prosím o kontrolu logu, virus generuje autorun.inf

[igor.p]

Logfile of random's system information tool 1.06 (written by random/random)
Run by prijem 2 at 2010-03-25 18:13:29
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 17 GB (56%) free of 31 GB
Total RAM: 767 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:49, on 25.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\WINDOWS\system32\oodtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AutorunRemover\AutorunRemover.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\prijem 2\Plocha\RSIT.exe
C:\Program Files\trend micro\prijem 2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést vybrané vazby do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést vybrané vazby do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést výběr do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést výběr do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Přidat do stávajícího PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8377002093
O17 - HKLM\System\CCS\Services\Tcpip\..\{39BBA4F2-A0A9-48B0-828B-74AE6F4E6862}: NameServer = 62.129.50.20,85.135.32.100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

--
End of file - 7933 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\OGALogon.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-21 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-11 321120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-31 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-31 806912]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-11 321120]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"=C:\WINDOWS\system32\oodtray.exe [2007-05-11 2512392]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"AutorunRemover.exe"=C:\Program Files\AutorunRemover\AutorunRemover.exe [2010-03-25 1257472]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-02-26 2140880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2008-01-11 623992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-02-16 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Synchronizer.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Acrobat\ADOBEC~1.EXE [2007-05-11 738968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logo Calibration Loader.lnk]
C:\PROGRA~1\GRETAG~1\i1\EYE-ON~1\CALIBR~1\CALIBR~1.EXE [2006-06-29 708608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ProfileReminder.lnk]
C:\PROGRA~1\GRETAG~1\i1\EYE-ON~1\PROFIL~1.EXE [2006-06-29 954368]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1029-0000-7760-000000000003}\_SC_Acrobat.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
C:\WINDOWS\system32\PCANotify.dll [2007-04-27 18744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Symantec\pcAnywhere\awhost32.exe"="C:\Program Files\Symantec\pcAnywhere\awhost32.exe:*:Enabled:pcAnywhere Host"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049ba9-365b-11df-8a22-00a024a66859}]
shell\AutoRun\command - F:\SMEKER//laushki.exe
shell\open\command - F:\SMEKER//laushki.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049baa-365b-11df-8a22-00a024a66859}]
shell\AutoRun\command - F:\SMEKER//laushki.exe
shell\open\command - F:\SMEKER//laushki.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{099c2ae7-efa7-11de-89dc-00a024a66859}]
shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd849c-1f5b-11de-88e5-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd84a0-1f5b-11de-88e5-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL media.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13bf25b8-e882-11de-89d5-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16da3e35-0fe1-11df-89f6-00a024a66859}]
shell\AutoRun\command - F:\jedna/stvar.exe
shell\explore\command - F:\jedna/stvar.exe
shell\open\command - F:\jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16f0b1c8-92d9-11de-8972-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191bee3d-00dd-11df-89e9-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL TomÁŠ vilCsEK.eXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bc0199e-ed13-11dd-acff-00a024a66859}]
shell\AutoRun\command - D:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1dc2116e-c1f9-11de-89ac-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26b66745-2120-11df-8a0c-00a024a66859}]
shell\AutoRun\command - jedna/stvar.exe
shell\explore\command - jedna/stvar.exe
shell\open\command - jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{370e7608-1618-11df-8a02-00a024a66859}]
shell\AutoRun\command - F:\jedna/stvar.exe
shell\explore\command - F:\jedna/stvar.exe
shell\open\command - F:\jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a65255c-2f00-11de-88f8-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b438f87-2993-11de-88ef-00a024a66859}]
shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e82b106-1f90-11df-8a0a-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99973-392e-11de-8905-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99974-392e-11de-8905-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99986-392e-11de-8905-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{578f1b4a-17d4-11df-8a04-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7cf-6c5b-11de-8940-00a024a66859}]
shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7d1-6c5b-11de-8940-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{585bb7f7-0a17-11de-ad14-00a024a66859}]
shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{638314f0-01af-11df-89ea-00a024a66859}]
shell\AutoRun\command - F:\Autorun.exe main\assetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dcc6f18-04d8-11df-89eb-00a024a66859}]
shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7116c05e-30a3-11de-88fb-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{744593b0-469e-11de-8914-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f70c900-2c15-11df-8a17-00a024a66859}]
shell\AutoRun\command - RAZLOG///zaljubljeni.exe
shell\explore\command - RAZLOG///zaljubljeni.exe
shell\open\command - RAZLOG///zaljubljeni.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82160b4f-2a5e-11de-88f0-00a024a66859}]
shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9310ab09-e6d4-11dd-acfb-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b05e4de-2985-11de-88ee-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cab2cc1-0e06-11de-ad18-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOMአVILcSek.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cd9adcc-3dec-11de-8908-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fb85991-b181-11de-8996-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOMአVILcSek.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e76636-acbe-11de-898e-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3af0ee0-fe93-11de-89e5-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a85d1261-300f-11df-8a1a-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add385b5-2fcf-11de-88f9-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aea4ad18-353c-11de-8901-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb7ddda1-3ac5-11de-8907-00a024a66859}]
shell\AutoRun\command - jedna/stvar.exe
shell\explore\command - jedna/stvar.exe
shell\open\command - jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf97f203-d98b-11de-89c5-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2c9e277-ff63-11de-89e6-00a024a66859}]
shell\AutoRun\command - F:\setup.exe start-king.ctx

