Instrukce na adrese..

[STAR]

http://i43.tinypic.com/358b1c9.jpg

pomoc prosím nejde mi hodně her a programů ((

koukal sem tu už na návod a nic nepomohlo..

[Rudy]

Dejte log z RSIT: http://viry.cz/forum/viewtopic.php?f=24&t=81939 .

[STAR]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jarouš at 2010-03-11 17:05:22
Systém Microsoft Windows XP Professional Service Pack 3
System drive D: has 6 GB (29%) free of 22 GB
Total RAM: 1023 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:05:53, on 11.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Miranda IM\miranda32.exe
C:\Wowko\Wow.exe
C:\Wowko\Wow.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Down\RSIT.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe
D:\Program Files\trend micro\Jarouš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search-styles.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-styles.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-styles.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dirtysexgames.net/ttt.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 217.114.215.195 mininova.org
O1 - Hosts: 217.114.215.195 www.mininova.org
O1 - Hosts: 217.114.215.195 thepiratebay.org
O1 - Hosts: 217.114.215.195 www.thepiratebay.org
O1 - Hosts: 217.114.215.195 mininova.org
O1 - Hosts: 217.114.215.195 www.mininova.org
O1 - Hosts: 217.114.215.195 thepiratebay.org
O1 - Hosts: 217.114.215.195 www.thepiratebay.org
O1 - Hosts: 217.114.215.195 mininova.org
O1 - Hosts: 217.114.215.195 www.mininova.org
O1 - Hosts: 217.114.215.195 thepiratebay.org
O1 - Hosts: 217.114.215.195 www.thepiratebay.org
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - D:\WINDOWS\system32\ddcDvwWP.dll
O2 - BHO: GdfrDUEn - {A3CF7606-E683-4375-A372-96B75DA0AEF7} - D:\Program Files\Get Styles\enlbrdr.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinSys2] D:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eurobattlegui] "C:\Program Files\Warcraft III\eb.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Pando Media Booster] D:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\BitTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: GamersFirst LIVE!.lnk = D:\Program Files\GamersFirst\LIVE!\Live.exe
O9 - Extra button: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - D:\Program Files\Get Styles\ct.htm
O9 - Extra 'Tools' menuitem: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - D:\Program Files\Get Styles\ct.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwa ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ddcDvwWP - D:\WINDOWS\SYSTEM32\ddcDvwWP.dll
O23 - Service: Turbine Message Service - Live (LiveTurbineMessageService) - Unknown owner - C:\Turbine Download Manager\TurbineMessageService.exe (file missing)
O23 - Service: Turbine Network Service - Live (LiveTurbineNetworkService) - Unknown owner - C:\Turbine Download Manager\TurbineNetworkService.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - D:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5592 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
D:\WINDOWS\system32\ddcDvwWP.dll [2002-11-26 37376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
GdfrDUEn Class - D:\Program Files\Get Styles\enlbrdr.dll [2010-01-07 185344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - D:\Program Files\Ask.com\GenericAskToolbar.dll [2009-09-02 1175944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - D:\Program Files\Ask.com\GenericAskToolbar.dll [2009-09-02 1175944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"=D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2008-07-09 919016]
"WinSys2"=D:\WINDOWS\system32\winsys2.exe [2006-04-29 208896]
"nwiz"=nwiz.exe /installquiet []
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2010-01-11 13666408]
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2010-01-11 110696]
"eurobattlegui"=C:\Program Files\Warcraft III\eb.exe [2009-10-22 757760]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=D:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Pando Media Booster"=D:\Program Files\Pando Networks\Media Booster\PMB.exe [2010-02-11 2937528]
"BitTorrent"=C:\Program Files\BitTorrent\BitTorrent.exe [2010-02-12 654128]
"PlayNC Launcher"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
D:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
D:\WINDOWS\system32\NvCpl.dll [2010-01-11 13666408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
D:\WINDOWS\system32\NvMcTray.dll [2010-01-11 110696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
D:\WINDOWS\RTHDCPL.EXE [2007-04-10 16126464]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2009-05-26 85160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"vsmon"=2
"nvsvc"=2

D:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
GamersFirst LIVE!.lnk - D:\Program Files\GamersFirst\LIVE!\Live.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcDvwWP]
D:\WINDOWS\system32\ddcDvwWP.dll [2002-11-26 37376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"=D:\WINDOWS\system32\ddcDvwWP.dll [2002-11-26 37376]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\BitTorrent\bittorrent.exe"="D:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"D:\Documents and Settings\All Users\Data aplikací\NexonUS\NGM\NGM.exe"="D:\Documents and Settings\All Users\Data aplikací\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"D:\Nexon\Combat Arms\CombatArms.exe"="D:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"D:\Nexon\Combat Arms\Engine.exe"="D:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"D:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe"="D:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"D:\Nexon\Combat Arms EU\CombatArms.exe"="D:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"D:\Nexon\Combat Arms EU\Engine.exe"="D:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"D:\Nexon\Combat Arms EU\NMService.exe"="D:\Nexon\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core"
"c:\kos\game_sting_pak\sting.exe"="C:\kos\game_sting_pak\sting.exe:*:Enabled:˝şĆÿ¶óŔÎ"
"D:\WINDOWS\system32\PnkBstrA.exe"="D:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"D:\WINDOWS\system32\PnkBstrB.exe"="D:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\DNA\btdna.exe"="D:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\BlackShot\Blackshot\system\BlackShot.exe"="C:\BlackShot\Blackshot\system\BlackShot.exe:*:Enabled:BlackShot"
"C:\Turbine Download Manager\TurbineMessageService.exe"="C:\Turbine Download Manager\TurbineMessageService.exe:*:Enabled:TurbineMessageService"
"C:\Turbine Download Manager\TurbineNetworkService.exe"="C:\Turbine Download Manager\TurbineNetworkService.exe:*:Enabled:TurbineNetworkService"
"C:\Warrior Epic\WEShell_TGI.exe"="C:\Warrior Epic\WEShell_TGI.exe:*:Enabled:Warrior Epic"
"C:\VertigoGames\Game\BlackShot\Blackshot\system\BlackShot.exe"="C:\VertigoGames\Game\BlackShot\Blackshot\system\BlackShot.exe:*:Enabled:BlackShot"
"C:\Program Files\Outspark\Project Powder\Run.exe"="C:\Program Files\Outspark\Project Powder\Run.exe:*:Enabled:ProjectPowder"
"D:\Riot Games\League of Legends\air\LolClient.exe"="D:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"D:\Riot Games\League of Legends\game\League of Legends.exe"="D:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\Program Files\Messenger\msmsgs.exe"="D:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\Program Files\Skype\Plugin Manager\skypePM.exe"="D:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Program Files\Pando Networks\Media Booster\PMB.exe"="D:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\BitTorrent\BitTorrent.exe"="C:\Program Files\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\BlackShot\DDDDAAA\Blackshot\system\blackshot.exe"="C:\BlackShot\DDDDAAA\Blackshot\system\blackshot.exe:*:Enabled:BlackShot"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Nexon\Combat Arms\CombatArms.exe"="D:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"D:\Nexon\Combat Arms\Engine.exe"="D:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"D:\Nexon\Combat Arms EU\CombatArms.exe"="D:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"D:\Nexon\Combat Arms EU\Engine.exe"="D:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"c:\kos\game_sting_pak\sting.exe"="C:\kos\game_sting_pak\sting.exe:*:Enabled:˝şĆÿ¶óŔÎ"
"D:\Program Files\Windows Live\Messenger\msnmsgr.exe"="D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2010-03-10 19:15:31 ----D---- D:\Program Files\trend micro
2010-03-10 19:15:27 ----D---- D:\rsit
2010-03-10 17:43:39 ----D---- D:\WINDOWS\system32\Te_mp_B_S!!
2010-03-10 17:38:35 ----D---- D:\Program Files\Yamicsoft
2010-03-10 16:32:30 ----D---- D:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment
2010-03-10 16:14:42 ----D---- D:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment.temp
2010-03-10 12:21:53 ----D---- D:\Documents and Settings\All Users\Data aplikací\Blizzard
2010-03-10 10:51:49 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\BitTorrent
2010-03-10 10:51:48 ----D---- D:\Documents and Settings\All Users\Data aplikací\PMB Files
2010-03-10 08:24:16 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\Macromedia
2010-03-10 08:24:16 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\Adobe
2010-03-09 18:21:04 ----D---- D:\Program Files\Ace Explorer
2010-03-07 18:04:38 ----D---- D:\Program Files\NCsoft
2010-03-07 11:07:16 ----D---- D:\Program Files\eM Client
2010-03-04 21:30:42 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\TS3Client
2010-03-04 21:30:03 ----D---- D:\Program Files\TeamSpeak 3 Client
2010-02-28 21:53:36 ----D---- D:\Program Files\NusKO Team
2010-02-25 12:36:57 ----D---- D:\Program Files\Hamachi
2010-02-22 15:41:21 ----A---- D:\WINDOWS\system32\CmdLineExt.dll
2010-02-16 09:12:07 ----D---- D:\Program Files\BlackBeanGames
2010-02-12 20:52:45 ----D---- D:\Program Files\OpenAL
2010-02-12 20:52:45 ----A---- D:\WINDOWS\system32\wrap_oal.dll
2010-02-12 20:52:45 ----A---- D:\WINDOWS\system32\OpenAL32.dll
2010-02-12 20:52:36 ----A---- D:\WINDOWS\system32\XAudio2_5.dll
2010-02-12 20:52:36 ----A---- D:\WINDOWS\system32\xactengine3_5.dll
2010-02-12 20:52:36 ----A---- D:\WINDOWS\system32\D3DCompiler_42.dll
2010-02-12 20:52:35 ----A---- D:\WINDOWS\system32\d3dx11_42.dll
2010-02-12 20:52:35 ----A---- D:\WINDOWS\system32\d3dx10_42.dll
2010-02-12 20:52:35 ----A---- D:\WINDOWS\system32\d3dcsx_42.dll
2010-02-12 20:52:34 ----A---- D:\WINDOWS\system32\D3DX9_42.dll
2010-02-12 19:32:40 ----D---- D:\Program Files\Ask.com

======List of files/folders modified in the last 1 months======

2010-03-11 16:56:22 ----D---- D:\Program Files\Common Files\Akamai
2010-03-11 16:44:32 ----RSD---- D:\WINDOWS\Fonts
2010-03-11 16:29:32 ----D---- D:\WINDOWS\Internet Logs
2010-03-11 16:25:45 ----D---- D:\Program Files\Mozilla Firefox
2010-03-11 11:57:07 ----D---- D:\WINDOWS\system32\drivers
2010-03-10 22:40:23 ----A---- D:\WINDOWS\SchedLgU.Txt
2010-03-10 19:15:46 ----D---- D:\WINDOWS\Prefetch
2010-03-10 19:15:31 ----RD---- D:\Program Files
2010-03-10 17:43:39 ----D---- D:\WINDOWS\system32
2010-03-10 17:38:41 ----SHD---- D:\WINDOWS\Installer
2010-03-10 17:38:40 ----SD---- D:\Documents and Settings\Jarouš\Data aplikací\Microsoft
2010-03-10 17:38:35 ----D---- D:\WINDOWS
2010-03-10 10:51:50 ----D---- D:\WINDOWS\Temp
2010-03-10 05:03:02 ----D---- D:\WINDOWS\system32\CatRoot2
2010-03-08 19:09:47 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\Mumble
2010-03-08 12:48:31 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\mIRC
2010-03-08 12:46:46 ----D---- D:\Program Files\mIRC
2010-03-07 17:53:38 ----HD---- D:\Program Files\InstallShield Installation Information
2010-03-07 11:38:22 ----D---- D:\WINDOWS\Microsoft.NET
2010-03-07 11:09:28 ----RSD---- D:\WINDOWS\assembly
2010-03-04 13:59:18 ----D---- D:\WINDOWS\WinSxS
2010-03-03 18:42:30 ----HD---- D:\WINDOWS\inf
2010-02-22 15:34:49 ----D---- D:\WINDOWS\system32\DirectX
2010-02-20 19:38:19 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\Skype
2010-02-20 19:27:29 ----D---- D:\Documents and Settings\Jarouš\Data aplikací\skypePM
2010-02-18 20:19:59 ----A---- D:\WINDOWS\system32\PnkBstrB.exe
2010-02-17 16:30:59 ----D---- D:\Program Files\Ventrilo
2010-02-12 19:32:48 ----SD---- D:\WINDOWS\Tasks

