219D4B0F63818AFA6285D7CC963BFE5E205F215EEC8C056B88CAF0C85806A3707A072BAACADC03B86295B417B26FD7E02615BDDFE6D29C2227A5413CAF53E7D4A0BC31722C367B201D2041D244B3B9FE6451A6792329CBC4970952D21D09A863627FACEDA10E818A7084956900EE91BC04A8154E0183D8396DBC5FBC7766F1D0A580F9EBD7C2AE33443E3E771FAFB34DE9C29FC04F2AFC8914101D45F1D340128163AF817C70F02020F4E015A786827B67F6EEA776A9B31683422BEEF546163186A7983160205D30F8C4703443A2D1D61C5EFDF1E7AAD596EE04C76E27CF46E047590174D12782D826FD2858B4C483A1B5A14CD3DF097CC1984E2ED8648703ABBEA83C23532DDD3A2013752708DBD9146BA02DD7DF38D8E81718F480E42D9D7B1919EC5A9ED2B86DA9C80E798AF15AC6577A5EAEB7A4994E58F40DD8F473A497DC56F17E72A5A733C327CF80A3BDA89A2362F837BD00449A8D6A53C058720055874C6E0941A6BBF79C6BF6C33891D184BAE926C8016828ACED634A2CD881D77A2A3BC7EB8C85F026BF2A1DC634A71BE5030881CB4BD86AA03B1A6082BA1C5FE5F682A03BC143EC70E62BB97CF7FEDD3459B8DBF3511DA6E149D7812C381356EB36FAC35F1AD919180D56DA08F01AE2765E560B4832A4A117164EB1FA227878D6D76290B0C1AE8D18620DAADA0F753F78B9885908679A5C032E506BE35E7DF96F8D24335203557F0892BEA29E26480FCB8CFC5190542C31F91928FB5CE6C62B8696AE4942C2B72CA93F2C9B19919DB5D13BE2ECAAD9DFAC1EA7115FCA6B23A9777B83E3D8E7E54305608639AEE3C1337E2298CD591F528B2C21DE941D40A94497C4D40F98A051DE4A38D6E6A6EC9541C15E8F61CA70D2DEFBDC220E2D997A259774B2148C7676F20753C60D9880F54103A6AC536C6F36D6C242614F416D49A460CEA5AD95125F08E66E1F3D9912FCA8B873113EFAE93D28E679CDFC1D18E350480F42C92170FCCD0365C2A0BC121727CD55040C700A8492E969067C436E331F8BFCA160FEBCAB27A4A21C34437308AC4227171F1BEC1411B69804E30D2CB4F81D85F619908525393A9B84911EF7AD7B70DD28F5656C33017387D7D66198D56E9FE3A15B586736518003E06AFD072A2205BC5451013650E5881B02301DF468E7889F58018E5D025771D64899223E0B4B8F6AE04EDA6335708E751304D6167C6617141"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(584)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-03-01 19:20:48
ComboFix-quarantined-files.txt 2010-03-01 18:20

Před spuštěním: Volných bajtů: 62 358 679 552
Po spuštění: Volných bajtů: 62 507 941 888

- - End Of File - - 95DEB13E51FD714B4F51D7A733EC0E13

[Tom8sh16]

Přesuňte Combofix na plochu (pokud tam již není)

K následujícímu úkonu je potřeba, abyste měl/a administrátorská práva

Otevřete poznámkový blok (Notepad) a zkopírujte do něj následující text:

Kód: Vybrat vše

KillAll::
DDS::
uStart Page = hxxp://search.bearshare.com/

Soubor uložte na plochu jako CFScript.txt a podle obrázku přetáhněte nad ComboFix:

spustí se ComboFix a vykoná příkaz ze skriptu - potom pošlete nový log

[Vicious]