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c88b1b5c-1e7c-11de-88e3-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91bc21c-1aa7-11de-88e1-00a024a66859}]
shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc84aca5-21d2-11df-8a0d-00a024a66859}]
shell\AutoRun\command - F:\StartPortableApps.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfad9178-072d-11de-ad0d-00a024a66859}]
shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1866a66-e64c-11de-89d3-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL toMÁš Vilcsek.Exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b1-371a-11df-8a23-00a024a66859}]
shell\AutoRun\command - F:\SMEKER//laushki.exe
shell\open\command - F:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b3-371a-11df-8a23-00a024a66859}]
shell\AutoRun\command - F:\
shell\open\command - F:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9ee0b7e-068e-11df-89ed-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOmአvILcsEK.eXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed9a2675-67c2-11de-893d-00a024a66859}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .////epidemic\\\\\\\\\syndrom.exe
shell\Explore\command - F:\.\\\\epidemic\syndrom.exe
shell\open\command - F:\epidemic\\\\\\\\\syndrom.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9400df1-3481-11de-88fe-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff9e6e8b-edf9-11de-89da-00a024a66859}]
shell\AutoRun\command - F:\LaunchU3.exe -a


======File associations======

.txt - open - NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2010-03-25 14:45:16 ----D---- C:\rsit
2010-03-25 14:45:16 ----D---- C:\Program Files\trend micro
2010-03-25 14:26:26 ----D---- C:\WINDOWS\temp
2010-03-25 14:26:24 ----A---- C:\ComboFix.txt
2010-03-25 14:15:27 ----A---- C:\Boot.bak
2010-03-25 14:15:22 ----RASHD---- C:\cmdcons
2010-03-25 14:14:16 ----A---- C:\WINDOWS\zip.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\SWSC.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\SWREG.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\sed.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\PEV.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\MBR.exe
2010-03-25 14:14:16 ----A---- C:\WINDOWS\grep.exe
2010-03-25 14:14:09 ----D---- C:\WINDOWS\ERDNT
2010-03-25 14:13:36 ----D---- C:\Qoobox
2010-03-25 12:02:34 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-25 09:51:46 ----D---- C:\Program Files\AutorunRemover
2010-03-19 08:08:25 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-03-19 07:54:27 ----D---- C:\Program Files\Microsoft Works
2010-03-19 07:54:19 ----D---- C:\Program Files\MSBuild
2010-03-19 07:53:58 ----D---- C:\Program Files\Microsoft Visual Studio
2010-03-19 07:50:25 ----D---- C:\WINDOWS\SHELLNEW
2010-03-19 07:49:06 ----RD---- C:\MSOCache
2010-03-15 15:51:31 ----A---- C:\WINDOWS\setuplog.txt
2010-03-10 07:04:13 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-08 10:21:06 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-05 11:34:05 ----D---- C:\001874-Proces-cedule