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Ovladač procesoru AMD; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 ElbyCDIO;ElbyCDIO Driver; D:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 KLIF;KLIF; D:\WINDOWS\system32\DRIVERS\klif.sys [2007-07-19 127768]
R1 vsdatant;vsdatant; D:\WINDOWS\System32\vsdatant.sys [2008-07-09 394952]
R3 hamachi;Hamachi Network Interface; D:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-02-25 25280]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-04-10 4397568]
R3 mouhid;Ovladač myši standardu HID; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-01-12 10276768]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; D:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-02-06 90880]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; D:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VClone;VClone; D:\WINDOWS\system32\DRIVERS\VClone.sys [2009-05-23 29696]
S3 Arp1394;Protokol 1394 ARP Client; D:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 EagleNT;EagleNT; \??\D:\WINDOWS\system32\drivers\EagleNT.sys []
S3 GarenaPEngine;GarenaPEngine; \??\D:\DOCUME~1\JAROU~1\LOCALS~1\Temp\JULF9.tmp []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 NIC1394;1394 Net Driver; D:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 SOACS;SOACS Driver; \??\D:\WINDOWS\system32\drivers\soacs.sys []
S3 usbscan;Ovladač skeneru USB; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 vtany;vtany; \??\D:\WINDOWS\vtany.sys []
S3 XDva281;XDva281; \??\D:\WINDOWS\system32\XDva281.sys []
S3 XDva308;XDva308; \??\D:\WINDOWS\system32\XDva308.sys []
S3 XDva319;XDva319; \??\D:\WINDOWS\system32\XDva319.sys []
S3 XDva321;XDva321; \??\D:\WINDOWS\system32\XDva321.sys []
S3 XDva323;XDva323; \??\D:\WINDOWS\system32\XDva323.sys []
S3 XDva327;XDva327; \??\D:\WINDOWS\system32\XDva327.sys []
S3 XDva337;XDva337; \??\D:\WINDOWS\system32\XDva337.sys []
S3 xhunter1;xhunter1; \??\D:\WINDOWS\xhunter1.sys []
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Akamai;Akamai NetSession Interface; D:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 nvsvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2010-01-11 154216]
R2 PnkBstrA;PnkBstrA; D:\WINDOWS\system32\PnkBstrA.exe [2002-11-29 75064]
R2 vsmon;TrueVector Internet Monitor; D:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-07-09 75304]
S2 LiveTurbineMessageService;Turbine Message Service - Live; C:\Turbine Download Manager\TurbineMessageService.exe []
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 getPlusHelper;getPlus(R) Helper; D:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 LiveTurbineNetworkService;Turbine Network Service - Live; C:\Turbine Download Manager\TurbineNetworkService.exe []
S3 npggsvc;nProtect GameGuard Service; D:\WINDOWS\system32\GameMon.des [2009-11-17 3427996]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

[Rudy]

Pár šmejdů tam vidím. Udělejte sken ComboFix a dejte log:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[STAR]

Log proběhl ale nevim kam se uložil log.. :/

[STAR]

ComboFix 10-03-11.02 - Jarouš 11.03.2010 19:13:26.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.757 [GMT 1:00]
Spuštěný z: D:\Documents and Settings\Jarouš\Plocha\ComboFix.exe
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý

.
Tyto soubory byly během aplikování deaktivovány:
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll


((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
D:\WINDOWS\system32\Bifrost
D:\WINDOWS\system32\Bifrost\klog.dat
D:\WINDOWS\system32\ddcDvwWP.dll
D:\WINDOWS\system32\ieuinit.inf
D:\WINDOWS\system32\vbzlib1.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-11 do 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-11 17:31:57 . 2010-02-04 09:01:14 74072 ----a-w- D:\WINDOWS\system32\XAPOFX1_4.dll
2010-03-11 17:31:57 . 2010-02-04 09:01:14 528216 ----a-w- D:\WINDOWS\system32\XAudio2_6.dll
2010-03-11 17:31:54 . 2010-02-04 09:01:14 238936 ----a-w- D:\WINDOWS\system32\xactengine3_6.dll
2010-03-11 17:31:48 . 2010-02-04 09:01:14 22360 ----a-w- D:\WINDOWS\system32\X3DAudio1_7.dll
2010-03-11 17:19:51 . 2010-03-11 18:05:38 -------- d-----w- D:\Program Files\The Craft Of Gods
2010-03-10 18:15:31 . 2010-03-11 16:05:53 -------- d-----w- D:\Program Files\trend micro
2010-03-10 18:15:27 . 2010-03-10 19:15:08 -------- d-----w- D:\rsit
2010-03-10 16:43:39 . 2010-03-10 16:43:45 -------- d-----w- D:\WINDOWS\system32\Te_mp_B_S!!
2010-03-10 16:38:35 . 2010-03-10 16:38:35 -------- d-----w- D:\Program Files\Yamicsoft
2010-03-09 17:21:04 . 2010-03-09 17:21:10 -------- d-----w- D:\Program Files\Ace Explorer
2010-03-07 17:04:38 . 2010-03-07 17:04:38 -------- d-----w- D:\Program Files\NCsoft
2010-03-07 10:07:16 . 2010-03-07 10:07:24 -------- d-----w- D:\Program Files\eM Client
2010-03-04 20:30:03 . 2010-03-04 20:30:12 -------- d-----w- D:\Program Files\TeamSpeak 3 Client
2010-02-28 20:53:36 . 2010-02-28 20:53:36 -------- d-----w- D:\Program Files\NusKO Team
2010-02-25 11:36:57 . 2010-02-25 11:37:20 -------- d-----w- D:\Program Files\Hamachi
2010-02-25 11:36:57 . 2010-02-25 11:36:57 25280 ----a-w- D:\WINDOWS\system32\drivers\hamachi.sys
2010-02-22 14:41:21 . 2010-02-22 14:41:21 107888 ----a-w- D:\WINDOWS\system32\CmdLineExt.dll
2010-02-16 08:12:07 . 2010-02-16 08:12:07 -------- d-----w- D:\Program Files\BlackBeanGames
2010-02-12 19:52:45 . 2010-02-12 19:52:45 444952 ----a-w- D:\WINDOWS\system32\wrap_oal.dll
2010-02-12 19:52:45 . 2010-02-12 19:52:45 109080 ----a-w- D:\WINDOWS\system32\OpenAL32.dll
2010-02-12 19:52:45 . 2010-02-12 19:52:45 -------- d-----w- D:\Program Files\OpenAL
2010-02-12 19:52:36 . 2009-09-04 16:44:40 515416 ----a-w- D:\WINDOWS\system32\XAudio2_5.dll
2010-02-12 19:52:36 . 2009-09-04 16:44:40 238936 ----a-w- D:\WINDOWS\system32\xactengine3_5.dll
2010-02-12 19:52:36 . 2009-09-04 16:29:32 1974616 ----a-w- D:\WINDOWS\system32\D3DCompiler_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:34 453456 ----a-w- D:\WINDOWS\system32\d3dx10_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:34 235344 ----a-w- D:\WINDOWS\system32\d3dx11_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:32 5501792 ----a-w- D:\WINDOWS\system32\d3dcsx_42.dll
2010-02-12 19:52:34 . 2009-09-04 16:29:30 1892184 ----a-w- D:\WINDOWS\system32\D3DX9_42.dll
2010-02-12 18:32:40 . 2010-02-12 18:32:49 -------- d-----w- D:\Program Files\Ask.com
2010-02-10 17:52:05 . 2010-02-10 17:53:02 -------- d-----w- D:\Program Files\Neffy

