Pomalé hledání stránek a velmi často "server nenalezen"

[Hooker]

Vše smazané.
Malwarebytes' Anti-Malware 1.44
Verze databáze: 3874
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

17.3.2010 10:11:42
mbam-log-2010-03-17 (10-11-42).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 217956
Uplynulý čas: 33 minute(s), 12 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Program Files\WinRAR\Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.
D:\INSTALL\ESET_Smart_Security_v3.0.672\ESET Smart Security v3.0.672 + NodLogin 9.6 (Working RETAIL)\NodLogin 9.6 For NOD32 32 & 64 bits\NodLogin 9.6 32Bits\setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\PROGRAMY\Instalované-war\WinRAR_3.80_CZ\Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.

[Rudy]

OK. Nastala nyní nějaká změna?

[Hooker]

Tak ještě nevím, trošku to tady provětrám a zítra dám vědět. Zatím díky.

[Rudy]

Zatím není zač!

[Hooker]

Omlouvám se za zpoždění, ale včera jsem sednout k počítači jaksi nezvládl. Takže až dnes: Myslím si, že je to lepší. Ale přesto bych měl pár dotazů, pokud se mohu zeptat.
-mohu fixnout tyto položky, které jsou v zaslaném logu?

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O4 - HKLM\..\Run: [Potato Screen Capture] "C:\Program Files\Zamaan's Software\Potato Screen Capture 1.0\psc.exe"

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)

O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)

-O2...vůbec nevím o co jde
-O4...to jsem už odinstaloval
-O9...taky odinstalováno, pokud to nějak nesouvisí s ICQ6.5
-O23..Alcohol 120% odinstalován již dávno
Dík za ochotu a přeji hezký "josefovský" den i večer. Hooker

[Rudy]

Vše můžete fixnout.

[Hooker]

Ahoj. došlo k nečekanému problému. Přestala mi včera fungovat klávesnice, tak jsem dnes asi v 16.00 provedl obnovu systemu k 17.3.2010. Prosím pěkně o novou kontrlu logu. Poslám nový RSIT. Díky.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jirka at 2010-03-20 16:48:29
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 41 GB (34%) free of 119 GB
Total RAM: 2047 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:48:59, on 20.3.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jirka\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Jirka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Jirka\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: (no name) - {C9F97205-62A3-41F2-9F2C-D99392F882EB} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Download all by FlashGet3 - C:\Users\Jirka\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Users\Jirka\AppData\Roaming\FlashGetBHO\GetUrl.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O15 - Trusted Zone: http://software.kuaiche.com
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)

--
End of file - 5609 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-03-08 329312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0}]
FlashGetBHO - C:\Users\Jirka\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll [2009-12-22 157232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9F97205-62A3-41F2-9F2C-D99392F882EB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-03-12 6965792]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2007-12-21 1443072]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-03-08 202256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"UIWatcher"=C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe [2009-02-23 3508568]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8df7614d-624b-11de-ab76-0019dbae7b9f}]
shell\AutoRun\command - J:\autorun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-20 02:49:54 ----D---- C:\Program Files\Microsoft Sync Framework
2010-03-20 02:49:00 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2010-03-20 02:47:38 ----D---- C:\Program Files\Windows Live
2010-03-20 02:47:22 ----D---- C:\Windows\PCHEALTH
2010-03-20 02:23:22 ----D---- C:\Program Files\Common Files\Windows Live
2010-03-19 22:46:58 ----D---- C:\Users\Jirka\AppData\Roaming\ColorCop
2010-03-16 22:02:02 ----D---- C:\Users\Jirka\AppData\Roaming\Malwarebytes
2010-03-16 22:01:55 ----D---- C:\ProgramData\Malwarebytes
2010-03-16 22:01:52 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-11 17:20:01 ----D---- C:\Program Files\MSECache
2010-03-11 04:11:31 ----D---- C:\Program Files\NVIDIA Corporation
2010-03-11 04:06:22 ----A---- C:\Windows\system32\browserchoice.exe
2010-03-11 00:41:59 ----A---- C:\Windows\system32\nshhttp.dll
2010-03-11 00:41:53 ----A---- C:\Windows\system32\httpapi.dll
2010-03-08 21:34:37 ----D---- C:\Program Files\Common Files\xing shared
2010-02-24 03:04:26 ----A---- C:\Windows\system32\jscript.dll
2010-02-24 03:04:18 ----A---- C:\Windows\system32\tzres.dll
2010-02-24 03:03:37 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-24 03:03:36 ----A---- C:\Windows\system32\secproc.dll
2010-02-24 03:03:18 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-24 03:03:16 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-24 03:03:16 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-24 03:03:15 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-24 03:03:13 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-24 03:03:13 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-24 03:03:13 ----A---- C:\Windows\system32\msdrm.dll
2010-02-24 03:03:08 ----A---- C:\Windows\system32\gameux.dll
2010-02-24 03:03:06 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-02-24 03:03:06 ----A---- C:\Windows\system32\Apphlpdm.dll