======List of files/folders modified in the last 1 months======

2010-03-25 18:13:36 ----D---- C:\WINDOWS\Prefetch
2010-03-25 14:45:16 ----RD---- C:\Program Files
2010-03-25 14:40:21 ----D---- C:\Program Files\Mozilla Firefox
2010-03-25 14:29:23 ----D---- C:\WINDOWS\system32\drivers
2010-03-25 14:26:26 ----D---- C:\WINDOWS
2010-03-25 14:24:19 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-25 14:22:51 ----A---- C:\WINDOWS\system.ini
2010-03-25 14:20:13 ----D---- C:\WINDOWS\system32\config
2010-03-25 14:18:16 ----D---- C:\WINDOWS\system32
2010-03-25 14:18:16 ----D---- C:\WINDOWS\AppPatch
2010-03-25 14:18:13 ----D---- C:\Program Files\Common Files
2010-03-25 14:15:27 ----RASH---- C:\boot.ini
2010-03-25 14:14:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-25 14:14:15 ----SHD---- C:\System Volume Information
2010-03-25 14:14:15 ----D---- C:\WINDOWS\system32\Restore
2010-03-25 13:49:45 ----A---- C:\WINDOWS\wincmd.ini
2010-03-25 12:47:27 ----SHD---- C:\WINDOWS\Installer
2010-03-25 12:47:19 ----HD---- C:\WINDOWS\inf
2010-03-19 09:36:04 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-03-19 09:03:28 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-19 09:00:24 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-03-19 08:57:50 ----A---- C:\WINDOWS\win.ini
2010-03-19 08:56:44 ----D---- C:\WINDOWS\WinSxS
2010-03-19 08:00:56 ----D---- C:\WINDOWS\SxsCaPendDel
2010-03-19 07:54:10 ----D---- C:\Program Files\Microsoft Office
2010-03-19 07:53:58 ----D---- C:\Program Files\Common Files\Designer
2010-03-19 07:53:35 ----RSD---- C:\WINDOWS\Fonts
2010-03-19 07:50:42 ----D---- C:\Program Files\Common Files\System
2010-03-19 07:46:53 ----D---- C:\WINDOWS\pchealth
2010-03-18 10:04:12 ----D---- C:\Documents and Settings\prijem 2\Data aplikací\U3
2010-03-10 07:04:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-10 07:04:19 ----D---- C:\Program Files\Movie Maker
2010-03-10 07:04:06 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-05 14:43:55 ----A---- C:\WINDOWS\wcx_ftp.ini
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AW_HOST;AW_HOST; C:\WINDOWS\system32\drivers\aw_host5.sys [2007-03-30 18232]
R1 awecho;awecho; C:\WINDOWS\system32\drivers\awechomd.sys [2007-03-30 13368]
R1 awlegacy;awlegacy; C:\WINDOWS\System32\Drivers\awlegacy.sys [2007-03-30 17848]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-02-26 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-02-26 95872]
R1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-14 46592]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2002-09-16 4228]
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2008-06-20 225856]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-02-26 139192]
R2 PDIHWCTL;PDIHWCTL; \??\C:\WINDOWS\system32\drivers\pdihwctl.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-03-20 44384]
R3 atirage3;atirage3; C:\WINDOWS\system32\DRIVERS\atimpae.sys [2001-10-24 75136]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 eyeonedp;eye-one display; C:\WINDOWS\system32\DRIVERS\eyeonedp.sys [2004-05-07 44344]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mbr;mbr; \??\C:\DOCUME~1\PRIJEM~1\LOCALS~1\Temp\mbr.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Pomocná služba protokolu IPv6; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2007-10-23 427288]
R2 awhost32;Symantec pcAnywhere Host Service; C:\Program Files\Symantec\pcAnywhere\awhost32.exe [2008-09-05 136568]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-02-26 810120]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-05-11 1050120]
R2 SimpTcp;Jednoduché služby TCP/IP; C:\WINDOWS\system32\tcpsvcs.exe [2001-10-25 19456]
R2 TryAndDecideService;Acronis Try And Decide Service; C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2007-10-23 495832]
R2 UxTuneUp;TuneUp Design Expansion; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-02-26 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-12-08 654848]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2008-06-30 3093872]
S3 LPDSVC;Tiskový server TCP/IP; C:\WINDOWS\system32\tcpsvcs.exe [2001-10-25 19456]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 p2pgasvc;Ověřování v síti skupiny rovnocenných počítačů; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 p2pimsvc;Správce identit sítě rovnocenných počítačů; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 p2psvc;Síť rovnocenných počítačů; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 PNRPSvc;Protokol PNRP; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 SNMP;SNMP; C:\WINDOWS\System32\snmp.exe [2008-04-14 32768]
S3 SNMPTRAP;Zachytávání pro službu SNMP; C:\WINDOWS\System32\snmptrap.exe [2008-04-14 8704]

-----------------EOF-----------------

[Caroprd111]

Zdravím

Na logu se pracuje, prosím o strpení.

[Caroprd111]

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Vložte do PC všechny flash disky, které používáte.
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

[igor.p]

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Vložte do PC všechny flash disky, které používáte.
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

[Caroprd111]

Vložte sem ten log, co jste už dělal.