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 18:22:20 . 2002-11-25 19:42:13 39499808 --sha-w- D:\WINDOWS\system32\drivers\fidbox.dat
2010-03-11 18:21:22 . 2010-01-26 14:20:18 -------- d-----w- D:\Program Files\Common Files\Akamai
2010-03-11 18:20:09 . 2002-11-25 19:42:13 466976 --sha-w- D:\WINDOWS\system32\drivers\fidbox.idx
2010-03-08 11:46:46 . 2010-02-05 13:37:28 -------- d-----w- D:\Program Files\mIRC
2010-03-07 16:53:38 . 2002-11-25 19:38:04 -------- d--h--w- D:\Program Files\InstallShield Installation Information
2010-02-18 19:19:59 . 2002-11-26 14:48:15 214816 ----a-w- D:\WINDOWS\system32\PnkBstrB.exe
2010-02-18 19:16:02 . 2002-11-26 14:48:22 138328 ----a-w- D:\WINDOWS\system32\drivers\PnkBstrK.sys
2010-02-18 03:34:44 . 2010-02-18 03:35:29 1959936 ----a-w- D:\WINDOWS\Internet Logs\xDBF.tmp
2010-02-17 15:30:59 . 2002-11-28 01:49:44 -------- d-----w- D:\Program Files\Ventrilo
2010-02-15 19:05:26 . 2010-02-16 08:04:02 1950720 ----a-w- D:\WINDOWS\Internet Logs\xDBE.tmp
2010-02-15 19:05:26 . 2010-02-16 08:04:02 1374208 ----a-w- D:\WINDOWS\Internet Logs\xDBD.tmp
2010-02-12 20:51:41 . 2010-02-12 22:15:41 1947136 ----a-w- D:\WINDOWS\Internet Logs\xDBC.tmp
2010-02-12 20:51:41 . 2010-02-12 22:15:40 2945024 ----a-w- D:\WINDOWS\Internet Logs\xDBB.tmp
2010-02-11 17:38:34 . 2010-01-16 15:14:03 98918 ----a-w- D:\WINDOWS\War3Unin.dat
2010-02-11 14:22:00 . 2002-12-02 12:39:06 -------- d-----w- D:\Program Files\Pando Networks
2010-02-09 23:54:28 . 2002-12-03 21:43:49 65536 ----a-w- D:\WINDOWS\IFinst27.exe
2010-02-09 19:44:54 . 2002-11-26 13:35:34 -------- d-----w- D:\Program Files\Registry Easy
2010-02-09 16:19:07 . 2002-11-30 19:59:11 -------- d-----w- D:\Program Files\DNA
2010-02-08 22:52:59 . 2010-02-08 22:52:59 56 ---ha-w- D:\WINDOWS\system32\ezsidmv.dat
2010-02-08 22:47:11 . 2010-02-08 22:46:30 -------- d-----r- D:\Program Files\Skype
2010-02-08 22:46:33 . 2010-02-08 22:46:33 -------- d-----w- D:\Program Files\Common Files\Skype
2010-02-07 19:37:09 . 2010-02-07 19:37:08 -------- d-----w- D:\Program Files\Tunatic
2010-02-07 10:55:29 . 2002-12-04 20:36:00 -------- d-----w- D:\Program Files\PokerStars
2010-02-07 10:54:03 . 2010-01-02 14:00:39 -------- d-----w- D:\Program Files\Common Files\Symantec Shared
2010-02-07 10:31:11 . 2002-11-30 19:59:10 -------- d-----w- D:\Program Files\GamersFirst
2010-02-06 19:14:23 . 2002-12-03 10:00:38 -------- d-----w- D:\Program Files\DivX
2010-02-03 18:53:06 . 2010-02-03 18:55:29 775168 ----a-w- D:\WINDOWS\Internet Logs\xDB9.tmp
2010-02-03 18:53:05 . 2010-02-03 18:55:29 1848832 ----a-w- D:\WINDOWS\Internet Logs\xDBA.tmp
2010-02-03 09:37:38 . 2010-02-03 09:38:49 1835008 ----a-w- D:\WINDOWS\Internet Logs\xDB8.tmp
2010-02-03 09:37:36 . 2010-02-03 09:38:48 3129344 ----a-w- D:\WINDOWS\Internet Logs\xDB7.tmp
2010-02-03 09:14:45 . 2010-02-03 09:14:45 -------- d-----w- D:\Program Files\Windows Live
2010-02-02 20:18:08 . 2010-02-02 20:18:08 -------- d-----w- D:\Program Files\DsNET Corp
2010-02-02 20:17:02 . 2002-11-25 20:00:50 -------- d-----w- D:\Program Files\NVIDIA Corporation
2010-02-02 20:16:17 . 2002-11-25 20:01:18 -------- d-----w- D:\Program Files\Common Files\Wise Installation Wizard
2010-02-02 20:16:06 . 2002-11-25 20:01:25 -------- d-----w- D:\Program Files\AGEIA Technologies
2010-01-28 05:20:10 . 2010-01-28 05:20:04 1945314 ----a-w- D:\WINDOWS\Internet Logs\tvDebug.zip
2010-01-27 16:44:16 . 2010-01-12 21:30:39 -------- d-----w- D:\Program Files\Common Files\Blizzard Entertainment
2010-01-27 07:13:30 . 2010-01-27 07:13:30 -------- d-----w- D:\Program Files\Lizard Interactive
2010-01-26 16:02:50 . 2010-01-26 16:02:50 -------- d-----w- D:\Program Files\Common Files\Adobe AIR
2010-01-26 14:15:42 . 2010-01-26 14:09:39 -------- d-----w- D:\Program Files\Xenimus
2010-01-21 17:46:20 . 2010-01-21 17:46:20 -------- d-----w- D:\Program Files\Outspark
2010-01-16 15:18:17 . 2010-01-16 15:14:02 2829 ----a-w- D:\WINDOWS\War3Unin.pif
2010-01-16 15:18:17 . 2010-01-16 15:14:01 139264 ----a-w- D:\WINDOWS\War3Unin.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 278120 ----a-w- D:\WINDOWS\system32\nvmccs.dll
2010-01-11 21:17:44 . 2010-01-11 21:17:44 154216 ----a-w- D:\WINDOWS\system32\nvsvc32.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 145000 ----a-w- D:\WINDOWS\system32\nvcolor.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 13666408 ----a-w- D:\WINDOWS\system32\nvcpl.dll
2010-01-11 21:17:44 . 2010-01-11 21:17:44 110696 ----a-w- D:\WINDOWS\system32\nvmctray.dll
2010-01-11 21:17:40 . 2010-01-11 21:17:40 81920 ----a-w- D:\WINDOWS\system32\nvwddi.dll
2010-01-10 19:10:12 . 2010-01-10 19:10:12 -------- d-----w- D:\Program Files\Get Styles
2010-01-05 12:53:20 . 2010-01-05 12:54:04 1686528 ----a-w- D:\WINDOWS\Internet Logs\xDB6.tmp
2010-01-05 12:53:17 . 2010-01-05 12:54:03 3249664 ----a-w- D:\WINDOWS\Internet Logs\xDB5.tmp
2009-12-17 17:18:54 . 2009-12-17 17:18:54 75264 ----a-w- D:\WINDOWS\system32\uc_holybeast_launching.dll
2009-12-17 17:17:42 . 2009-12-17 17:17:42 64000 ----a-w- D:\WINDOWS\system32\uc_sfighters_launching.dll
2009-12-15 16:21:32 . 2009-12-15 16:21:32 427008 ----a-w- D:\WINDOWS\system32\uc_wepic_launching.dll
.

