100% CPU vytížení, log nasnadě

[Zaitsev]

Dobrý den,

100% CPU toť můj problém.

Předem děkuji za vstřícnost

log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Adolfik at 2010-08-06 14:35:34
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 31 GB (23%) free of 131 GB
Total RAM: 1023 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:36:49, on 6.8.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\real\realplayer\RealPlay.exe
C:\Documents and Settings\Adolfik\Plocha\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Adolfik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: (no name) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: updpxe32.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5265427701
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5266880186
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} (DownloadCenter Control) - http://192.168.1.249/cab/DownloadCenter_8200.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{865005C8-6FB1-46D5-B78A-D3319BB361E3}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

--
End of file - 11902 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\AWC Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-790525478-839522115-1003.job
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-790525478-839522115-1003.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{F7A6ADA6-3D06-44FD-BC50-AA49DB618CEC}.job
C:\WINDOWS\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
C:\WINDOWS\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
C:\WINDOWS\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-03-23 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
XML Class

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2007-08-31 1122128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Documents and Settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-05-25 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-03-16 47392]
"RemoteControl"=C:\WINDOWS\system32\rmctrl.exe [2000-10-16 32768]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2007-12-21 1443072]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-03-23 202256]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2007-08-31 1460560]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2009-11-06 323392]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-21 68856]
"Advanced SystemCare 3"=C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe [2010-07-02 2347216]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\Documents and Settings\Adolfik\Nabídka Start\Programy\Po spuštění
updpxe32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\totalcmd\TOTALCMD.EXE"="C:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\v8010\DMMultiView\MultiView.exe"="C:\Program Files\v8010\DMMultiView\MultiView.exe:*:Enabled:MultiView"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"F:\bitdefender\bitdefender_avplus_v10.exe"="F:\bitdefender\bitdefender_avplus_v10.exe:*:Enabled:ipsec"
"F:\spybotsd15.exe"="F:\spybotsd15.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Sony\Station\LaunchPad\LaunchPad.exe"="C:\Program Files\Sony\Station\LaunchPad\LaunchPad.exe:*:Enabled:LaunchPad"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe"="C:\Program Files\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe:*:Enabled:biahh"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-08-06 14:35:37 ----D---- C:\Program Files\trend micro
2010-08-06 14:35:34 ----D---- C:\rsit
2010-08-06 14:22:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\IObit
2010-08-01 11:20:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-07-25 16:53:46 ----D---- C:\Program Files\iPod
2010-07-25 16:47:28 ----D---- C:\Program Files\Bonjour

======List of files/folders modified in the last 1 months======

2010-08-06 14:36:19 ----D---- C:\WINDOWS\Temp
2010-08-06 14:35:37 ----RD---- C:\Program Files
2010-08-06 14:35:01 ----D---- C:\WINDOWS\Prefetch
2010-08-06 14:34:10 ----D---- C:\Documents and Settings\Adolfik\Data aplikací\DNA
2010-08-06 14:24:07 ----D---- C:\Program Files\DNA
2010-08-06 14:22:42 ----D---- C:\WINDOWS
2010-08-06 14:22:33 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-06 13:55:19 ----SD---- C:\WINDOWS\Tasks
2010-08-06 12:47:08 ----D---- C:\WINDOWS\system32\drivers
2010-08-06 12:46:59 ----D---- C:\WINDOWS\system32
2010-08-06 12:13:58 ----A---- C:\WINDOWS\m3jpeg.ini
2010-08-06 11:50:16 ----D---- C:\Documents and Settings\Adolfik\Data aplikací\IObit
2010-08-06 11:49:51 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-06 11:49:40 ----D---- C:\WINDOWS\system32\config
2010-08-06 11:49:39 ----D---- C:\WINDOWS\repair
2010-08-06 11:49:39 ----D---- C:\WINDOWS\Debug
2010-08-06 11:49:38 ----D---- C:\Temp
2010-08-06 11:49:38 ----D---- C:\Program Files\WorldNet
2010-08-06 11:49:38 ----D---- C:\Program Files\K-Lite Codec Pack
2010-08-06 11:49:35 ----D---- C:\Downloads
2010-08-06 11:49:33 ----SHD---- C:\WINDOWS\Installer
2010-08-06 11:49:32 ----D---- C:\Program Files\WinRAR
2010-08-06 11:49:32 ----D---- C:\Program Files\Apple Software Update
2010-08-01 11:37:17 ----D---- C:\Config.Msi
2010-08-01 11:34:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-08-01 11:34:34 ----D---- C:\Program Files\Common Files\Adobe
2010-08-01 11:20:22 ----HD---- C:\WINDOWS\inf
2010-08-01 11:20:16 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-01 11:18:56 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-31 09:44:10 ----D---- C:\Program Files\Adobe
2010-07-25 16:54:56 ----D---- C:\Program Files\iTunes
2010-07-25 16:53:42 ----D---- C:\Program Files\Common Files\Apple
2010-07-25 16:48:14 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-07-25 16:43:34 ----D---- C:\Program Files\Safari
2010-07-20 12:04:45 ----A---- C:\WINDOWS\hpqcopy.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2008-01-04 43528]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2006-03-26 51200]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-03-13 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2005-05-16 19968]
R0 sfsync04;StarForce Protection Synchronization Driver (version 4.x); C:\WINDOWS\System32\drivers\sfsync04.sys [2006-03-24 50176]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-06-20 691696]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2007-03-30 82380]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2005-10-18 11008]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
R1 HWiNFO32;HWiNFO32 Kernel Driver; \??\C:\Program Files\HWiNFO32\HWiNFO32.SYS []
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-18 14848]
R2 acedrv11;acedrv11; \??\C:\WINDOWS\system32\drivers\acedrv11.sys []
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-06-06 279712]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-09-21 25888]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter; C:\WINDOWS\System32\DRIVERS\atl01_xp.sys [2006-07-27 34944]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-08-02 4356608]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 aonk1pvw;aonk1pvw; C:\WINDOWS\system32\drivers\aonk1pvw.sys []
S3 arkoeby4;arkoeby4; C:\WINDOWS\system32\drivers\arkoeby4.sys []
S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
S3 Nokia USB Port;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-05-29 13312]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2006-09-04 241664]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2009-02-08 126976]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-06 135664]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2007-12-21 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-29 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-18 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Hezké odpoledne
ne CPU, ale potvůrky jsou Váš problém .

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

[Zaitsev]

combík hotov ty bylo ale dobrodružství

log:

ComboFix 10-08-05.06 - Adolfik 06.08.2010 16:38:40.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.692 [GMT 2:00]
Spuštěný z: c:\documents and settings\Adolfik\Plocha\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\documents and settings\Adolfik\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
c:\recycled\Recycled
c:\windows\system32\fonts
c:\windows\system32\fonts\a010013l.afm
c:\windows\system32\fonts\a010013l.pfb
c:\windows\system32\fonts\a010013l.pfm
c:\windows\system32\fonts\a010015l.afm
c:\windows\system32\fonts\a010015l.pfb
c:\windows\system32\fonts\a010015l.pfm
c:\windows\system32\fonts\a010033l.afm
c:\windows\system32\fonts\a010033l.pfb
c:\windows\system32\fonts\a010033l.pfm
c:\windows\system32\fonts\a010035l.afm
c:\windows\system32\fonts\a010035l.pfb
c:\windows\system32\fonts\a010035l.pfm
c:\windows\system32\fonts\b018012l.afm
c:\windows\system32\fonts\b018012l.pfb
c:\windows\system32\fonts\b018012l.pfm
c:\windows\system32\fonts\b018015l.afm
c:\windows\system32\fonts\b018015l.pfb
c:\windows\system32\fonts\b018015l.pfm
c:\windows\system32\fonts\b018032l.afm
c:\windows\system32\fonts\b018032l.pfb
c:\windows\system32\fonts\b018032l.pfm
c:\windows\system32\fonts\b018035l.afm
c:\windows\system32\fonts\b018035l.pfb
c:\windows\system32\fonts\b018035l.pfm
c:\windows\system32\fonts\c059013l.afm
c:\windows\system32\fonts\c059013l.pfb
c:\windows\system32\fonts\c059013l.pfm
c:\windows\system32\fonts\c059016l.afm
c:\windows\system32\fonts\c059016l.pfb
c:\windows\system32\fonts\c059016l.pfm
c:\windows\system32\fonts\c059033l.afm
c:\windows\system32\fonts\c059033l.pfb
c:\windows\system32\fonts\c059033l.pfm
c:\windows\system32\fonts\c059036l.afm
c:\windows\system32\fonts\c059036l.pfb
c:\windows\system32\fonts\c059036l.pfm
c:\windows\system32\fonts\d050000l.afm
c:\windows\system32\fonts\d050000l.pfb
c:\windows\system32\fonts\d050000l.pfm
c:\windows\system32\fonts\fonts.dir
c:\windows\system32\fonts\fonts.scale
c:\windows\system32\fonts\n019003l.afm
c:\windows\system32\fonts\n019003l.pfb
c:\windows\system32\fonts\n019003l.pfm
c:\windows\system32\fonts\n019004l.afm
c:\windows\system32\fonts\n019004l.pfb
c:\windows\system32\fonts\n019004l.pfm
c:\windows\system32\fonts\n019023l.afm
c:\windows\system32\fonts\n019023l.pfb
c:\windows\system32\fonts\n019023l.pfm
c:\windows\system32\fonts\n019024l.afm
c:\windows\system32\fonts\n019024l.pfb
c:\windows\system32\fonts\n019024l.pfm
c:\windows\system32\fonts\n019043l.afm
c:\windows\system32\fonts\n019043l.pfb
c:\windows\system32\fonts\n019043l.pfm
c:\windows\system32\fonts\n019044l.afm
c:\windows\system32\fonts\n019044l.pfb
c:\windows\system32\fonts\n019044l.pfm
c:\windows\system32\fonts\n019063l.afm
c:\windows\system32\fonts\n019063l.pfb
c:\windows\system32\fonts\n019063l.pfm
c:\windows\system32\fonts\n019064l.afm
c:\windows\system32\fonts\n019064l.pfb
c:\windows\system32\fonts\n019064l.pfm
c:\windows\system32\fonts\n021003l.afm
c:\windows\system32\fonts\n021003l.pfb
c:\windows\system32\fonts\n021003l.pfm
c:\windows\system32\fonts\n021004l.afm
c:\windows\system32\fonts\n021004l.pfb
c:\windows\system32\fonts\n021004l.pfm
c:\windows\system32\fonts\n021023l.afm
c:\windows\system32\fonts\n021023l.pfb
c:\windows\system32\fonts\n021023l.pfm
c:\windows\system32\fonts\n021024l.afm
c:\windows\system32\fonts\n021024l.pfb
c:\windows\system32\fonts\n021024l.pfm
c:\windows\system32\fonts\n022003l.afm
c:\windows\system32\fonts\n022003l.pfb
c:\windows\system32\fonts\n022003l.pfm
c:\windows\system32\fonts\n022004l.afm
c:\windows\system32\fonts\n022004l.pfb
c:\windows\system32\fonts\n022004l.pfm
c:\windows\system32\fonts\n022023l.afm
c:\windows\system32\fonts\n022023l.pfb
c:\windows\system32\fonts\n022023l.pfm
c:\windows\system32\fonts\n022024l.afm
c:\windows\system32\fonts\n022024l.pfb
c:\windows\system32\fonts\n022024l.pfm
c:\windows\system32\fonts\p052003l.afm
c:\windows\system32\fonts\p052003l.pfb
c:\windows\system32\fonts\p052003l.pfm
c:\windows\system32\fonts\p052004l.afm
c:\windows\system32\fonts\p052004l.pfb
c:\windows\system32\fonts\p052004l.pfm
c:\windows\system32\fonts\p052023l.afm
c:\windows\system32\fonts\p052023l.pfb
c:\windows\system32\fonts\p052023l.pfm
c:\windows\system32\fonts\p052024l.afm
c:\windows\system32\fonts\p052024l.pfb
c:\windows\system32\fonts\p052024l.pfm
c:\windows\system32\fonts\s050000l.afm
c:\windows\system32\fonts\s050000l.pfb
c:\windows\system32\fonts\s050000l.pfm
c:\windows\system32\fonts\uninstal.txt
c:\windows\system32\fonts\z003034l.afm
c:\windows\system32\fonts\z003034l.pfb
c:\windows\system32\fonts\z003034l.pfm
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NDISFILESERVICES32


((((((((((((((((((((((((( Soubory vytvořené od 2010-07-06 do 2010-08-06 )))))))))))))))))))))))))))))))
.

2010-08-06 12:35 . 2010-08-06 12:36 -------- d-----w- c:\program files\trend micro
2010-08-06 12:35 . 2010-08-06 12:37 -------- d-----w- C:\rsit
2010-08-01 09:13 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-25 14:53 . 2010-07-25 14:53 -------- d-----w- c:\program files\iPod
2010-07-25 14:47 . 2010-07-25 14:47 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-06 14:44 . 2009-02-22 20:55 -------- d-----w- c:\program files\DNA
2010-08-06 09:49 . 2009-04-21 14:35 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-08-06 09:49 . 2008-04-09 16:23 -------- d-----w- c:\program files\WorldNet
2010-08-06 09:49 . 2007-04-20 07:31 -------- d-----w- c:\program files\Apple Software Update
2010-08-01 09:34 . 2007-05-14 19:55 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-25 14:54 . 2008-11-10 12:18 -------- d-----w- c:\program files\iTunes
2010-07-25 14:53 . 2007-07-03 08:08 -------- d-----w- c:\program files\Common Files\Apple
2010-07-25 14:43 . 2008-03-19 08:30 -------- d-----w- c:\program files\Safari
2010-06-25 18:30 . 2001-10-25 12:00 84078 ----a-w- c:\windows\system32\perfc005.dat
2010-06-25 18:30 . 2001-10-25 12:00 441422 ----a-w- c:\windows\system32\perfh005.dat
2010-06-21 17:39 . 2007-03-30 14:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-21 17:19 . 2010-06-21 17:19 -------- d-----w- c:\program files\Ubi Soft
2010-06-20 06:33 . 2010-06-20 06:33 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-20 06:33 . 2010-06-06 13:00 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-06-20 06:33 . 2007-04-07 06:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-18 14:40 . 2008-09-07 11:01 51764 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-14 14:30 . 2007-03-30 14:06 743936 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-06 13:31 . 2008-09-21 16:58 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-06 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-21 68856]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-07-02 2347216]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2000-10-16 32768]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\Adolfik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
updpxe32.exe [2004-8-18 32768]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"RTHDCPL"=RTHDCPL.EXE
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\v8010\\DMMultiView\\MultiView.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22146:TCP"= 22146:TCP:BitComet 22146 TCP
"22146:UDP"= 22146:UDP:BitComet 22146 UDP