Nedoporučuji používat ComboFix z vlastní iniciativy, může dojít k poškození systému!

[igor.p]

Vložte sem ten log, co už jste dělal.

ComboFix 10-03-24.03 - Administrator 25.03.2010 14:16:21.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.767.212 [GMT 1:00]
Spuštěný z: c:\documents and settings\prijem 2\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\prijem 2\csrss.exe
C:\LOG8B.tmp
c:\recycler\S-1-5-21-2347402815-1024867655-585184964-0781
c:\recycler\S-1-5-21-4454894228-2639397479-599991977-6427
c:\recycler\S-1-5-21-9644261538-7987379946-730875629-4487

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-25 do 2010-03-25 )))))))))))))))))))))))))))))))
.

2010-03-25 08:51 . 2010-03-25 10:57 -------- d-----w- c:\program files\AutorunRemover
2010-03-19 07:08 . 2010-03-19 07:08 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-19 06:54 . 2010-03-19 07:59 -------- d-----w- c:\program files\Microsoft Works
2010-03-19 06:54 . 2010-03-19 06:54 -------- d-----w- c:\program files\MSBuild
2010-03-19 06:50 . 2010-03-19 07:06 -------- d-----w- c:\windows\SHELLNEW
2010-03-19 06:49 . 2010-03-19 06:49 -------- d-----r- C:\MSOCache
2010-03-10 05:43 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 09:21 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-05 10:34 . 2010-03-05 10:34 -------- d-----w- C:\001874-Proces-cedule
2010-02-26 05:41 . 2010-02-26 05:41 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-02-25 14:41 . 2010-02-25 14:42 -------- d-----w- C:\001780-samolepky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 05:41 . 2008-10-24 19:53 95872 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-02-26 05:39 . 2008-10-24 19:45 139192 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-02-25 05:58 . 2008-10-20 07:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-05 09:58 . 2004-08-17 13:49 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:57 . 2004-08-17 13:49 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2004-08-17 13:49 17408 ------w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AutorunRemover.exe"="c:\program files\AutorunRemover\AutorunRemover.exe" [2010-03-25 1257472]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-02-26 2140880]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1029-0000-7760-000000000003}\_SC_Acrobat.exe [2008-12-8 295606]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2007-04-27 11:10 18744 ----a-w- c:\windows\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-01-11 18:54 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 14:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)
"20486:UDP"= 20486:UDP:Enfocus Port
"24654:UDP"= 24654:UDP:Enfocus Port

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [26.2.2010 6:41 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24.10.2008 20:53 95872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [26.2.2010 6:41 810120]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [12.5.2009 4:37 14416]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [12.5.2009 4:37 44344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049ba9-365b-11df-8a22-00a024a66859}]
\Shell\AutoRun\command - F:\SMEKER//laushki.exe
\Shell\open\command - F:\SMEKER//laushki.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049baa-365b-11df-8a22-00a024a66859}]
\Shell\AutoRun\command - F:\SMEKER//laushki.exe
\Shell\open\command - F:\SMEKER//laushki.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{099c2ae7-efa7-11de-89dc-00a024a66859}]
\Shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd849c-1f5b-11de-88e5-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd84a0-1f5b-11de-88e5-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL media.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13bf25b8-e882-11de-89d5-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16da3e35-0fe1-11df-89f6-00a024a66859}]
\Shell\AutoRun\command - F:\jedna/stvar.exe
\Shell\explore\command - F:\jedna/stvar.exe
\Shell\open\command - F:\jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16f0b1c8-92d9-11de-8972-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191bee3d-00dd-11df-89e9-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL TomÁŠ vilCsEK.eXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bc0199e-ed13-11dd-acff-00a024a66859}]
\Shell\AutoRun\command - D:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1dc2116e-c1f9-11de-89ac-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26b66745-2120-11df-8a0c-00a024a66859}]
\Shell\AutoRun\command - jedna/stvar.exe
\Shell\explore\command - jedna/stvar.exe
\Shell\open\command - jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{370e7608-1618-11df-8a02-00a024a66859}]
\Shell\AutoRun\command - F:\jedna/stvar.exe
\Shell\explore\command - F:\jedna/stvar.exe
\Shell\open\command - F:\jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a65255c-2f00-11de-88f8-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b438f87-2993-11de-88ef-00a024a66859}]
\Shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e82b106-1f90-11df-8a0a-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99973-392e-11de-8905-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99974-392e-11de-8905-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99986-392e-11de-8905-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{578f1b4a-17d4-11df-8a04-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7cf-6c5b-11de-8940-00a024a66859}]
\Shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7d1-6c5b-11de-8940-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{585bb7f7-0a17-11de-ad14-00a024a66859}]
\Shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{638314f0-01af-11df-89ea-00a024a66859}]
\Shell\AutoRun\command - f:\autorun.exe main\assetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dcc6f18-04d8-11df-89eb-00a024a66859}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7116c05e-30a3-11de-88fb-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{744593b0-469e-11de-8914-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f70c900-2c15-11df-8a17-00a024a66859}]
\Shell\AutoRun\command - RAZLOG///zaljubljeni.exe
\Shell\explore\command - RAZLOG///zaljubljeni.exe
\Shell\open\command - RAZLOG///zaljubljeni.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82160b4f-2a5e-11de-88f0-00a024a66859}]
\Shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9310ab09-e6d4-11dd-acfb-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b05e4de-2985-11de-88ee-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cab2cc1-0e06-11de-ad18-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOMአVILcSek.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cd9adcc-3dec-11de-8908-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fb85991-b181-11de-8996-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOMአVILcSek.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e76636-acbe-11de-898e-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3af0ee0-fe93-11de-89e5-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a85d1261-300f-11df-8a1a-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add385b5-2fcf-11de-88f9-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aea4ad18-353c-11de-8901-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb7ddda1-3ac5-11de-8907-00a024a66859}]
\Shell\AutoRun\command - jedna/stvar.exe
\Shell\explore\command - jedna/stvar.exe
\Shell\open\command - jedna/stvar.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf97f203-d98b-11de-89c5-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2c9e277-ff63-11de-89e6-00a024a66859}]
\Shell\AutoRun\command - F:\setup.exe start-king.ctx