------- Sigcheck -------

[-] 2008-06-12 09:16:50 . 977034D14621DE018E779C672DDF8472 . 361344 . . [5.1.2600.5512 (xpsp.080413-0852)] . . D:\WINDOWS\system32\drivers\tcpip.sys

[-] 2008-06-12 14:58:16 . C71BB4782833750BF4C02AC30ED670B7 . 1571840 . . [5.1.2600.5512 (xpsp.080413-2111)] . . D:\WINDOWS\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2010-01-07 06:51:08 185344 ----a-w- D:\Program Files\Get Styles\enlbrdr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 13:56:30 1175944 ----a-w- D:\Program Files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "D:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 13:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "D:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 13:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="D:\Program Files\Pando Networks\Media Booster\PMB.exe" [2010-02-11 14:22:09 2937528]
"BitTorrent"="C:\Program Files\BitTorrent\BitTorrent.exe" [2010-02-12 18:32:18 654128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 08:05:20 919016]
"WinSys2"="D:\WINDOWS\system32\winsys2.exe" [2006-04-29 03:36:54 208896]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2010-01-11 21:17:44 13666408]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2010-01-11 21:17:44 110696]
"eurobattlegui"="C:\Program Files\Warcraft III\eb.exe" [2009-10-22 18:39:22 757760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 06:52:18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43:28 69632 ------r- D:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 06:52:18 15360 ------w- D:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-01-11 21:17:44 13666408 ----a-w- D:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-01-11 21:17:44 110696 ----a-w- D:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-04-10 07:28:44 16126464 ------r- D:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2009-05-26 22:31:29 85160 ----a-w- D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"vsmon"=2 (0x2)
"nvsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"D:\\WINDOWS\\system32\\PnkBstrA.exe"=
"D:\\WINDOWS\\system32\\PnkBstrB.exe"=
"D:\\Program Files\\DNA\\btdna.exe"=
"C:\\BlackShot\\Blackshot\\system\\BlackShot.exe"=
"C:\\VertigoGames\\Game\\BlackShot\\Blackshot\\system\\BlackShot.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"D:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"C:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\BlackShot\\DDDDAAA\\Blackshot\\system\\blackshot.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57610:TCP"= 57610:TCP:Pando Media Booster
"57610:UDP"= 57610:UDP:Pando Media Booster
"314:TCP"= 314:TCP:WarriorEpic
"314:UDP"= 314:UDP:WarriorEpic
"8375:TCP"= 8375:TCP:League of Legends Launcher
"8375:UDP"= 8375:UDP:League of Legends Launcher
"58975:TCP"= 58975:TCP:Pando Media Booster
"58975:UDP"= 58975:UDP:Pando Media Booster
"57176:TCP"= 57176:TCP:Pando Media Booster
"57176:UDP"= 57176:UDP:Pando Media Booster
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R2 Akamai;Akamai NetSession Interface;D:\WINDOWS\System32\svchost.exe -k Akamai [14.4.2008 7:52:50 14336]
S2 LiveTurbineMessageService;Turbine Message Service - Live;"C:\Turbine Download Manager\TurbineMessageService.exe" --> C:\Turbine Download Manager\TurbineMessageService.exe [?]
S3 GarenaPEngine;GarenaPEngine;\??\D:\DOCUME~1\JAROU~1\LOCALS~1\Temp\JULF9.tmp --> D:\DOCUME~1\JAROU~1\LOCALS~1\Temp\JULF9.tmp [?]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;"C:\Turbine Download Manager\TurbineNetworkService.exe" --> C:\Turbine Download Manager\TurbineNetworkService.exe [?]
S3 npggsvc;nProtect GameGuard Service;D:\WINDOWS\system32\GameMon.des -service --> D:\WINDOWS\system32\GameMon.des -service [?]
S3 SOACS;SOACS Driver;\??\D:\WINDOWS\system32\drivers\soacs.sys --> D:\WINDOWS\system32\drivers\soacs.sys [?]
S3 vtany;vtany;\??\D:\WINDOWS\vtany.sys --> D:\WINDOWS\vtany.sys [?]
S3 XDva281;XDva281;\??\D:\WINDOWS\system32\XDva281.sys --> D:\WINDOWS\system32\XDva281.sys [?]
S3 XDva308;XDva308;\??\D:\WINDOWS\system32\XDva308.sys --> D:\WINDOWS\system32\XDva308.sys [?]
S3 XDva319;XDva319;\??\D:\WINDOWS\system32\XDva319.sys --> D:\WINDOWS\system32\XDva319.sys [?]
S3 XDva321;XDva321;\??\D:\WINDOWS\system32\XDva321.sys --> D:\WINDOWS\system32\XDva321.sys [?]
S3 XDva323;XDva323;\??\D:\WINDOWS\system32\XDva323.sys --> D:\WINDOWS\system32\XDva323.sys [?]
S3 XDva327;XDva327;\??\D:\WINDOWS\system32\XDva327.sys --> D:\WINDOWS\system32\XDva327.sys [?]
S3 XDva337;XDva337;\??\D:\WINDOWS\system32\XDva337.sys --> D:\WINDOWS\system32\XDva337.sys [?]
S3 xhunter1;xhunter1;\??\D:\WINDOWS\xhunter1.sys --> D:\WINDOWS\xhunter1.sys [?]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'

2010-03-11 D:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
- D:\Program Files\Ask.com\UpdateTask.exe [2009-09-02 13:56:32 . 2009-09-02 13:56:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search-styles.com/
uInternet Connection Wizard,ShellNext = hxxp://www.dirtysexgames.net/ttt.php
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - D:\Program Files\Get Styles\ct.htm
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-PlayNC Launcher - (no file)
HKLM-Run-nwiz - nwiz.exe
AddRemove-Rohan_RBF - C:\ROHAN_Blood_Feud\GoUninstRBF.exe
AddRemove-Talisman Online_is1 - C:\Program Files\TalismanOnline\unins000.exe
AddRemove-NCsoft-Aion - d:\program files\ncsoft\launcher\NCLauncher.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 19:21:38
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\D:\DOCUME~1\JAROU~1\LOCALS~1\Temp\JULF9.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="D:\WINDOWS\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(844)
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\d3dx9_28.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll

- - - - - - - > 'lsass.exe'(900)
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\d3dx9_28.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll

- - - - - - - > 'explorer.exe'(2128)
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\d3dx9_28.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll

- - - - - - - > 'csrss.exe'(820)
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\d3dx9_28.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2010-03-11 19:26:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-11 18:26:19