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [11.4.2010 18:20 19320]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\ACEDRV11.sys [23.1.2008 10:19 501560]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [30.3.2007 16:14 34944]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.12.2009 17:55 135664]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.4.2007 8:38 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-08-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-08-06 c:\windows\Tasks\AWC Update.job
- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2010-05-07 14:18]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-05 c:\windows\Tasks\User_Feed_Synchronization-{F7A6ADA6-3D06-44FD-BC50-AA49DB618CEC}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: {865005C8-6FB1-46D5-B78A-D3319BB361E3} = 192.168.1.1
DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} - hxxp://192.168.1.249/cab/DownloadCenter_8200.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-06 16:44
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\documents and settings\Adolfik\Nabídka Start\Programy\Po spuštění\updpxe32.exe 32768 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ee,a2,7c,b8,d0,c3,88,b9,ff,30,f2,43,29,21,cb,95,74,77,28,5f,16,4c,6c,
ec,9c,25,44,80,db,54,82,7b,6f,56,4d,1e,dc,1f,46,e8,77,99,e6,05,6e,2e,13,ed,\
"??"=hex:3a,46,89,ff,8f,f6,a7,52,cc,e2,41,ab,8a,8a,e6,2d

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:1d,a0,de,74,ad,4f,82,93,ca,69,5d,f4,bf,b7,80,63,06,65,4d,38,18,
e3,73,b9,dd,4f,5b,04,b2,1d,56,22,08,d5,a6,41,3e,38,09,95,5c,8f,55,2d,b1,2b,\
"rkeysecu"=hex:da,5f,36,6f,b9,70,3a,fa,8f,c3,fe,b8,7a,d1,a5,8b
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2572)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-08-06 16:57:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-06 14:57

Před spuštěním: Volných bajtů: 31 988 670 464
Po spuštění: Volných bajtů: 32 102 445 056

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /usepmtimer /NoExecute=OptIn

- - End Of File - - CCF51FFA6190B9FA5D7A5D071B674CCB

[motji]

Lepší než akční film v televizi,že?

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Collect::
c:\documents and settings\Adolfik\Nabídka Start\Programy\Po spuštění\updpxe32.exe 

DDS::
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip

Folder::
c:\program files\DAEMON Tools Toolbar

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



Zapojte do pc všechny usb klíče, flashky...co používáte

Použijte USB fix
http://www.viry.cz/forum/viewtopic.php?f=24&t=102308


Před stažením vypněte rezidentní štít antiviru, má na Usbfix falešnou detekci
-spusťte
-klikněte na volbu deletion , potvrdte enter
- po skenu sem vložte log , pokud na Vás nevyskočí, najdete ho C:\UsbFix.txt

[Zaitsev]

U akčních filmů totiž dopředu tušívávám jak skončí - tady ne spíš je to taková reality show ale pardon, k věci:

log:

ComboFix 10-08-06.01 - Adolfik 06.08.2010 22:32:35.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.621 [GMT 2:00]
Spuštěný z: c:\documents and settings\Adolfik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Adolfik\Plocha\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

file zipped: c:\documents and settings\Adolfik\Nabídka Start\Programy\Po spuštění\updpxe32.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Adolfik\Nabídka Start\Programy\Po spuštění\updpxe32.exe
c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\_DTLite.xml
c:\program files\DAEMON Tools Toolbar\DTToolbar.dll
c:\program files\DAEMON Tools Toolbar\Resources\about.ico
c:\program files\DAEMON Tools Toolbar\Resources\AboutWindow.ico
c:\program files\DAEMON Tools Toolbar\Resources\accept.ico
c:\program files\DAEMON Tools Toolbar\Resources\AddRadioStation.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.png
c:\program files\DAEMON Tools Toolbar\Resources\astro.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_buy.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_download.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_feedback.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_forum.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_home.ico
c:\program files\DAEMON Tools Toolbar\Resources\astro_lite.ico
c:\program files\DAEMON Tools Toolbar\Resources\astroburn_site.ico
c:\program files\DAEMON Tools Toolbar\Resources\astroLite_16.ico
c:\program files\DAEMON Tools Toolbar\Resources\az.ico
c:\program files\DAEMON Tools Toolbar\Resources\b1.png
c:\program files\DAEMON Tools Toolbar\Resources\burn_files.ico
c:\program files\DAEMON Tools Toolbar\Resources\burn_image.ico
c:\program files\DAEMON Tools Toolbar\Resources\burn_imgs.ico
c:\program files\DAEMON Tools Toolbar\Resources\BurnImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\buy.ico
c:\program files\DAEMON Tools Toolbar\Resources\Config.ico
c:\program files\DAEMON Tools Toolbar\Resources\d.ico
c:\program files\DAEMON Tools Toolbar\Resources\d2.ico
c:\program files\DAEMON Tools Toolbar\Resources\daemon.ico
c:\program files\DAEMON Tools Toolbar\Resources\daemon_search.ico
c:\program files\DAEMON Tools Toolbar\Resources\daemon_search_site.ico
c:\program files\DAEMON Tools Toolbar\Resources\dot_disabled.bmp
c:\program files\DAEMON Tools Toolbar\Resources\dot_enabled.bmp
c:\program files\DAEMON Tools Toolbar\Resources\dot_on_over.bmp
c:\program files\DAEMON Tools Toolbar\Resources\download.ico
c:\program files\DAEMON Tools Toolbar\Resources\ds.ico
c:\program files\DAEMON Tools Toolbar\Resources\dsearch.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt-home.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_about.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_buy.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_download.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_faq.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_feedback.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_forum.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_line.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_lite.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_manual.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt_pro.ico
c:\program files\DAEMON Tools Toolbar\Resources\DTPro.ico
c:\program files\DAEMON Tools Toolbar\Resources\dtt16.ico
c:\program files\DAEMON Tools Toolbar\Resources\dtt32.ico
c:\program files\DAEMON Tools Toolbar\Resources\Dwnl.ico
c:\program files\DAEMON Tools Toolbar\Resources\emulation.ico
c:\program files\DAEMON Tools Toolbar\Resources\faq.ico
c:\program files\DAEMON Tools Toolbar\Resources\favicon.ico
c:\program files\DAEMON Tools Toolbar\Resources\features.ico
c:\program files\DAEMON Tools Toolbar\Resources\feedback.ico
c:\program files\DAEMON Tools Toolbar\Resources\forum.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameCentrix.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixCristals.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixDownload.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixPlayOnline.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixTop.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameS.ico
c:\program files\DAEMON Tools Toolbar\Resources\games_search.ico
c:\program files\DAEMON Tools Toolbar\Resources\games_search_SA.ico
c:\program files\DAEMON Tools Toolbar\Resources\GameSA.ico
c:\program files\DAEMON Tools Toolbar\Resources\gct16.ico
c:\program files\DAEMON Tools Toolbar\Resources\gd.ico
c:\program files\DAEMON Tools Toolbar\Resources\genre.xml
c:\program files\DAEMON Tools Toolbar\Resources\globe.ico
c:\program files\DAEMON Tools Toolbar\Resources\GrabImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\hb.bmp
c:\program files\DAEMON Tools Toolbar\Resources\hb.ico
c:\program files\DAEMON Tools Toolbar\Resources\help.ico
c:\program files\DAEMON Tools Toolbar\Resources\hide.ico
c:\program files\DAEMON Tools Toolbar\Resources\home.ico
c:\program files\DAEMON Tools Toolbar\Resources\image_search.ico
c:\program files\DAEMON Tools Toolbar\Resources\image_search_SA.ico
c:\program files\DAEMON Tools Toolbar\Resources\ImageS.ico
c:\program files\DAEMON Tools Toolbar\Resources\ImageSA.ico
c:\program files\DAEMON Tools Toolbar\Resources\ip.ico
c:\program files\DAEMON Tools Toolbar\Resources\lang.xml
c:\program files\DAEMON Tools Toolbar\Resources\lingvo.ico
c:\program files\DAEMON Tools Toolbar\Resources\m.ico
c:\program files\DAEMON Tools Toolbar\Resources\mail.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\manual.ico
c:\program files\DAEMON Tools Toolbar\Resources\map.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuRSCur.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuTr.ico
c:\program files\DAEMON Tools Toolbar\Resources\mount.ico
c:\program files\DAEMON Tools Toolbar\Resources\mount_n_drive.ico
c:\program files\DAEMON Tools Toolbar\Resources\next.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\op.ico
c:\program files\DAEMON Tools Toolbar\Resources\play.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play.ico
c:\program files\DAEMON Tools Toolbar\Resources\play_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\pragma.ico
c:\program files\DAEMON Tools Toolbar\Resources\prev.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prod.ico
c:\program files\DAEMON Tools Toolbar\Resources\Radio.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioE.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioG.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioL.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioLDotMask.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioLeft.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioLeftMask.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioLM.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioM.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioN.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioR.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioR.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioRM.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioRU.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioW.bmp
c:\program files\DAEMON Tools Toolbar\Resources\rbcheck.ico
c:\program files\DAEMON Tools Toolbar\Resources\rbtxt.ico
c:\program files\DAEMON Tools Toolbar\Resources\refresh.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Rss.ico
c:\program files\DAEMON Tools Toolbar\Resources\Rss1.ico
c:\program files\DAEMON Tools Toolbar\Resources\RssA.ico
c:\program files\DAEMON Tools Toolbar\Resources\RssA1.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssClose.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssL.bmp
c:\program files\DAEMON Tools Toolbar\Resources\rssOpen.ico
c:\program files\DAEMON Tools Toolbar\Resources\RssRefresh.ico
c:\program files\DAEMON Tools Toolbar\Resources\s2.ico
c:\program files\DAEMON Tools Toolbar\Resources\show.ico
c:\program files\DAEMON Tools Toolbar\Resources\size.bmp
c:\program files\DAEMON Tools Toolbar\Resources\size_lr.ico
c:\program files\DAEMON Tools Toolbar\Resources\size_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\size_rl.ico
c:\program files\DAEMON Tools Toolbar\Resources\skins.ico
c:\program files\DAEMON Tools Toolbar\Resources\soft24.ico
c:\program files\DAEMON Tools Toolbar\Resources\soft24_SA.ico
c:\program files\DAEMON Tools Toolbar\Resources\spt.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\style.ico
c:\program files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
c:\program files\DAEMON Tools Toolbar\Resources\timer.ico
c:\program files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
c:\program files\DAEMON Tools Toolbar\Resources\toolbar.xml
c:\program files\DAEMON Tools Toolbar\Resources\trans.ico
c:\program files\DAEMON Tools Toolbar\Resources\Trash.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\u.ico
c:\program files\DAEMON Tools Toolbar\Resources\unmount-all.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol_back.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_mute.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_mute_check.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\web_resources.ico
c:\program files\DAEMON Tools Toolbar\Resources\web_search.ico
c:\program files\DAEMON Tools Toolbar\Resources\web_search_SA.ico
c:\program files\DAEMON Tools Toolbar\Resources\WebS.ico
c:\program files\DAEMON Tools Toolbar\Resources\WebSa.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi0.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi1.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi10.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi11.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi12.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi13.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi14.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi2.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi3.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi4.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi5.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi6.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi7.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi8.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi9.ico
c:\program files\DAEMON Tools Toolbar\uninst.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-06 do 2010-08-06 )))))))))))))))))))))))))))))))
.