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c88b1b5c-1e7c-11de-88e3-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91bc21c-1aa7-11de-88e1-00a024a66859}]
\Shell\AutoRun\command - setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc84aca5-21d2-11df-8a0d-00a024a66859}]
\Shell\AutoRun\command - F:\StartPortableApps.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfad9178-072d-11de-ad0d-00a024a66859}]
\Shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1866a66-e64c-11de-89d3-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL toMÁš Vilcsek.Exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b1-371a-11df-8a23-00a024a66859}]
\Shell\AutoRun\command - F:\SMEKER//laushki.exe
\Shell\open\command - F:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b3-371a-11df-8a23-00a024a66859}]
\Shell\AutoRun\command - F:\
\Shell\open\command - F:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9ee0b7e-068e-11df-89ed-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tOmአvILcsEK.eXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed9a2675-67c2-11de-893d-00a024a66859}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .////epidemic\\\\\\\\\syndrom.exe
\Shell\Explore\COMMAND - f:\.\\\\epidemic\syndrom.exe
\Shell\open\commAND - f:\epidemic\\\\\\\\\syndrom.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9400df1-3481-11de-88fe-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff9e6e8b-edf9-11de-89da-00a024a66859}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Obsah adresáře 'Naplánované úlohy'

2010-01-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]

2010-03-25 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]