Před spuštěním: 4 907 700 224
Po spuštění: 5 027 291 136

- - End Of File - - A76CD2AF5030D332996C228F72FFB21B

[STAR]

http://i43.tinypic.com/xpcynl.jpg pecička :/

[STAR]

počkam do 9 jestli pomůžeš pak reinstall :///

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Folder::
D:\Program Files\Ask.com
D:\Program Files\Common Files\Akamai

Collect::
D:\WINDOWS\system32\winsys2.exe
D:\WINDOWS\vtany.sys
D:\WINDOWS\xhunter1.sys
D:\WINDOWS\system32\drivers\soacs.sys
D:\DOCUME~1\JAROU~1\LOCALS~1\Temp\JULF9.tmp

Driver::
Akamai
GarenaPEngine
mchInjDrv
SOACS
vtany
XDva281
XDva308
XDva319
XDva321
XDva323
XDva327
XDva337

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[-HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinSys2"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[STAR]

ComboFix 10-03-11.02 - Jarouš 11.03.2010 21:13:52.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.760 [GMT 1:00]
Spuštěný z: D:\Documents and Settings\Jarouš\Plocha\ComboFix.exe
Použité ovládací přepínače :: D:\Documents and Settings\Jarouš\Plocha\CFScript.txt
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý


file zipped: D:\WINDOWS\system32\winsys2.exe
.
Tyto soubory byly během aplikování deaktivovány:
D:\WINDOWS\system32\HookShield.dll
D:\WINDOWS\system32\Auxiliary.dll
D:\WINDOWS\system32\SMdll.dll


((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Program Files\Ask.com
D:\Program Files\Ask.com\cobrand.ico
D:\Program Files\Ask.com\config.xml
D:\Program Files\Ask.com\favicon.ico
D:\Program Files\Ask.com\GenericAskToolbar.dll
D:\Program Files\Ask.com\mupcfg.xml
D:\Program Files\Ask.com\SaUpdate.exe
D:\Program Files\Ask.com\UpdateTask.exe
D:\Program Files\Common Files\Akamai
D:\Program Files\Common Files\Akamai\AdminTool.exe
D:\Program Files\Common Files\Akamai\appregistry.dat
D:\Program Files\Common Files\Akamai\Cache\867dfe0596c59fd9cb43b2a240a92fd6a1a62898.rsmd
D:\Program Files\Common Files\Akamai\Cache\87527\Shaiya_Install_US_090508.exe
D:\Program Files\Common Files\Akamai\client.ini
D:\Program Files\Common Files\Akamai\client.ini.json
D:\Program Files\Common Files\Akamai\ControlPanel.exe
D:\Program Files\Common Files\Akamai\CplTasks.xml
D:\Program Files\Common Files\Akamai\data.dat
D:\Program Files\Common Files\Akamai\debug.log
D:\Program Files\Common Files\Akamai\debug.log.6.upload
D:\Program Files\Common Files\Akamai\guid.ini
D:\Program Files\Common Files\Akamai\Languages\csy.dll
D:\Program Files\Common Files\Akamai\Languages\dan.dll
D:\Program Files\Common Files\Akamai\Languages\deu.dll
D:\Program Files\Common Files\Akamai\Languages\esp.dll
D:\Program Files\Common Files\Akamai\Languages\fin.dll
D:\Program Files\Common Files\Akamai\Languages\fra.dll
D:\Program Files\Common Files\Akamai\Languages\chs.dll
D:\Program Files\Common Files\Akamai\Languages\cht.dll
D:\Program Files\Common Files\Akamai\Languages\ita.dll
D:\Program Files\Common Files\Akamai\Languages\jpn.dll
D:\Program Files\Common Files\Akamai\Languages\kor.dll
D:\Program Files\Common Files\Akamai\Languages\nld.dll
D:\Program Files\Common Files\Akamai\Languages\nor.dll
D:\Program Files\Common Files\Akamai\Languages\plk.dll
D:\Program Files\Common Files\Akamai\Languages\ptb.dll
D:\Program Files\Common Files\Akamai\Languages\ptg.dll
D:\Program Files\Common Files\Akamai\Languages\rus.dll
D:\Program Files\Common Files\Akamai\Languages\sve.dll
D:\Program Files\Common Files\Akamai\Languages\trk.dll
D:\Program Files\Common Files\Akamai\Readme.txt
D:\Program Files\Common Files\Akamai\root.pem
D:\Program Files\Common Files\Akamai\rswin_3648.dll
D:\Program Files\Common Files\Akamai\rswinui.exe
D:\Program Files\Common Files\Akamai\uninstall.exe
D:\Program Files\Common Files\Akamai\vcredist_x86.exe
D:\WINDOWS\system32\winsys2.exe
.
---- Předchozí spuštění -------
.
C:\install.exe
D:\WINDOWS\system32\Bifrost\klog.dat
D:\WINDOWS\system32\ddcDvwWP.dll
D:\WINDOWS\system32\ieuinit.inf
D:\WINDOWS\system32\vbzlib1.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AKAMAI
-------\Legacy_GARENAPENGINE
-------\Legacy_MCHINJDRV
-------\Legacy_SOACS
-------\Legacy_VTANY
-------\Legacy_XDVA281
-------\Legacy_XDVA308
-------\Legacy_XDVA319
-------\Legacy_XDVA321
-------\Legacy_XDVA323
-------\Legacy_XDVA327
-------\Legacy_XDVA337
-------\Service_Akamai
-------\Service_GarenaPEngine
-------\Service_SOACS
-------\Service_vtany
-------\Service_XDva281
-------\Service_XDva308
-------\Service_XDva319
-------\Service_XDva321
-------\Service_XDva323
-------\Service_XDva327
-------\Service_XDva337