2010-08-06 12:35 . 2010-08-06 12:36 -------- d-----w- c:\program files\trend micro
2010-08-06 12:35 . 2010-08-06 12:37 -------- d-----w- C:\rsit
2010-08-01 09:13 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-25 14:53 . 2010-07-25 14:53 -------- d-----w- c:\program files\iPod
2010-07-25 14:47 . 2010-07-25 14:47 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-06 21:05 . 2009-02-22 20:55 -------- d-----w- c:\program files\DNA
2010-08-06 09:49 . 2009-04-21 14:35 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-08-06 09:49 . 2008-04-09 16:23 -------- d-----w- c:\program files\WorldNet
2010-08-06 09:49 . 2007-04-20 07:31 -------- d-----w- c:\program files\Apple Software Update
2010-08-01 09:34 . 2007-05-14 19:55 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-25 14:54 . 2008-11-10 12:18 -------- d-----w- c:\program files\iTunes
2010-07-25 14:53 . 2007-07-03 08:08 -------- d-----w- c:\program files\Common Files\Apple
2010-07-25 14:43 . 2008-03-19 08:30 -------- d-----w- c:\program files\Safari
2010-06-25 18:30 . 2001-10-25 12:00 84078 ----a-w- c:\windows\system32\perfc005.dat
2010-06-25 18:30 . 2001-10-25 12:00 441422 ----a-w- c:\windows\system32\perfh005.dat
2010-06-21 17:39 . 2007-03-30 14:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-21 17:19 . 2010-06-21 17:19 -------- d-----w- c:\program files\Ubi Soft
2010-06-20 06:33 . 2010-06-20 06:33 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-20 06:33 . 2007-04-07 06:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-18 14:40 . 2008-09-07 11:01 51764 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-14 14:30 . 2007-03-30 14:06 743936 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-06 13:31 . 2008-09-21 16:58 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-06 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-21 68856]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-07-02 2347216]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10e.exe" [2010-01-27 256280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2000-10-16 32768]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"RTHDCPL"=RTHDCPL.EXE
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\v8010\\DMMultiView\\MultiView.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22146:TCP"= 22146:TCP:BitComet 22146 TCP
"22146:UDP"= 22146:UDP:BitComet 22146 UDP

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [11.4.2010 18:20 19320]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\ACEDRV11.sys [23.1.2008 10:19 501560]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [30.3.2007 16:14 34944]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.12.2009 17:55 135664]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.4.2007 8:38 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-08-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-06 c:\windows\Tasks\User_Feed_Synchronization-{F7A6ADA6-3D06-44FD-BC50-AA49DB618CEC}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearch Page = hxxp://search.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearch Bar = hxxp://search.qip.ru/ie
uDefault_Page_URL = hxxp://search.qip.ru
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: {865005C8-6FB1-46D5-B78A-D3319BB361E3} = 192.168.1.1
DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} - hxxp://192.168.1.249/cab/DownloadCenter_8200.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
BHO-{500BCA15-57A7-4eaf-8143-8C619470B13D} - (no file)
BHO-{95289393-33EA-4F8D-B952-483415B9C955} - (no file)
BHO-{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-06 23:05
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ee,a2,7c,b8,d0,c3,88,b9,ff,30,f2,43,29,21,cb,95,74,77,28,5f,16,4c,6c,
ec,9c,25,44,80,db,54,82,7b,6f,56,4d,1e,dc,1f,46,e8,77,99,e6,05,6e,2e,13,ed,\
"??"=hex:3a,46,89,ff,8f,f6,a7,52,cc,e2,41,ab,8a,8a,e6,2d