======List of files/folders modified in the last 1 months======

2010-03-20 16:48:43 ----D---- C:\Windows\Prefetch
2010-03-20 16:48:35 ----D---- C:\Windows\temp
2010-03-20 16:39:31 ----AD---- C:\Windows\System32
2010-03-20 16:39:30 ----D---- C:\Windows\inf
2010-03-20 16:39:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-03-20 16:38:25 ----SHD---- C:\System Volume Information
2010-03-20 16:33:16 ----D---- C:\Windows\system32\wbem
2010-03-20 16:33:16 ----D---- C:\Windows
2010-03-20 16:32:18 ----D---- C:\Windows\system32\config
2010-03-20 16:32:02 ----D---- C:\Windows\Tasks
2010-03-20 16:32:02 ----D---- C:\Windows\system32\spool
2010-03-20 16:32:02 ----D---- C:\Windows\system32\Msdtc
2010-03-20 16:32:02 ----D---- C:\Windows\system32\CodeIntegrity
2010-03-20 16:32:02 ----D---- C:\Windows\system32\catroot2
2010-03-20 16:32:01 ----D---- C:\Users\Jirka\AppData\Roaming\BITS
2010-03-20 16:32:00 ----D---- C:\Windows\registration
2010-03-20 15:42:50 ----D---- C:\Windows\Microsoft.NET
2010-03-20 15:42:10 ----RSD---- C:\Windows\assembly
2010-03-20 11:33:20 ----D---- C:\Users\Jirka\AppData\Roaming\Skype
2010-03-20 11:32:05 ----SHD---- C:\Windows\Installer
2010-03-20 11:32:02 ----SD---- C:\ProgramData\Microsoft
2010-03-20 10:21:52 ----D---- C:\Users\Jirka\AppData\Roaming\skypePM
2010-03-20 02:53:36 ----SD---- C:\Users\Jirka\AppData\Roaming\Microsoft
2010-03-20 02:50:26 ----D---- C:\Windows\system32\drivers
2010-03-20 02:49:58 ----D---- C:\Windows\winsxs
2010-03-20 02:49:54 ----RD---- C:\Program Files
2010-03-20 02:47:48 ----D---- C:\Program Files\Common Files\microsoft shared
2010-03-20 02:23:22 ----D---- C:\Program Files\Common Files
2010-03-18 02:21:01 ----D---- C:\Downloads
2010-03-17 10:17:52 ----D---- C:\Windows\twain_32
2010-03-17 10:11:42 ----D---- C:\Program Files\WinRAR
2010-03-16 22:01:55 ----HD---- C:\ProgramData
2010-03-14 17:14:17 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-03-14 17:13:49 ----D---- C:\Windows\system32\Tasks
2010-03-12 17:39:26 ----AD---- C:\ProgramData\TEMP
2010-03-11 17:35:57 ----D---- C:\ProgramData\Real
2010-03-11 04:12:53 ----D---- C:\ProgramData\NVIDIA
2010-03-11 04:11:20 ----D---- C:\Windows\system32\catroot
2010-03-11 03:58:59 ----D---- C:\Program Files\Windows Mail
2010-03-11 03:58:59 ----D---- C:\Program Files\Movie Maker
2010-03-08 21:36:01 ----D---- C:\Users\Jirka\AppData\Roaming\Real
2010-03-08 21:35:19 ----D---- C:\Program Files\Common Files\Real
2010-03-08 21:35:16 ----A---- C:\Windows\system32\rmoc3260.dll
2010-03-08 21:35:08 ----A---- C:\Windows\system32\pndx5032.dll
2010-03-08 21:35:08 ----A---- C:\Windows\system32\pndx5016.dll
2010-03-08 21:34:44 ----D---- C:\Program Files\real
2010-03-08 21:34:12 ----A---- C:\Windows\system32\pncrt.dll
2010-03-05 20:53:20 ----D---- C:\Users\Jirka\AppData\Roaming\Vso
2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe
2010-02-27 00:22:18 ----D---- C:\Program Files\CCleaner
2010-02-24 14:36:24 ----D---- C:\Windows\rescache
2010-02-24 10:16:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-24 05:37:00 ----D---- C:\Windows\system32\cs-CZ
2010-02-24 05:36:56 ----D---- C:\Windows\AppPatch
2010-02-24 05:36:54 ----RSD---- C:\Windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 EIO;EIO; \??\C:\Windows\system32\drivers\EIO.sys [2006-06-14 12288]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2007-12-21 53768]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2007-12-21 71176]
R3 3xHybrid;3xHybrid service; C:\Windows\system32\DRIVERS\3xHybrid.sys [2007-04-20 674048]
R3 ASUSVRC;ASUSTeK Virtual Capture Device; C:\Windows\system32\DRIVERS\AsusVRC.sys [2007-01-29 18432]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2007-12-21 30728]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-03-12 2342688]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-01-12 11586280]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2006-11-02 44544]
S3 adn931vu;adn931vu; C:\Windows\system32\drivers\adn931vu.sys []
S3 Dot4;Ovladač MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2009-07-25 13224]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2009-07-25 25512]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2009-06-15 47360]
S3 se3ebus;Sony Ericsson Device 062 (WDM); C:\Windows\system32\DRIVERS\se3ebus.sys [2007-04-10 83080]
S3 se3emdfl;Sony Ericsson Device 062 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\se3emdfl.sys [2007-04-10 15112]
S3 se3emdm;Sony Ericsson Device 062 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\se3emdm.sys [2007-04-10 108552]
S3 se3emgmt;Sony Ericsson Device 062 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\se3emgmt.sys [2007-04-10 100360]
S3 se3eobex;Sony Ericsson Device 062 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\se3eobex.sys [2007-04-10 98568]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-10-20 71096]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-11 129640]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe []
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2007-12-21 19200]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]