2010-03-25 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést vybrané vazby do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést vybrané vazby do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést výběr do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést výběr do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Přidat do stávajícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: {39BBA4F2-A0A9-48B0-828B-74AE6F4E6862} = 62.129.50.20,85.135.32.100
FF - ProfilePath - c:\documents and settings\prijem 2\Data aplikací\Mozilla\Firefox\Profiles\8jrh4oq4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/firefox?client=firefox-a& ... s:official
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-_{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91} - c:\program files\Corel\CorelDRAW Graphics Suite 13\Programs\MSILauncher {7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-25 14:22
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="5A2EBD8726D08A8CBA1C45EA4CC2151D703A44979597A5E8AB74F66DA13D0F0DB682F54CDEBBAB348B1746D83744AB7E06CEFD1B44058D4AA5F2F26112628CBED412047E7CE831B1CCE463CB0D1D6CD0047C7F06FA1A3DA9274FF2752B7B70F4318785E5479CE9FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79339DB7CE019D40AA5CFEBC9E127BECC74C2568B769F88CBFFAAB090A421A52EDEB6A8BF04D29D23A2A16D32EEA8A47B25E49692E5038802FA0D184DA87B6FD0C4BD22D3F865E92B8CE39E77FCD741E9520F476979B114F1B320E2576AF5B7FDB7D03AA5D1E90934E21FC9296315B796A064C42F957FDA6149DBA014130C835DB2B291B2B1464878421060C73BCEBFC6905094411754F3C9FF244EE53611287FC1D86D53EC7D2A4DBF08A4E45FBA04FBEBB75384AC9A5C6B6E6AD8B76829FDC264072795E82282346D7551672DDCD1B8968731C488D798146538AB72CB22DA230A6576687EC85C12BC0C6661536970EDFEF763461DA942CAFB40516A7F849C86B08B242EB95DEC1E4BAD206793CF65CC75907062133960BC6AB5A904E3E59C497BC9776EE6F7D69C3F77DFCA28BBC3C3ED0C15EC47B72E5D4FCDB513E50148E6C432BAEA8D07E810A51E51CC424096733A6D54BC0FCEC879892EE4A45DE062313BCA9DC66F352596FBEB973CAE7501E0BCD88213861A240C1F88B2EE8818E0329EF5FB7A7773E409CE0BBDA50205E211C5FB175093C0264746040F5DEB0E0334147AF35A35DD90DB37BC3EAA8F5CF3835163EA541FECDC84C1F2EDD924A863C61CE8F16BF0C141AC6F2BC0259FA17AD93D32ECD21841DCCD3AB0BE5248FD8AA04B98BD81A4E2BC35BD4274499A0F8D0EC1A94D3A107594D0DA51F52E725898F165EBF43035234EC6E4F1495D9BF9074E8911BDDEBA8C3AF6D4CC72B64941C7E7AB45F5F7E2A1A7AED332D20B914CBED23877DD65F6D6C5A5D04F6BC56CBE611075DB079C5CD98D5BDF92CD310BBE918ACE98C6E0EBDBB3A3AD73196AA1D18E285178E234595BFEC34BDE0E165BA0452884EAC973E656B3DD473118D873B2D1635CAE6311E4174311C3DAD4077F7027FAE6BD5096B150CD871A7C239C3C2FA4F4600BABCA2F17099355B0C2837BFA1858B1D13BD42617E034B698876E92EA8B55F66A1A35D30BF1E319E059ACBC075CF006406F5A7C2FA390D51B565BA61B3779B4FC5850A63C23DB9B2B9568D8E62CC5F64E2B431158AF9591DB469A8A06AC308B065C91A5D30F7E666DB640BA0A36E70E4F1BF29198D4944AC83AADC94705026A3D218314E8E55C9ABB38D04D1C5AB71520E248D7437AED6073317B1CB3E556C6773DD28CC3BDD649A1B5F70E32A7F903CAA2F11AD0C350FD167"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\PCANotify.dll

- - - - - - - > 'lsass.exe'(792)
c:\windows\system32\relog_ap.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Symantec\pcAnywhere\awhost32.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\oodag.exe
c:\windows\system32\tcpsvcs.exe
c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
c:\program files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
.
**************************************************************************
.
Celkový čas: 2010-03-25 14:26:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-25 13:26

Před spuštěním: Volných bajtů: 18 166 022 144
Po spuštění: Volných bajtů: 18 048 266 240

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 89348E29E59B73D3EAA9C616FC538129

[Caroprd111]

Vydržte, napíšu skript na smazání.

[Caroprd111]

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049ba9-365b-11df-8a22-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049baa-365b-11df-8a22-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{099c2ae7-efa7-11de-89dc-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd84a0-1f5b-11de-88e5-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16da3e35-0fe1-11df-89f6-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191bee3d-00dd-11df-89e9-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bc0199e-ed13-11dd-acff-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26b66745-2120-11df-8a0c-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{370e7608-1618-11df-8a02-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b438f87-2993-11de-88ef-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99974-392e-11de-8905-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7cf-6c5b-11de-8940-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{585bb7f7-0a17-11de-ad14-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{638314f0-01af-11df-89ea-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dcc6f18-04d8-11df-89eb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7116c05e-30a3-11de-88fb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f70c900-2c15-11df-8a17-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82160b4f-2a5e-11de-88f0-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9310ab09-e6d4-11dd-acfb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cab2cc1-0e06-11de-ad18-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fb85991-b181-11de-8996-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e76636-acbe-11de-898e-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3af0ee0-fe93-11de-89e5-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a85d1261-300f-11df-8a1a-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb7ddda1-3ac5-11de-8907-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2c9e277-ff63-11de-89e6-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c88b1b5c-1e7c-11de-88e3-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91bc21c-1aa7-11de-88e1-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc84aca5-21d2-11df-8a0d-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfad9178-072d-11de-ad0d-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1866a66-e64c-11de-89d3-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b1-371a-11df-8a23-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b3-371a-11df-8a23-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9ee0b7e-068e-11df-89ed-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed9a2675-67c2-11de-893d-00a024a66859}]