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:1d,a0,de,74,ad,4f,82,93,ca,69,5d,f4,bf,b7,80,63,06,65,4d,38,18,
e3,73,b9,dd,4f,5b,04,b2,1d,56,22,08,d5,a6,41,3e,38,09,95,5c,8f,55,2d,b1,2b,\
"rkeysecu"=hex:da,5f,36,6f,b9,70,3a,fa,8f,c3,fe,b8,7a,d1,a5,8b
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3064)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Celkový čas: 2010-08-06 23:11:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-06 21:11
ComboFix2.txt 2010-08-06 14:57

Před spuštěním: Volných bajtů: 31 391 158 272
Po spuštění: Volných bajtů: 31 379 181 568

- - End Of File - - D9416C7E57093E6479CE4AE99D5CC1F4

[motji]

Ještě poprosím o ten log z USBfixu, a napište, jak to vypadá s počítačem

[Zaitsev]

Počítač zrychlil a zdá se mi na první "omak" v pořádku - nicméně pořád na mě vyjíždí startovací deamon tools, který (pochopil-li jsem dobře) nebyl uplně v pořádku...

usbfix log:

############################## | UsbFix 7.019 | [Deletion]

User: Adolfik (Administrator) # DOLFIK [ ]
Updated 03/08/10 by El Desaparecido / C_XX
Started at 23:20:30 | 06/08/2010
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: AMD Athlon(tm) 64 Processor 3500+
Systém Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18702

Windows Firewall: Enabled
Antivirus: BitDefender Antivirus 12.0 [(!) Disabled | Updated]
Antivirus: ESET NOD32 Antivirus 3.0 3.0 [Enabled | Updated]
Firewall: BitDefender Firewall 12.0 [(!) Disabled]
RAM -> 1023 Mb
C:\ (%systemdrive%) -> Fixed drive # 128 Gb (29 Mb free - 23%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Removable drive # 1000 Mb (697 Mb free - 70%) [] # FAT
F:\ -> Fixed drive # 149 Gb (99 Mb free - 67%) [WD Passport] # FAT32
G:\ -> Removable drive # 8 Gb (7 Mb free - 88%) [CORSAIR] # FAT32
K:\ -> Removable drive # 2 Gb (2 Mb free - 84%) [] # FAT

################## | Files # Infected Folders |

Not deleted ! K:\Autorun.inf
Deleted ! C:\khw
Deleted ! C:\khx
Deleted ! E:\delpijero
Deleted ! E:\KLIZAVI
Deleted ! G:\KLIZAVI
Deleted ! K:\KLIZAVI

################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoResolveSearch