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-11 do 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-11 17:31:57 . 2010-02-04 09:01:14 74072 ----a-w- D:\WINDOWS\system32\XAPOFX1_4.dll
2010-03-11 17:31:57 . 2010-02-04 09:01:14 528216 ----a-w- D:\WINDOWS\system32\XAudio2_6.dll
2010-03-11 17:31:54 . 2010-02-04 09:01:14 238936 ----a-w- D:\WINDOWS\system32\xactengine3_6.dll
2010-03-11 17:31:48 . 2010-02-04 09:01:14 22360 ----a-w- D:\WINDOWS\system32\X3DAudio1_7.dll
2010-03-11 17:19:51 . 2010-03-11 18:41:27 -------- d-----w- D:\Program Files\The Craft Of Gods
2010-03-10 18:15:31 . 2010-03-11 16:05:53 -------- d-----w- D:\Program Files\trend micro
2010-03-10 18:15:27 . 2010-03-10 19:15:08 -------- d-----w- D:\rsit
2010-03-10 16:43:39 . 2010-03-10 16:43:45 -------- d-----w- D:\WINDOWS\system32\Te_mp_B_S!!
2010-03-10 16:38:35 . 2010-03-10 16:38:35 -------- d-----w- D:\Program Files\Yamicsoft
2010-03-09 17:21:04 . 2010-03-09 17:21:10 -------- d-----w- D:\Program Files\Ace Explorer
2010-03-07 17:04:38 . 2010-03-07 17:04:38 -------- d-----w- D:\Program Files\NCsoft
2010-03-07 10:07:16 . 2010-03-07 10:07:24 -------- d-----w- D:\Program Files\eM Client
2010-03-04 20:30:03 . 2010-03-04 20:30:12 -------- d-----w- D:\Program Files\TeamSpeak 3 Client
2010-02-28 20:53:36 . 2010-02-28 20:53:36 -------- d-----w- D:\Program Files\NusKO Team
2010-02-25 11:36:57 . 2010-02-25 11:37:20 -------- d-----w- D:\Program Files\Hamachi
2010-02-25 11:36:57 . 2010-02-25 11:36:57 25280 ----a-w- D:\WINDOWS\system32\drivers\hamachi.sys
2010-02-22 14:41:21 . 2010-02-22 14:41:21 107888 ----a-w- D:\WINDOWS\system32\CmdLineExt.dll
2010-02-16 08:12:07 . 2010-02-16 08:12:07 -------- d-----w- D:\Program Files\BlackBeanGames
2010-02-12 19:52:45 . 2010-02-12 19:52:45 444952 ----a-w- D:\WINDOWS\system32\wrap_oal.dll
2010-02-12 19:52:45 . 2010-02-12 19:52:45 109080 ----a-w- D:\WINDOWS\system32\OpenAL32.dll
2010-02-12 19:52:45 . 2010-02-12 19:52:45 -------- d-----w- D:\Program Files\OpenAL
2010-02-12 19:52:36 . 2009-09-04 16:44:40 515416 ----a-w- D:\WINDOWS\system32\XAudio2_5.dll
2010-02-12 19:52:36 . 2009-09-04 16:44:40 238936 ----a-w- D:\WINDOWS\system32\xactengine3_5.dll
2010-02-12 19:52:36 . 2009-09-04 16:29:32 1974616 ----a-w- D:\WINDOWS\system32\D3DCompiler_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:34 453456 ----a-w- D:\WINDOWS\system32\d3dx10_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:34 235344 ----a-w- D:\WINDOWS\system32\d3dx11_42.dll
2010-02-12 19:52:35 . 2009-09-04 16:29:32 5501792 ----a-w- D:\WINDOWS\system32\d3dcsx_42.dll
2010-02-12 19:52:34 . 2009-09-04 16:29:30 1892184 ----a-w- D:\WINDOWS\system32\D3DX9_42.dll
2010-02-10 17:52:05 . 2010-02-10 17:53:02 -------- d-----w- D:\Program Files\Neffy

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 20:22:11 . 2002-11-25 19:42:13 39661600 --sha-w- D:\WINDOWS\system32\drivers\fidbox.dat
2010-03-11 20:20:20 . 2002-11-25 19:42:13 468872 --sha-w- D:\WINDOWS\system32\drivers\fidbox.idx
2010-03-11 20:12:57 . 2010-01-28 05:20:04 3507979 ----a-w- D:\WINDOWS\Internet Logs\tvDebug.zip
2010-03-08 11:46:46 . 2010-02-05 13:37:28 -------- d-----w- D:\Program Files\mIRC
2010-03-07 16:53:38 . 2002-11-25 19:38:04 -------- d--h--w- D:\Program Files\InstallShield Installation Information
2010-02-18 19:19:59 . 2002-11-26 14:48:15 214816 ----a-w- D:\WINDOWS\system32\PnkBstrB.exe
2010-02-18 19:16:02 . 2002-11-26 14:48:22 138328 ----a-w- D:\WINDOWS\system32\drivers\PnkBstrK.sys
2010-02-18 03:34:44 . 2010-02-18 03:35:29 1959936 ----a-w- D:\WINDOWS\Internet Logs\xDBF.tmp
2010-02-17 15:30:59 . 2002-11-28 01:49:44 -------- d-----w- D:\Program Files\Ventrilo
2010-02-15 19:05:26 . 2010-02-16 08:04:02 1950720 ----a-w- D:\WINDOWS\Internet Logs\xDBE.tmp
2010-02-15 19:05:26 . 2010-02-16 08:04:02 1374208 ----a-w- D:\WINDOWS\Internet Logs\xDBD.tmp
2010-02-12 20:51:41 . 2010-02-12 22:15:41 1947136 ----a-w- D:\WINDOWS\Internet Logs\xDBC.tmp
2010-02-12 20:51:41 . 2010-02-12 22:15:40 2945024 ----a-w- D:\WINDOWS\Internet Logs\xDBB.tmp
2010-02-11 17:38:34 . 2010-01-16 15:14:03 98918 ----a-w- D:\WINDOWS\War3Unin.dat
2010-02-11 14:22:00 . 2002-12-02 12:39:06 -------- d-----w- D:\Program Files\Pando Networks
2010-02-09 23:54:28 . 2002-12-03 21:43:49 65536 ----a-w- D:\WINDOWS\IFinst27.exe
2010-02-09 19:44:54 . 2002-11-26 13:35:34 -------- d-----w- D:\Program Files\Registry Easy
2010-02-09 16:19:07 . 2002-11-30 19:59:11 -------- d-----w- D:\Program Files\DNA
2010-02-08 22:52:59 . 2010-02-08 22:52:59 56 ---ha-w- D:\WINDOWS\system32\ezsidmv.dat
2010-02-08 22:47:11 . 2010-02-08 22:46:30 -------- d-----r- D:\Program Files\Skype
2010-02-08 22:46:33 . 2010-02-08 22:46:33 -------- d-----w- D:\Program Files\Common Files\Skype
2010-02-07 19:37:09 . 2010-02-07 19:37:08 -------- d-----w- D:\Program Files\Tunatic
2010-02-07 10:55:29 . 2002-12-04 20:36:00 -------- d-----w- D:\Program Files\PokerStars
2010-02-07 10:54:03 . 2010-01-02 14:00:39 -------- d-----w- D:\Program Files\Common Files\Symantec Shared
2010-02-07 10:31:11 . 2002-11-30 19:59:10 -------- d-----w- D:\Program Files\GamersFirst
2010-02-06 19:14:23 . 2002-12-03 10:00:38 -------- d-----w- D:\Program Files\DivX
2010-02-03 18:53:06 . 2010-02-03 18:55:29 775168 ----a-w- D:\WINDOWS\Internet Logs\xDB9.tmp
2010-02-03 18:53:05 . 2010-02-03 18:55:29 1848832 ----a-w- D:\WINDOWS\Internet Logs\xDBA.tmp
2010-02-03 09:37:38 . 2010-02-03 09:38:49 1835008 ----a-w- D:\WINDOWS\Internet Logs\xDB8.tmp
2010-02-03 09:37:36 . 2010-02-03 09:38:48 3129344 ----a-w- D:\WINDOWS\Internet Logs\xDB7.tmp
2010-02-03 09:14:45 . 2010-02-03 09:14:45 -------- d-----w- D:\Program Files\Windows Live
2010-02-02 20:18:08 . 2010-02-02 20:18:08 -------- d-----w- D:\Program Files\DsNET Corp
2010-02-02 20:17:02 . 2002-11-25 20:00:50 -------- d-----w- D:\Program Files\NVIDIA Corporation
2010-02-02 20:16:17 . 2002-11-25 20:01:18 -------- d-----w- D:\Program Files\Common Files\Wise Installation Wizard
2010-02-02 20:16:06 . 2002-11-25 20:01:25 -------- d-----w- D:\Program Files\AGEIA Technologies
2010-01-27 16:44:16 . 2010-01-12 21:30:39 -------- d-----w- D:\Program Files\Common Files\Blizzard Entertainment
2010-01-27 07:13:30 . 2010-01-27 07:13:30 -------- d-----w- D:\Program Files\Lizard Interactive
2010-01-26 16:02:50 . 2010-01-26 16:02:50 -------- d-----w- D:\Program Files\Common Files\Adobe AIR
2010-01-26 14:15:42 . 2010-01-26 14:09:39 -------- d-----w- D:\Program Files\Xenimus
2010-01-21 17:46:20 . 2010-01-21 17:46:20 -------- d-----w- D:\Program Files\Outspark
2010-01-16 15:18:17 . 2010-01-16 15:14:02 2829 ----a-w- D:\WINDOWS\War3Unin.pif
2010-01-16 15:18:17 . 2010-01-16 15:14:01 139264 ----a-w- D:\WINDOWS\War3Unin.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 278120 ----a-w- D:\WINDOWS\system32\nvmccs.dll
2010-01-11 21:17:44 . 2010-01-11 21:17:44 154216 ----a-w- D:\WINDOWS\system32\nvsvc32.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 145000 ----a-w- D:\WINDOWS\system32\nvcolor.exe
2010-01-11 21:17:44 . 2010-01-11 21:17:44 13666408 ----a-w- D:\WINDOWS\system32\nvcpl.dll
2010-01-11 21:17:44 . 2010-01-11 21:17:44 110696 ----a-w- D:\WINDOWS\system32\nvmctray.dll
2010-01-11 21:17:40 . 2010-01-11 21:17:40 81920 ----a-w- D:\WINDOWS\system32\nvwddi.dll
2010-01-05 12:53:20 . 2010-01-05 12:54:04 1686528 ----a-w- D:\WINDOWS\Internet Logs\xDB6.tmp
2010-01-05 12:53:17 . 2010-01-05 12:54:03 3249664 ----a-w- D:\WINDOWS\Internet Logs\xDB5.tmp
2009-12-17 17:18:54 . 2009-12-17 17:18:54 75264 ----a-w- D:\WINDOWS\system32\uc_holybeast_launching.dll
2009-12-17 17:17:42 . 2009-12-17 17:17:42 64000 ----a-w- D:\WINDOWS\system32\uc_sfighters_launching.dll
2009-12-15 16:21:32 . 2009-12-15 16:21:32 427008 ----a-w- D:\WINDOWS\system32\uc_wepic_launching.dll
.