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[igor.p]

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049ba9-365b-11df-8a22-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09049baa-365b-11df-8a22-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{099c2ae7-efa7-11de-89dc-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09bd84a0-1f5b-11de-88e5-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16da3e35-0fe1-11df-89f6-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191bee3d-00dd-11df-89e9-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bc0199e-ed13-11dd-acff-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26b66745-2120-11df-8a0c-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{370e7608-1618-11df-8a02-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b438f87-2993-11de-88ef-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d99974-392e-11de-8905-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580aa7cf-6c5b-11de-8940-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{585bb7f7-0a17-11de-ad14-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{638314f0-01af-11df-89ea-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dcc6f18-04d8-11df-89eb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7116c05e-30a3-11de-88fb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f70c900-2c15-11df-8a17-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82160b4f-2a5e-11de-88f0-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9310ab09-e6d4-11dd-acfb-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cab2cc1-0e06-11de-ad18-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fb85991-b181-11de-8996-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e76636-acbe-11de-898e-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3af0ee0-fe93-11de-89e5-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a85d1261-300f-11df-8a1a-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb7ddda1-3ac5-11de-8907-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2c9e277-ff63-11de-89e6-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c88b1b5c-1e7c-11de-88e3-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91bc21c-1aa7-11de-88e1-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc84aca5-21d2-11df-8a0d-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfad9178-072d-11de-ad0d-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1866a66-e64c-11de-89d3-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b1-371a-11df-8a23-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9e512b3-371a-11df-8a23-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9ee0b7e-068e-11df-89ed-00a024a66859}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed9a2675-67c2-11de-893d-00a024a66859}]

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[Caroprd111]

Máte nějaký problém

[igor.p]

Máte nějaký problém

ComboFix 10-03-24.03 - prijem 2 25.03.2010 18:41:56.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.767.360 [GMT 1:00]
Spuštěný z: c:\documents and settings\prijem 2\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\prijem 2\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-25 do 2010-03-25 )))))))))))))))))))))))))))))))
.

2010-03-25 13:45 . 2010-03-25 17:13 -------- d-----w- c:\program files\trend micro
2010-03-25 13:45 . 2010-03-25 13:45 -------- d-----w- C:\rsit
2010-03-25 08:51 . 2010-03-25 10:57 -------- d-----w- c:\program files\AutorunRemover
2010-03-19 07:08 . 2010-03-19 07:08 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-19 06:54 . 2010-03-19 07:59 -------- d-----w- c:\program files\Microsoft Works
2010-03-19 06:54 . 2010-03-19 06:54 -------- d-----w- c:\program files\MSBuild
2010-03-19 06:50 . 2010-03-19 07:06 -------- d-----w- c:\windows\SHELLNEW
2010-03-19 06:49 . 2010-03-19 06:49 -------- d-----r- C:\MSOCache
2010-03-10 05:43 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 09:21 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-05 10:34 . 2010-03-05 10:34 -------- d-----w- C:\001874-Proces-cedule
2010-02-26 05:41 . 2010-02-26 05:41 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-02-25 14:41 . 2010-02-25 14:42 -------- d-----w- C:\001780-samolepky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 05:41 . 2008-10-24 19:53 95872 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-02-26 05:39 . 2008-10-24 19:45 139192 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-02-25 05:58 . 2008-10-20 07:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-05 09:58 . 2004-08-17 13:49 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 09:57 . 2004-08-17 13:49 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2004-08-17 13:49 17408 ------w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AutorunRemover.exe"="c:\program files\AutorunRemover\AutorunRemover.exe" [2010-03-25 1257472]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-02-26 2140880]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1029-0000-7760-000000000003}\_SC_Acrobat.exe [2008-12-8 295606]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2007-04-27 11:10 18744 ----a-w- c:\windows\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-01-11 18:54 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 14:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)
"20486:UDP"= 20486:UDP:Enfocus Port
"24654:UDP"= 24654:UDP:Enfocus Port

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [26.2.2010 6:41 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24.10.2008 20:53 95872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [26.2.2010 6:41 810120]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [12.5.2009 4:37 14416]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [12.5.2009 4:37 44344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]

2010-03-25 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]