################## | Mountpoints2 |


################## | Listing |

[06/08/2009 - 08:34:37 | D ] C:\33aa305ec62b6af26fc2f724
[06/08/2009 - 08:31:25 | D ] C:\9d9bc804f9b145ebaea35334946e
[01/02/2010 - 21:32:44 | A | 0] C:\Ahoj prosim te jsem nove pripojeny -) jak to tady funguje,dajidek.txt
[10/09/2008 - 10:23:12 | A | 0] C:\AILog.txt
[07/01/2010 - 13:40:07 | A | 2321] C:\aoedoppl.txt
[07/01/2010 - 13:40:33 | A | 3718] C:\aoeWVlog.txt
[30/03/2007 - 16:07:58 | A | 0] C:\AUTOEXEC.BAT
[30/03/2007 - 17:27:57 | A | 235] C:\Boot.bak
[06/08/2010 - 16:36:59 | RASH | 293] C:\boot.ini
[25/10/2001 - 14:00:00 | RASH | 4952] C:\Bootfont.bin
[06/08/2010 - 16:36:59 | RASHD ] C:\cmdcons
[03/08/2004 - 23:00:04 | A | 261312] C:\cmldr
[06/08/2010 - 23:11:28 | A | 26497] C:\ComboFix.txt
[01/08/2010 - 11:37:17 | D ] C:\Config.Msi
[30/03/2007 - 16:07:58 | A | 0] C:\CONFIG.SYS
[08/08/2009 - 00:18:14 | D ] C:\d89a40a1ae68f03684
[30/03/2007 - 16:12:08 | D ] C:\Documents and Settings
[06/08/2010 - 11:49:35 | D ] C:\Downloads
[14/06/2008 - 01:19:59 | D ] C:\found.000
[08/02/2009 - 23:03:14 | A | 93] C:\gputest.txt
[19/02/2009 - 18:32:14 | AH | 696] C:\hpothb07.dat
[19/02/2009 - 18:31:42 | AH | 1775] C:\hpothb07.tif
[01/07/2009 - 17:43:32 | A | 132] C:\httpdwl.dat
[30/03/2007 - 16:07:58 | RASH | 0] C:\IO.SYS
[30/03/2007 - 16:07:58 | RASH | 0] C:\MSDOS.SYS
[30/03/2007 - 17:25:31 | RASH | 47564] C:\NTDETECT.COM
[30/03/2007 - 17:25:31 | RASH | 250048] C:\ntldr
[12/06/2008 - 00:53:15 | D ] C:\NVIDIA
[06/08/2010 - 22:59:41 | ASH | 1610612736] C:\pagefile.sys
[06/08/2010 - 22:57:18 | RD ] C:\Program Files
[06/08/2010 - 23:11:31 | D ] C:\Qoobox
[06/08/2010 - 23:22:07 | SHD ] C:\RECYCLER
[06/08/2010 - 14:37:16 | D ] C:\rsit
[30/03/2007 - 17:31:49 | SHD ] C:\System Volume Information
[29/09/2009 - 17:44:12 | A | 12288] C:\t18o
[28/09/2009 - 14:00:10 | A | 24576] C:\t1to.g
[29/09/2009 - 17:30:20 | A | 16384] C:\t38c.3
[29/09/2009 - 17:53:56 | A | 12288] C:\t3jk
[29/09/2009 - 17:20:39 | A | 16384] C:\t3t4
[06/08/2010 - 11:49:38 | D ] C:\Temp
[08/02/2010 - 17:05:49 | D ] C:\TERASOFT
[17/06/2010 - 22:01:23 | H | 1652] C:\treeinfo.wc
[08/02/2010 - 17:04:56 | D ] C:\TS_ZEMEP
[06/08/2010 - 23:22:09 | D ] C:\UsbFix
[06/08/2010 - 23:22:12 | A | 1606] C:\UsbFix.txt
[06/08/2010 - 23:11:30 | D ] C:\WINDOWS
[14/06/2010 - 11:16:10 | A | 1388] E:\BOOTEX.LOG
[10/04/2010 - 11:48:14 | A | 4413] E:\Dotazník.txt
[29/05/2009 - 12:28:28 | RSHD ] E:\RECYCLER
[30/03/2010 - 23:13:36 | A | 193738] E:\pamet-1.txt
[30/12/2009 - 17:20:38 | A | 29696] E:\GAČR.doc
[21/04/2008 - 10:05:22 | D ] E:\Firmy
[10/01/2010 - 17:12:10 | A | 26112] E:\Zápis - redakční rada.doc
[27/01/2010 - 11:16:48 | A | 116736] E:\Prohlášení KÚ za 08.doc
[09/06/2010 - 21:39:16 | A | 681984] E:\Etická a prosociální výchova.ppt
[11/03/2010 - 12:51:26 | A | 443163] E:\042010-vyhlaseni_grantove_souteze.pdf
[30/03/2010 - 23:38:12 | A | 184320] E:\Jak učit žáky učit se.ppt
[14/05/2010 - 22:54:08 | A | 27648] E:\Akreditace lektor[2].doc
[17/01/2010 - 17:55:06 | A | 23552] E:\Pedagogická encyklopedie.doc
[10/11/2009 - 08:58:36 | RSHD ] E:\Recycled
[05/05/2010 - 08:57:24 | A | 39424] E:\EtV strukt seznam - akredit vyuč 5-10.doc
[31/03/2008 - 00:37:00 | D ] E:\Diplomky
[17/06/2010 - 10:15:12 | A | 40448] E:\Výkaz poradce formulář.doc
[14/04/2010 - 22:14:42 | A | 23552] E:\Dohoda o provedení práce- tiskopis.[1].doc
[05/05/2010 - 08:59:48 | A | 39424] E:\EtV strukt seznam -Maněnová.doc
[17/06/2010 - 11:52:30 | A | 220438] E:\kybersikana_press.txt
[28/05/2010 - 11:50:28 | A | 49152] E:\Haškovec.doc
[18/05/2010 - 14:34:44 | A | 12883] E:\Empirie úvod (3).docx
[14/06/2010 - 11:30:58 | A | 1104] E:\RE aktualizovaný publikační plán.txt
[17/06/2010 - 12:49:02 | A | 116736] E:\zpráva _supervizor.doc
[29/03/2010 - 11:02:06 | A | 12374] E:\Pedagogická fakulta Univerzita Hradec Králové.docx
[17/06/2010 - 12:42:24 | A | 116736] E:\zpráva _průb.kurzy.doc
[29/07/2010 - 12:08:46 | A | 96101] E:\DP V. Krčmárová.pdf
[26/05/2010 - 21:34:40 | A | 84480] E:\Podpora žáka.ppt
[18/04/2010 - 12:21:42 | A | 82944] E:\Vzorový formulář posudku (opravená verze)[1].doc
[18/04/2010 - 12:18:02 | A | 62464] E:\Clanek_k_recenzi_Novotny_Vacek[1].doc
[22/02/2010 - 11:17:58 | A | 161280] E:\Studie_MaresSmolik_PolitickyExtremismus_NechatPosoudit[1].doc
[30/05/2010 - 16:21:22 | A | 26624] E:\Empirie - editorial.doc
[19/04/2010 - 15:38:16 | A | 59392] E:\Dohoda 2007 - DPP VVZ.doc
[22/04/2010 - 16:51:36 | A | 15925] E:\Okruh témat pro závěrečné zkoušky.docx
[22/04/2010 - 16:52:16 | A | 31744] E:\Okruh témat pro závěrečné zkoušky.doc
[22/03/2009 - 15:36:54 | D ] E:\Pavel
[14/11/2009 - 18:13:48 | SHD ] F:\FOUND.000
[18/01/2008 - 10:57:24 | SHD ] F:\System Volume Information
[18/01/2008 - 11:02:22 | D ] F:\WD Passport
[18/01/2008 - 11:04:06 | D ] F:\Filmy
[23/01/2008 - 21:57:06 | SHD ] F:\Recycled
[02/04/2008 - 23:21:34 | D ] F:\Seriály
[02/04/2008 - 23:24:36 | D ] F:\Hudba
[03/06/2008 - 18:56:56 | D ] F:\záloha nokia k 3.6.2008
[03/06/2008 - 18:58:04 | D ] F:\záloha k my files k 8.1. 2009
[25/06/2008 - 18:17:26 | SHD ] F:\$RECYCLE.BIN
[05/05/2008 - 09:49:30 | A | 163143] F:\granty.pdf
[30/03/2007 - 20:14:16 | A | 718] F:\WinRAR.lnk
[22/11/2008 - 15:08:24 | RD ] F:\Obrázky
[26/12/2008 - 14:20:54 | A | 2897821] F:\bsplayer137.826.exe
[22/11/2008 - 15:27:18 | A | 10463304] F:\bsplayer233.977_clip.exe
[26/12/2008 - 14:20:22 | A | 10050902] F:\Codecs6030_allin1.exe
[07/04/2007 - 07:41:16 | A | 744] F:\DAEMON Tools.lnk
[17/12/2008 - 09:47:06 | A | 1328202] F:\1600x1200_1.jpg
[29/04/2009 - 09:21:52 | A | 83968] F:\legislativa.doc
[12/06/2009 - 20:03:30 | RSHD ] F:\RECYCLER
[23/06/2009 - 00:57:18 | A | 1022976] F:\Diplomova prace jenda.doc
[22/06/2009 - 23:01:38 | A | 1017856] F:\Kopie - Diplomova prace jenda.doc
[23/06/2009 - 16:19:02 | A | 24064] F:\Nový objekt - Dokument aplikace Microsoft Word.doc
[31/07/2009 - 20:24:12 | D ] F:\ESET NOD32 Antivirus 3.0
[18/08/2009 - 23:40:44 | D ] F:\Diplomky
[05/11/2009 - 10:11:22 | D ] F:\Habilitation
[06/08/2010 - 15:14:06 | D ] F:\My files
[06/08/2010 - 15:21:18 | D ] F:\SVP Pyramida
[06/08/2010 - 15:21:50 | D ] F:\Mladost
[06/08/2010 - 15:53:54 | D ] F:\Etopedie
[25/06/2010 - 11:03:12 | D ] G:\Alligator (2005)
[25/06/2010 - 11:04:36 | D ] G:\Boxer (2007)
[25/06/2010 - 11:07:02 | D ] G:\Druide [2004]
[09/05/2010 - 23:13:12 | RSHD ] G:\RECYCLER
[11/05/2010 - 11:43:34 | A | 2594816] G:\Habilitace IV..doc
[14/05/2010 - 13:59:46 | A | 1272389] G:\Habilitace.pdf