-----------------EOF-----------------

[Rudy]

Log vypadá čistý.

[Hooker]

Tak to je fajn. Prosil bych o jednu radu. Ve složce Download mám už delší dobu soubor s nulovýn obsahem a nejde nikterak odstranit, viz obrázek. Můžeš, prosím poradit, jak se toho šmejda zbavit? Díky Hooker
http://yfrog.com/esscreenshot2137364196j

http://yfrog.com/6tvilvlastnostij

[Rudy]

Stáhněte a spusťte Avenger: http://www.viry.cz/forum/viewtopic.php?f=15&t=19832 tímto skriptem:

Files to delete:
C:\users\jirka\downloads\V.I.L.

[Hooker]

Tak to proběhlo O.K.
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\users\jirka\downloads\V.I.L." deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Jestli mohu, tak mám ještě jeden malý problem. Synátor si dle nějaké inter. rady chtěl udělat složku, kterou na ploše neuvidím a dopadlo to tak, že složka je vidět, nemá název, nejde pojmenovat ani odstranit. Je možno jí nějak odstranit? Pokud ne, tak se s tím žít nechá,že? Viz obr:http://img265.imageshack.us/img265/726/ ... 150917.jpg
Jinak pokud je vše jak má být, tak díky za ochotu a obětovaný čas. Hooker

[Rudy]

Ano, soubor byl smazán. Nastala nějaká změna?

[Hooker]

Myslím si, že je to v pořádku. Pokud se stalo, že "server nenalezen", tak na druhý pokus je nalezen a už to není takový šnek. Teď bude třeba asi odinstalovat použité programy, že? Mám na to použít odinstalátor windows? Díky.

[Rudy]

RSIT a MBAM je možné odinstalovat přes přidat/ubrat programy.

[Hooker]

Vše jsem odinstaloval, je to O.K. Díky za ochotu a věnovaný čas. Hooker