ComboFix 10-02-28.04 - Petr 02.03.2010 21:30:32.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.673 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Petr\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-02 do 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-03-02 15:32 . 2010-03-02 16:00 -------- d-----w- c:\program files\VisualConnection
2010-02-28 08:06 . 2010-02-28 08:19 -------- d-----w- c:\windows\SxsCaPendDel
2010-02-28 07:23 . 2010-02-28 08:19 -------- d-----w- c:\program files\Bonjour
2010-02-28 07:17 . 2010-02-28 08:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-21 09:22 . 2010-02-21 09:22 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-02-20 19:19 . 2010-02-20 19:19 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-02-20 19:13 . 2010-02-20 19:13 -------- d-----w- c:\program files\Common Files\Skype
2010-02-20 19:13 . 2010-02-20 19:16 -------- d-----r- c:\program files\Skype
2010-02-20 17:42 . 2010-02-20 17:42 -------- d-----w- C:\rsit
2010-02-20 14:57 . 2009-12-30 10:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2010-02-20 10:57 . 1999-02-09 20:40 188928 ----a-w- c:\windows\system32\vbuzip10.DLL
2010-02-20 10:57 . 2007-08-15 12:09 159744 ----a-w- c:\windows\system32\wt_menu.dll
2010-02-20 10:57 . 2007-08-15 12:09 40960 ----a-w- c:\windows\system32\ssubtmr6.dll
2010-02-20 10:56 . 2010-02-20 10:59 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2010-02-20 08:45 . 2010-02-20 08:45 -------- d-----w- c:\program files\KASTNER software
2010-02-16 17:02 . 2010-02-16 17:02 -------- d-----w- c:\program files\7-Zip
2010-02-16 16:59 . 2010-02-16 17:18 -------- d-----w- c:\program files\StrongDC++
2010-02-16 13:31 . 2010-03-02 17:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-13 11:54 . 2010-02-15 15:16 -------- d-----w- c:\program files\Miranda-0.7.1-DcPack
2010-02-13 10:42 . 2010-02-13 10:42 -------- d-----w- c:\program files\Common Files\CyberLink
2010-02-13 10:39 . 2010-02-13 10:42 -------- d-----w- c:\program files\CyberLink
2010-02-13 10:38 . 2010-02-13 10:49 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-02-07 16:02 . 2010-03-02 19:55 -------- d-----w- C:\RTSStavitel
2010-02-07 08:51 . 2010-02-21 08:03 -------- d-----w- c:\program files\ABAK
2010-02-07 08:50 . 1998-01-23 11:19 304640 ----a-w- c:\windows\IsUn0405.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 14:06 . 2010-01-16 07:44 -------- d-----w- c:\program files\trend micro
2010-02-28 17:16 . 2009-12-13 15:08 -------- d-----w- c:\program files\Soulseek
2010-02-28 09:47 . 2009-11-04 13:18 -------- d-----w- c:\program files\FreeRapid-0.83u1
2010-02-20 14:57 . 2009-10-19 17:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-13 10:55 . 2009-10-19 15:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-30 17:33 . 2010-01-30 17:33 -------- d-----w- c:\program files\BearShare Applications
2010-01-30 16:38 . 2010-01-30 16:38 -------- d-----w- c:\program files\eMule
2010-01-30 09:43 . 2010-01-30 09:13 -------- d-----w- c:\program files\Visual Business Cards
2010-01-28 18:07 . 2010-01-28 18:07 -------- d-----w- c:\program files\Avira
2010-01-22 15:23 . 2010-01-22 15:21 -------- d-----w- c:\program files\Milan's GUI
2010-01-16 14:50 . 2010-01-16 14:50 -------- d-----w- c:\program files\Trojan Remover
2010-01-16 11:57 . 2010-01-16 11:57 626688 ----a-w- c:\windows\system32\msvcr80.dll
2010-01-16 11:57 . 2010-01-16 11:57 548864 ----a-w- c:\windows\system32\msvcp80.dll
2010-01-16 11:57 . 2010-01-16 11:57 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-01-15 08:45 . 2010-01-15 08:45 28672 ----a-w- c:\windows\system32\eEmpty.exe
2010-01-10 11:49 . 2010-01-10 11:49 -------- d-----w- c:\program files\XemiComputers
2010-01-10 09:40 . 2009-10-19 14:25 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-31 16:50 . 2008-04-13 22:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2008-04-14 06:52 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2009-10-19 13:23 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2008-04-14 06:51 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 15:46 . 2001-10-25 11:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2009-12-09 15:46 . 2001-10-25 11:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2009-12-09 10:11 . 2008-04-14 08:06 2068224 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:11 . 2008-04-14 06:07 2191360 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-10-19 18:21 . 2009-10-19 18:21 11963 ----a-w- c:\program files\un_Internet Download Manager_16575.txt
2008-09-28 20:00 . 2009-10-19 18:21 439440 ----a-w- c:\program files\un_Internet Download Manager_16575.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-07-10 188416]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-02-24 335872]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2009-09-11 2524416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"OEXPRESS"=c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" /s
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.10.2009 17:37 721904]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [19.10.2009 14:54 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 3:54 66600]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/02/13 11:42];c:\program files\CyberLink\PowerDVD9\000.fcl [1.9.2009 16:59 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [28.1.2010 19:07 108289]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19.10.2009 19:30 615280]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19.10.2009 19:30 615280]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 6:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 6:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [19.10.2009 14:54 65576]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [20.2.2010 15:57 27064]
S3 XoftSpyService;XoftSpyService;c:\program files\Common Files\XoftSpySE\6\xoftspyservice.exe [28.8.2009 22:15 582424]
.
Obsah adresáře 'Naplánované úlohy'

2009-10-19 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-28 21:15]