[14/05/2010 - 13:58:08 | A | 696612] G:\Habilitace.docx
[17/05/2010 - 09:50:36 | D ] G:\MGKK Telepathy (2009)
[21/05/2010 - 15:21:54 | D ] G:\Horúce Časy (2010)
[21/05/2010 - 15:29:56 | D ] G:\Interpol
[25/05/2010 - 09:14:22 | D ] G:\květen
[25/05/2010 - 22:21:22 | D ] G:\DP
[26/05/2010 - 00:24:52 | A | 4224000] G:\pica.doc
[25/05/2010 - 22:04:04 | A | 4217344] G:\Kopie - pica.doc
[26/05/2010 - 11:40:34 | A | 4225024] G:\Didaktický projekt.doc
[02/06/2010 - 10:59:56 | D ] G:\Dive In Your Life (2007)
[08/06/2010 - 19:51:54 | D ] G:\Elbow
[08/06/2010 - 19:52:32 | D ] G:\Please the trees - Lyon prayer
[08/06/2010 - 19:52:46 | D ] G:\Broken Bells - Broken Bells (2010)
[08/06/2010 - 19:52:58 | D ] G:\Okkervil River - The Stage Names
[13/06/2010 - 19:18:12 | D ] G:\Jet - Get Born
[04/01/2005 - 18:21:08 | A | 459698] K:\UserGuide_for3_En.pdf
[19/10/2008 - 21:31:20 | A | 582331] K:\Workholik, Nešpor.pdf
[02/10/2008 - 13:07:52 | D ] K:\Vyhoření
[25/03/2009 - 21:02:18 | D ] K:\Etika
[25/03/2009 - 20:58:32 | D ] K:\KEV
[25/03/2009 - 21:04:40 | D ] K:\Ps.morálky
[22/03/2009 - 15:07:56 | D ] K:\CAPV
[25/05/2010 - 22:29:22 | D ] K:\zaloha
[28/07/2010 - 16:24:00 | N | 622] K:\autorun.inf
[25/03/2009 - 21:21:28 | D ] K:\Michalík
[15/09/2009 - 15:30:52 | A | 31232] K:\Vyjasňování hodnot.doc
[25/03/2009 - 21:07:04 | D ] K:\Personálie
[06/06/2009 - 11:43:52 | RSHD ] K:\RECYCLER
[25/12/2008 - 17:26:08 | A | 130739] K:\Myslet jako auto.pdf
[20/04/2008 - 17:18:36 | D ] K:\Etická dimenze
[02/10/2008 - 13:05:26 | A | 138240] K:\Pojetí zdraví a kvality života2.doc
[25/03/2009 - 21:08:58 | D ] K:\Prevence
[27/04/2009 - 11:09:52 | A | 36352] K:\Dotazník - tahák.doc
[23/06/2009 - 12:14:16 | D ] K:\DP
[22/03/2009 - 15:10:24 | D ] K:\Školní podvody
[30/09/2009 - 18:03:54 | D ] K:\Trnava
[21/05/2008 - 00:11:30 | D ] K:\Olomouc,2008, konference
[20/05/2009 - 00:18:20 | D ] K:\sylaby_new
[04/06/2008 - 15:51:00 | D ] K:\OMT
[23/03/2009 - 22:25:00 | D ] K:\Rubikon
[25/03/2009 - 20:46:30 | D ] K:\KPP
[21/01/2010 - 12:54:52 | D ] K:\HK
[25/03/2009 - 20:51:46 | D ] K:\Asertivita
[19/04/2010 - 11:32:36 | A | 2766] K:\BOOTEX.LOG
[16/02/2009 - 21:50:00 | A | 107520] K:\Rodina a škola.ppt
[25/03/2009 - 20:52:42 | D ] K:\Příspěvky
[01/04/2009 - 23:30:32 | D ] K:\Výchovné poradenství
[26/09/2009 - 01:24:58 | D ] K:\Kázeň
[06/10/2009 - 18:20:36 | A | 13377] K:\Centrum v. - Zápis.docx
[26/09/2009 - 01:19:32 | D ] K:\SZZ
[12/03/2009 - 10:55:10 | D ] K:\Přijimačky
[26/09/2009 - 01:13:22 | D ] K:\Kurz EtV
[06/04/2009 - 15:23:36 | A | 12674] K:\EPASI projekt.docx
[20/06/2009 - 14:40:18 | D ] K:\Jenda
[30/01/2009 - 13:27:14 | A | 117248] K:\Prohlášení KÚ za 08.doc
[06/04/2009 - 18:02:08 | A | 77492] K:\Evaluace_sylab.pdf
[05/01/2010 - 23:06:08 | D ] K:\Diagnostika
[27/01/2010 - 11:34:56 | A | 73728] K:\Metodik, zkrácený kurz.doc
[11/10/2009 - 23:22:30 | A | 56299] K:\NIDV akreditace.docx
[05/03/2010 - 12:50:56 | A | 798367] K:\FAKTURY.rtf
[26/01/2010 - 22:38:12 | A | 112128] K:\Publikace.doc
[07/06/2009 - 00:29:18 | A | 23552] K:\Zápis služ. cesta Malmo.doc
[04/06/2010 - 22:56:20 | A | 98304] K:\Olomouc, EtF, 2010.doc
[09/06/2010 - 08:45:42 | D ] K:\Sýkora - NIDM
[18/08/2009 - 14:35:38 | A | 83968] K:\V BĚHU.doc
[02/08/2009 - 10:28:30 | A | 142848] K:\Literatura.doc
[09/06/2010 - 21:41:34 | A | 680448] K:\Etická a prosociální výchova.ppt
[14/07/2008 - 15:06:44 | A | 3480355] K:\prirucka_pro_zadatele_30_06_2008.pdf
[13/06/2010 - 14:41:16 | A | 1294088] K:\Empírie 1[1].pdf
[05/08/2009 - 10:45:48 | A | 36864] K:\Vztah žáků ke své škole.doc
[07/02/2010 - 23:06:40 | D ] K:\Habiltace 09
[19/04/2010 - 12:51:54 | A | 87040] K:\G nový.doc
[13/06/2010 - 14:41:40 | A | 113435] K:\Empírie 1[1].txt
[25/06/2010 - 10:57:08 | D ] K:\Habilitace_10
[01/11/2009 - 22:54:22 | A | 25088] K:\Vlhová - Anotace m. konf. doc..doc
[13/05/2010 - 16:15:26 | A | 41984] K:\Haškovec.doc
[03/11/2009 - 15:47:12 | A | 118784] K:\Sborník EtV.doc
[12/05/2008 - 19:53:56 | A | 92160] K:\Ročková.doc
[22/01/2010 - 22:01:34 | D ] K:\Szondi
[20/09/2009 - 22:47:52 | D ] K:\Ped.psych
[18/11/2009 - 20:39:30 | A | 129024] K:\Sborník EtV pro KHK.doc
[15/08/2009 - 00:26:26 | D ] K:\Projekt KEV
[30/04/2008 - 18:12:06 | A | 22016] K:\NIDV.doc
[25/07/2008 - 17:48:00 | D ] K:\Výzkum KŽS
[22/03/2009 - 15:07:38 | D ] K:\Akreditace
[25/07/2008 - 22:53:06 | A | 146944] K:\Prosocial behavior.doc
[26/05/2010 - 21:41:00 | A | 84480] K:\Podpora žáka.ppt
[29/06/2010 - 14:56:26 | A | 27136] K:\10-06_Info o katedre[1].doc
[22/08/2009 - 18:33:54 | A | 281640] K:\EV_Bc_2009-10.PDF
[24/11/2007 - 12:46:16 | A | 24064] K:\University information.doc
[18/04/2010 - 17:22:46 | A | 391243] K:\CiCe Conference Abstract book[2].pdf
[15/12/2009 - 09:22:50 | A | 273284] K:\09-10_PF_KPP.jpg
[22/03/2009 - 15:07:54 | D ] K:\Almanach
[22/03/2009 - 15:08:40 | D ] K:\Diplomky
[22/03/2009 - 15:09:38 | D ] K:\DISERTACNI PRACE Bělík
[17/01/2010 - 19:59:36 | D ] K:\Code of ethics
[01/01/2010 - 19:58:20 | D ] K:\Publikace,CV,citace
[22/03/2009 - 15:10:00 | D ] K:\Firmy
[22/03/2009 - 15:10:16 | D ] K:\Istanbul
[22/03/2009 - 15:12:32 | D ] K:\Portál
[22/03/2009 - 15:13:08 | D ] K:\Posudky
[22/03/2009 - 15:13:16 | D ] K:\Sylaby v cizím jazyce
[02/08/2008 - 22:19:54 | A | 44968] K:\McCabe_et_al.pdf
[05/01/2010 - 11:59:10 | D ] K:\Projekt Sýkora
[02/08/2008 - 22:29:50 | A | 126252] K:\Use of a Classroom Honor Code in Higher Education.mht
[02/08/2008 - 22:34:30 | A | 9203853] K:\82369073.pdf
[25/11/2007 - 17:42:38 | A | 90112] K:\application_form_section B.doc
[04/08/2008 - 00:39:54 | A | 291840] K:\chardev.doc
[08/05/2010 - 15:14:46 | A | 50688] K:\Teze habilitační práce[1].doc
[13/05/2010 - 17:03:32 | A | 1320960] K:\Konference Humanizace UHK[1].doc
[19/05/2010 - 13:59:10 | A | 128719] K:\School cheating, Barcelona.pptx
[19/05/2010 - 13:58:12 | A | 470528] K:\School cheating, Barcelona.ppt
[04/06/2010 - 21:25:08 | A | 116736] K:\Etické výchova, EF Olomouc, 2010.ppt
[29/06/2010 - 14:59:34 | A | 40960] K:\EtV strukt. seznam - akredit. vyuč.6-10[1].doc
[29/06/2010 - 15:39:16 | A | 101376] K:\Akred Ot -SZZ Bc -konečná[1].doc
[08/03/2008 - 13:22:02 | A | 28062] K:\Grada dotazník.rtf
[19/12/2007 - 23:44:04 | A | 47616] K:\Konf. multik. HK - přísp..doc
[08/02/2009 - 13:56:42 | A | 28160] K:\nazoridnes.doc
[29/07/2008 - 11:59:22 | A | 107812] K:\Portál_cz Zvnitřněné normy a školní podvádění.mht
[12/03/2009 - 16:45:46 | A | 30208] K:\Program školení zaměřeného na témata OSV.doc
[23/03/2009 - 19:11:54 | A | 92672] K:\Danča - GAČR.doc

