Desktop Security 2010 HELP!

[Lucish]

Zdravím, v počítači mi leze červ, můžete mi, prosím, pomoci? Zde je log z ComboFixu...


ComboFix 10-04-26.02 - Uživatel 26.04.2010 20:38:55.10.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1791.1199 [GMT 2:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-03-26 do 2010-04-26 )))))))))))))))))))))))))))))))
.

2010-04-26 18:30 . 2010-04-26 18:30 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-26 17:35 . 2010-04-26 18:34 -------- d-----w- c:\program files\WinClamAVShield
2010-04-26 17:11 . 2010-04-26 17:11 -------- d-----w- c:\program files\Crawler
2010-04-26 17:11 . 2010-04-26 17:11 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-04-26 17:11 . 2010-04-26 18:37 -------- d-----w- c:\program files\Spyware Terminator
2010-04-26 05:53 . 2010-04-26 05:53 390144 ----a-w- c:\windows\system32\CF19541.exe
2010-04-18 18:28 . 2010-04-18 18:28 -------- d-----w- c:\program files\Common Files\Java
2010-04-18 18:28 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-18 17:42 . 2010-04-18 17:42 -------- d-----w- c:\windows\system32\XPSViewer
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- c:\program files\MSBuild
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- c:\program files\Reference Assemblies
2010-04-18 17:41 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-04-18 17:41 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-04-18 17:41 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-04-18 17:41 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-04-18 17:41 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-04-18 17:41 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-04-18 17:41 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-04-18 17:41 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- C:\00b7c0ac44ab392244
2010-04-16 18:20 . 2010-04-16 18:20 -------- d-----w- c:\program files\ESET
2010-04-14 20:39 . 2010-04-14 20:40 -------- d-----w- c:\program files\PSPad editor
2010-04-01 12:02 . 2010-04-01 12:02 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 19:35 . 2008-12-20 21:48 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-04-25 19:09 . 2008-04-14 12:00 441324 ----a-w- c:\windows\system32\perfh005.dat
2010-04-25 19:09 . 2008-04-14 12:00 83940 ----a-w- c:\windows\system32\perfc005.dat
2010-04-18 18:28 . 2009-01-31 21:15 -------- d-----w- c:\program files\Java
2010-04-16 17:44 . 2010-03-18 21:40 -------- d-----w- c:\program files\Nokia
2010-03-25 16:24 . 2008-12-19 22:19 -------- d-----w- c:\program files\Opera
2010-03-18 21:44 . 2010-03-18 21:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-03-18 21:43 . 2010-03-18 21:43 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2010-03-18 21:42 . 2010-03-18 21:41 -------- d-----w- c:\program files\DIFX
2010-03-18 21:41 . 2010-03-18 21:41 -------- d-----w- c:\program files\PC Connectivity Solution
2010-03-09 11:11 . 2008-04-14 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-02-26 05:43 . 2008-04-14 12:00 668160 ------w- c:\windows\system32\wininet.dll
2010-02-26 05:43 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2008-04-14 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:08 . 2008-04-14 12:00 2148352 ------w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:08 . 2008-04-14 08:06 2026496 ------w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-10 14:36 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:35 . 2008-04-14 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-14 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-04-25_19.10.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-26 18:32 . 2010-04-26 18:32 16384 c:\windows\temp\Perflib_Perfdata_698.dat
+ 2010-04-26 18:30 . 2010-04-26 18:31 6932 c:\windows\system32\Restore\rstrlog.dat
+ 2010-04-26 18:26 . 2010-04-26 18:26 339968 c:\windows\system32\config\systemprofile\ntuser.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="c:\program files\CyberLink\Power2Go\Power2GoExpress.exe" [2008-03-18 2508072]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 2289664]
"SecurityCenter"="c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\securitycenter.exe" [2010-04-22 146432]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-04-26 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-01-15 851968]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2007-11-04 106496]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-11 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2008-07-01 217088]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2008-02-01 61440]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2008-01-23 7766016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-18 13545472]
"nwiz"="nwiz.exe" [2008-12-18 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-18 86016]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2008-12-18 37232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-12 815104]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-04-02 87336]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-14 596584]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 14:24 93336]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [26.4.2010 19:11 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [25.9.2008 6:39 41376]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 16:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search13.net/
uDefault_Search_URL = hxxp://search13.net/
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737}
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3044)
c:\windows\system32\btmmhook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-04-26 20:45:03
ComboFix-quarantined-files.txt 2010-04-26 18:45
ComboFix2.txt 2010-04-26 06:08
ComboFix3.txt 2010-04-25 19:12
ComboFix4.txt 2010-01-12 17:21
ComboFix5.txt 2010-04-26 18:38

Před spuštěním: Volných bajtů: 118 744 076 288
Po spuštění: Volných bajtů: 118 785 425 408

- - End Of File - - F304D9F8E5639B390A45D584311F3147

[Caroprd111]

Zdravím


Nedoporučuji používat ComboFix z vlastní iniciativy, může dojít k poškození systému!


Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SecurityCenter"=-

Folder::
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010

DDS::
uStart Page = hxxp://search13.net/
uDefault_Search_URL = hxxp://search13.net/

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[Lucish]

ComboFix 10-04-26.02 - Uživatel 26.04.2010 20:53:54.11.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1791.1247 [GMT 2:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uživatel\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\mfc71.dll
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\MFC71ENU.DLL
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\msvcp71.dll
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\msvcr71.dll
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\securitycenter.exe
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\securityhelper.exe
c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\taskmgr.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-26 do 2010-04-26 )))))))))))))))))))))))))))))))
.

2010-04-26 18:30 . 2010-04-26 18:30 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-26 17:35 . 2010-04-26 18:34 -------- d-----w- c:\program files\WinClamAVShield
2010-04-26 17:11 . 2010-04-26 17:11 -------- d-----w- c:\program files\Crawler
2010-04-26 17:11 . 2010-04-26 17:11 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-04-26 17:11 . 2010-04-26 18:37 -------- d-----w- c:\program files\Spyware Terminator
2010-04-26 05:53 . 2010-04-26 05:53 390144 ----a-w- c:\windows\system32\CF19541.exe
2010-04-18 18:28 . 2010-04-18 18:28 -------- d-----w- c:\program files\Common Files\Java
2010-04-18 18:28 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-18 17:42 . 2010-04-18 17:42 -------- d-----w- c:\windows\system32\XPSViewer
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- c:\program files\MSBuild
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- c:\program files\Reference Assemblies
2010-04-18 17:41 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-04-18 17:41 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-04-18 17:41 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-04-18 17:41 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-04-18 17:41 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-04-18 17:41 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-04-18 17:41 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-04-18 17:41 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-04-18 17:41 . 2010-04-18 17:41 -------- d-----w- C:\00b7c0ac44ab392244
2010-04-16 18:20 . 2010-04-16 18:20 -------- d-----w- c:\program files\ESET
2010-04-14 20:39 . 2010-04-14 20:40 -------- d-----w- c:\program files\PSPad editor
2010-04-01 12:02 . 2010-04-01 12:02 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 19:35 . 2008-12-20 21:48 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-04-25 19:09 . 2008-04-14 12:00 441324 ----a-w- c:\windows\system32\perfh005.dat
2010-04-25 19:09 . 2008-04-14 12:00 83940 ----a-w- c:\windows\system32\perfc005.dat
2010-04-18 18:28 . 2009-01-31 21:15 -------- d-----w- c:\program files\Java
2010-04-16 17:44 . 2010-03-18 21:40 -------- d-----w- c:\program files\Nokia
2010-03-25 16:24 . 2008-12-19 22:19 -------- d-----w- c:\program files\Opera
2010-03-18 21:44 . 2010-03-18 21:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-03-18 21:43 . 2010-03-18 21:43 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2010-03-18 21:42 . 2010-03-18 21:41 -------- d-----w- c:\program files\DIFX
2010-03-18 21:41 . 2010-03-18 21:41 -------- d-----w- c:\program files\PC Connectivity Solution
2010-03-09 11:11 . 2008-04-14 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-02-26 05:43 . 2008-04-14 12:00 668160 ------w- c:\windows\system32\wininet.dll
2010-02-26 05:43 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2008-04-14 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:08 . 2008-04-14 12:00 2148352 ------w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:08 . 2008-04-14 08:06 2026496 ------w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-10 14:36 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:35 . 2008-04-14 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-14 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="c:\program files\CyberLink\Power2Go\Power2GoExpress.exe" [2008-03-18 2508072]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 2289664]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-04-26 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-01-15 851968]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2007-11-04 106496]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-11 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2008-07-01 217088]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2008-02-01 61440]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2008-01-23 7766016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-18 13545472]
"nwiz"="nwiz.exe" [2008-12-18 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-18 86016]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2008-12-18 37232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-12 815104]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-04-02 87336]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-14 596584]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"=
"c:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"=
"c:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 14:24 93336]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [26.4.2010 19:11 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [25.9.2008 6:39 41376]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 16:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737}
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Desktop Security 2010 - c:\documents and settings\Uživatel\Data aplikací\Desktop Security 2010\securityhelper.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-26 20:58
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3128)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\ACEngSvr.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
.
**************************************************************************
.
Celkový čas: 2010-04-26 21:05:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-26 19:05
ComboFix2.txt 2010-04-26 18:45
ComboFix3.txt 2010-04-26 06:08
ComboFix4.txt 2010-04-25 19:12
ComboFix5.txt 2010-04-26 18:53

Před spuštěním: Volných bajtů: 118 797 570 048
Po spuštění: Volných bajtů: 118 756 929 536

- - End Of File - - E8CA4B955EBE41A33D36E1B9178332C3

[Caroprd111]

Jak to vypadá s PC

[Lucish]

zdá se to OK, v programech už jsem tu mršku taky nenašla:) Díky moc!

[Caroprd111]

Poprosím o log z RSIT.