2010-03-25 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést vybrané vazby do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést vybrané vazby do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést výběr do Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést výběr do existujícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Přidat do stávajícího PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: {39BBA4F2-A0A9-48B0-828B-74AE6F4E6862} = 62.129.50.20,85.135.32.100
FF - ProfilePath - c:\documents and settings\prijem 2\Data aplikací\Mozilla\Firefox\Profiles\8jrh4oq4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/firefox?client=firefox-a& ... s:official
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-25 18:45
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="5A2EBD8726D08A8CBA1C45EA4CC2151D703A44979597A5E8AB74F66DA13D0F0DB682F54CDEBBAB348B1746D83744AB7E06CEFD1B44058D4AA5F2F26112628CBED412047E7CE831B1CCE463CB0D1D6CD0047C7F06FA1A3DA9274FF2752B7B70F4318785E5479CE9FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79339DB7CE019D40AA5CFEBC9E127BECC74C2568B769F88CBFFAAB090A421A52EDEB6A8BF04D29D23A2A16D32EEA8A47B25E49692E5038802FA0D184DA87B6FD0C4BD22D3F865E92B8CE39E77FCD741E9520F476979B114F1B320E2576AF5B7FDB7D03AA5D1E90934E21FC9296315B796A064C42F957FDA6149DBA014130C835DB2B291B2B1464878421060C73BCEBFC6905094411754F3C9FF244EE53611287FC1D86D53EC7D2A4DBF08A4E45FBA04FBEBB75384AC9A5C6B6E6AD8B76829FDC264072795E82282346D7551672DDCD1B8968731C488D798146538AB72CB22DA230A6576687EC85C12BC0C6661536970EDFEF763461DA942CAFB40516A7F849C86B08B242EB95DEC1E4BAD206793CF65CC75907062133960BC6AB5A904E3E59C497BC9776EE6F7D69C3F77DFCA28BBC3C3ED0C15EC47B72E5D4FCDB513E50148E6C432BAEA8D07E810A51E51CC424096733A6D54BC0FCEC879892EE4A45DE062313BCA9DC66F352596FBEB973CAE7501E0BCD88213861A240C1F88B2EE8818E0329EF5FB7A7773E409CE0BBDA50205E211C5FB175093C0264746040F5DEB0E0334147AF35A35DD90DB37BC3EAA8F5CF3835163EA541FECDC84C1F2EDD924A863C61CE8F16BF0C141AC6F2BC0259FA17AD93D32ECD21841DCCD3AB0BE5248FD8AA04B98BD81A4E2BC35BD4274499A0F8D0EC1A94D3A107594D0DA51F52E725898F165EBF43035234EC6E4F1495D9BF9074E8911BDDEBA8C3AF6D4CC72B64941C7E7AB45F5F7E2A1A7AED332D20B914CBED23877DD65F6D6C5A5D04F6BC56CBE611075DB079C5CD98D5BDF92CD310BBE918ACE98C6E0EBDBB3A3AD73196AA1D18E285178E234595BFEC34BDE0E165BA0452884EAC973E656B3DD473118D873B2D1635CAE6311E4174311C3DAD4077F7027FAE6BD5096B150CD871A7C239C3C2FA4F4600BABCA2F17099355B0C2837BFA1858B1D13BD42617E034B698876E92EA8B55F66A1A35D30BF1E319E059ACBC075CF006406F5A7C2FA390D51B565BA61B3779B4FC5850A63C23DB9B2B9568D8E62CC5F64E2B431158AF9591DB469A8A06AC308B065C91A5D30F7E666DB640BA0A36E70E4F1BF29198D4944AC83AADC94705026A3D218314E8E55C9ABB38D04D1C5AB71520E248D7437AED6073317B1CB3E556C6773DD28CC3BDD649A1B5F70E32A7F903CAA2F11AD0C350FD167"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\PCANotify.dll

- - - - - - - > 'lsass.exe'(792)
c:\windows\system32\relog_ap.dll
.
Celkový čas: 2010-03-25 18:47:50
ComboFix-quarantined-files.txt 2010-03-25 17:47
ComboFix2.txt 2010-03-25 13:26

Před spuštěním: Volných bajtů: 18 108 489 728
Po spuštění: Volných bajtů: 18 077 409 280

- - End Of File - - 5F972CEA2F85CAAEC209769CECFE212B

[Caroprd111]

Jak to vypadá s PC

[igor.p]

Jak to vypadá s PC

fyzicky budu u něj až zítra, pak se ozvu, každopádně pro nyní velký poděkování. Hezký večer.

[Caroprd111]

OK

[igor.p]

OK

Tak jsem to mohl ověřit až dnes a prozatím to vypadá, že je vše O.K. Díky za podporu a pochopení.