2009-10-19 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE6\XoftSpySELauncher.exe [2009-08-28 21:13]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\i7ggokpx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-02 21:45
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys splx.sys >>UNKNOWN [0x86778938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7872f28
\Driver\ACPI -> ACPI.sys @ 0xf76cccb8
\Driver\atapi -> atapi.sys @ 0xf7687b40
IoDeviceObjectType -> ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{39abad19-8b0c-4f2d-bae1-e538624126d9}]
@Denied: (Full) (Everyone)
"Model"=dword:0000001b
"Therad"=dword:00000002
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):22,18,d2,6e,e5,7d,f8,d6,1e,34,75,98,56,83,88,22,c9,d3,6e,e9,1b,
b6,29,8b,9d,38,05,0a,3d,97,85,38,1b,20,0d,4d,c8,59,a1,26,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="0E328AD4C75DDD42BB973746E813A429F1C47A030E4BC2C1845EF750CA39DB5A4A1708717F34FD1ED86D6293A2E2162056C6650397B67E42D14D64B814BA96E13CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452C038D530D6EB3452A6A0AC4980AC79339C9399482ECC4C15AD75DE315DD219D4B0F63818AFA6285D7CC963BFE5E205F215EEC8C056B88CAF0C85806A3707A072BAACADC03B86295B417B26FD7E02615BDDFE6D29C2227A5413CAF53E7D4A0BC31722C367B201D2041D244B3B9FE6451A6792329CBC4970952D21D09A863627FACEDA10E818A7084956900EE91BC04A8154E0183D8396DBC5FBC7766F1D0A580F9EBD7C2AE33443E3E771FAFB34DE9C29FC04F2AFC8914101D45F1D340128163AF817C70F02020F4E015A786827B67F6EEA776A9B31683422BEEF546163186A7983160205D30F8C4703443A2D1D61C5EFDF1E7AAD596EE04C76E27CF46E047590174D12782D826FD2858B4C483A1B5A14CD3DF097CC1984E2ED8648703ABBEA83C23532DDD3A2013752708DBD9146BA02DD7DF38D8E81718F480E42D9D7B1919EC5A9ED2B86DA9C80E798AF15AC6577A5EAEB7A4994E58F40DD8F473A497DC56F17E72A5A733C327CF80A3BDA89A2362F837BD00449A8D6A53C058720055874C6E0941A6BBF79C6BF6C33891D184BAE926C8016828ACED634A2CD881D77A2A3BC7EB8C85F026BF2A1DC634A71BE5030881CB4BD86AA03B1A6082BA1C5FE5F682A03BC143EC70E62BB97CF7FEDD3459B8DBF3511DA6E149D7812C381356EB36FAC35F1AD919180D56DA08F01AE2765E560B4832A4A117164EB1FA227878D6D76290B0C1AE8D18620DAADA0F753F78B9885908679A5C032E506BE35E7DF96F8D24335203557F0892BEA29E26480FCB8CFC5190542C31F91928FB5CE6C62B8696AE4942C2B72CA93F2C9B19919DB5D13BE2ECAAD9DFAC1EA7115FCA6B23A9777B83E3D8E7E54305608639AEE3C1337E2298CD591F528B2C21DE941D40A94497C4D40F98A051DE4A38D6E6A6EC9541C15E8F61CA70D2DEFBDC220E2D997A259774B2148C7676F20753C60D9880F54103A6AC536C6F36D6C242614F416D49A460CEA5AD95125F08E66E1F3D9912FCA8B873113EFAE93D28E679CDFC1D18E350480F42C92170FCCD0365C2A0BC121727CD55040C700A8492E969067C436E331F8BFCA160FEBCAB27A4A21C34437308AC4227171F1BEC1411B69804E30D2CB4F81D85F619908525393A9B84911EF7AD7B70DD28F5656C33017387D7D66198D56E9FE3A15B586736518003E06AFD072A2205BC5451013650E5881B02301DF468E7889F58018E5D025771D64899223E0B4B8F6AE04EDA6335708E751304D6167C6617141"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(604)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(992)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\OO Software\Defrag\oodag.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
.
**************************************************************************
.
Celkový čas: 2010-03-02 21:52:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-02 20:52
ComboFix2.txt 2010-03-02 16:56
ComboFix3.txt 2010-03-01 18:20

Před spuštěním: Volných bajtů: 62 433 816 576
Po spuštění: Volných bajtů: 62 399 496 192

- - End Of File - - 456673B9F5B24330EB4F9737BBA641BE

[Tom8sh16]

Dobrý den, v logu nevidím nic špatného. Jaký je stav PC?

[Vicious]

Už je to dobrý. Dík

[Tom8sh16]

Na dočištění použijte T-Cleaner, viz. můj podpis.
Pro potvrzení stiskněte vždy klávesu A nebo Enter.
(Poznámka: Některé antiviry chybně tuto utilitu označují jako vir. Pokud by ho tedy antivir blokoval, vypněte ho, stáhněte a použijte T-Cleaner, a pak antivir zase zapněte).


a ještě ATF Cleaner, viz. můj podpis
Po spuštění staženého souboru se objeví okno:

Zatrhněte Select All, klikněte na Empty Selected + všechny aktivní záložky (nahoře) - Main, Firefox + Opera a pak Exit

Potom už jen restartujte PC a je to vše

[Vicious]

Hotovo dik.

[Tom8sh16]

Není zač