------- Sigcheck -------

[-] 2008-06-12 09:16:50 . 977034D14621DE018E779C672DDF8472 . 361344 . . [5.1.2600.5512 (xpsp.080413-0852)] . . D:\WINDOWS\system32\drivers\tcpip.sys

[-] 2008-06-12 14:58:16 . C71BB4782833750BF4C02AC30ED670B7 . 1571840 . . [5.1.2600.5512 (xpsp.080413-2111)] . . D:\WINDOWS\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2010-01-07 06:51:08 185344 ----a-w- D:\Program Files\Get Styles\enlbrdr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="D:\Program Files\Pando Networks\Media Booster\PMB.exe" [2010-02-11 14:22:09 2937528]
"BitTorrent"="C:\Program Files\BitTorrent\BitTorrent.exe" [2010-02-12 18:32:18 654128]
"PlayNC Launcher"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 08:05:20 919016]
"nwiz"="nwiz.exe" [BU]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2010-01-11 21:17:44 13666408]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2010-01-11 21:17:44 110696]
"eurobattlegui"="C:\Program Files\Warcraft III\eb.exe" [2009-10-22 18:39:22 757760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 06:52:18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43:28 69632 ------r- D:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 06:52:18 15360 ------w- D:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-01-11 21:17:44 13666408 ----a-w- D:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-01-11 21:17:44 110696 ----a-w- D:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-04-10 07:28:44 16126464 ------r- D:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2009-05-26 22:31:29 85160 ----a-w- D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"vsmon"=2 (0x2)
"nvsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"D:\\WINDOWS\\system32\\PnkBstrA.exe"=
"D:\\WINDOWS\\system32\\PnkBstrB.exe"=
"D:\\Program Files\\DNA\\btdna.exe"=
"C:\\BlackShot\\Blackshot\\system\\BlackShot.exe"=
"C:\\VertigoGames\\Game\\BlackShot\\Blackshot\\system\\BlackShot.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"D:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"C:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\BlackShot\\DDDDAAA\\Blackshot\\system\\blackshot.exe"=

S2 LiveTurbineMessageService;Turbine Message Service - Live;"C:\Turbine Download Manager\TurbineMessageService.exe" --> C:\Turbine Download Manager\TurbineMessageService.exe [?]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;"C:\Turbine Download Manager\TurbineNetworkService.exe" --> C:\Turbine Download Manager\TurbineNetworkService.exe [?]
S3 npggsvc;nProtect GameGuard Service;D:\WINDOWS\system32\GameMon.des -service --> D:\WINDOWS\system32\GameMon.des -service [?]
S3 xhunter1;xhunter1;\??\D:\WINDOWS\xhunter1.sys --> D:\WINDOWS\xhunter1.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search-styles.com/
uInternet Connection Wizard,ShellNext = hxxp://www.dirtysexgames.net/ttt.php
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - D:\Program Files\Get Styles\ct.htm
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Akamai - D:\Program Files\Common Files\Akamai\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 21:21:45
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="D:\WINDOWS\system32\GameMon.des -service"
.
------------------------ Jiné spuštené procesy ------------------------
.
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2010-03-11 21:24:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-11 20:24:32

Před spuštěním: 5 019 754 496
Po spuštění: 4 921 307 136

- - End Of File - - 325A8C8D8189C6CB8A39D40D11A0AA72

[Rudy]

Log již vypadá čistý.

[STAR]

Díky moc zatim to vypadá ok.

[Rudy]

Nemáte zač!