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
E:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
F:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
G:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
K:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_DOLFIK.zip
http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution.

################## | E.O.F |

[motji]

Tyto složky znáte?
C:\t18o
C:\t1to.g
C:\t38c.3
C:\t3jk
C:\t3t4


To s tím Daemonem pak vyladíme, nebojte.

Ponechejte flešky připojené
Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky

[Zaitsev]

Tyto složky znáte?
C:\t18o
C:\t1to.g
C:\t38c.3
C:\t3jk
C:\t3t4
tyto složky mi nic neříkají - "havěť"?

Co se týče Deamona - tak jsem to psychicky nevydržel a odinstaloval ho...od tý doby je klid

Nechal jsem dnes jet AVPTOOL, který dojel do 96%, když projížděl můj externí disk - asi dvě hodiny se už dál nehýbal, tak jsem ho ukončil a zde je log dle návodu (imortant events) - v těch normálních událostech bylo vše ok

Autoscan: stopping (events: 20, objects: 266642, time: Unknown)
8.8.2010 15:11:40 Task started
8.8.2010 19:02:41 Processing error I:\Seriály\In Treatment\1 week\In.Treatment.S01E02.Alex.Week.One.HDTV.XviD-0TV.avi Read error
8.8.2010 20:31:07 Processing error I:\My files\High School\Ostatní pelmel\Anketa - děvčata.doc Read error
8.8.2010 20:31:31 Processing error I:\My files\High School\Ostatní pelmel\BAR_1.doc Read error
8.8.2010 20:31:40 Processing error I:\My files\High School\Ostatní pelmel\DE-A.doc Read error
8.8.2010 20:31:45 Processing error I:\My files\High School\Ostatní pelmel\DE-F.doc Read error
8.8.2010 20:32:01 Processing error I:\My files\High School\Ostatní pelmel\Jan VACEK.doc Read error
8.8.2010 20:32:42 Processing error I:\My files\High School\Ostatní pelmel\Lidé kolem Hitlera.doc Read error
8.8.2010 20:32:53 Processing error I:\My files\High School\Ostatní pelmel\ON-E.doc Read error
8.8.2010 20:33:03 Processing error I:\My files\High School\Ostatní pelmel\Zakl de 1.doc Read error
8.8.2010 20:33:04 Processing error I:\My files\High School\Ostatní pelmel\zakl de 3.doc Read error
8.8.2010 20:33:04 Processing error I:\My files\High School\Ostatní pelmel\Četba.doc Read error
8.8.2010 20:33:04 Processing error I:\My files\High School\Maturita - ZSV 2005\23 A.doc Read error
8.8.2010 20:33:09 Processing error I:\My files\High School\Maturita - ZSV 2005\EKONOMIE.rtf Read error
8.8.2010 20:33:09 Processing error I:\My files\High School\Maturita - ZSV 2005\EU.doc Read error
8.8.2010 20:33:28 Processing error I:\My files\High School\Maturita - ZSV 2005\Evrops kunie.doc Read error
8.8.2010 20:33:29 Processing error I:\My files\High School\Maturita - ZSV 2005\Fenomenologie.doc Read error
8.8.2010 20:33:39 Processing error I:\My files\High School\Maturita - ZSV 2005\filosofie - ZSV.doc Read error
8.8.2010 20:33:40 Processing error I:\My files\High School\Maturita - ZSV 2005\filozofie-stedovk.doc Read error
8.8.2010 20:34:04 Processing error I:\My files\High School\Maturita - ZSV 2005\GLOBALIZACE.doc Read error

[motji]

A můžete se do těch složek podívat?

[Zaitsev]

Koukám na ně a otevřel jsem je v poznámkovém bloku (v ničem jiném mi to nešlo) - nejvíc se tam objevuje slovo "weapon" - celkem mi to přijde jako bláboly - ničemu asi nebude vadit, když je smažu, že?

[motji]

Já to smáznu

Nechte připojené flešky a pod

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

File:: 
c:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf
H:\Autorun.inf
I:\Autorun.inf
K:\Autorun.inf
L:\Autorun.inf
C:\t18o
C:\t1to.g
C:\t38c.3
C:\t3jk
C:\t3t4

Folder::
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
I:\recycler
C:\resycled
D:\resycled
e:\resycled
f:\resycled
g:\resycled
h:\resycled
I:\resycled
c:\$recycle.bin
d:\$recycle.bin
e:\$recycle.bin
f:\$recycle.bin
g:\$recycle.bin
h:\$recycle.bin
I:\$recycle.bin

DDS::
uSearch Page = hxxp://search.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearch Bar = hxxp://search.qip.ru/ie
uDefault_Page_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[Zaitsev]

combolog:

ComboFix 10-08-06.01 - Adolfik 08.08.2010 22:17:32.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.693 [GMT 2:00]
Spuštěný z: c:\documents and settings\Adolfik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Adolfik\Plocha\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\Autorun.inf"
"C:\t18o"
"C:\t1to.g"
"C:\t38c.3"
"C:\t3jk"
"C:\t3t4"
"D:\Autorun.inf"
"E:\Autorun.inf"
"F:\Autorun.inf"
"G:\Autorun.inf"
"H:\Autorun.inf"
"I:\Autorun.inf"
"K:\Autorun.inf"
"L:\Autorun.inf"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\recycler
C:\t18o
C:\t1to.g
C:\t38c.3
C:\t3jk
C:\t3t4
g:\recycler
h:\recycler
I:\$recycle.bin
I:\recycler

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-08 do 2010-08-08 )))))))))))))))))))))))))))))))
.

2010-08-06 21:22 . 2010-08-06 21:22 10764 ----a-w- C:\UsbFix_Upload_Me_DOLFIK.zip
2010-08-06 21:16 . 2010-08-08 20:07 -------- d-----w- C:\UsbFix
2010-08-06 12:35 . 2010-08-06 12:36 -------- d-----w- c:\program files\trend micro
2010-08-06 12:35 . 2010-08-06 12:37 -------- d-----w- C:\rsit
2010-08-01 09:13 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-25 14:53 . 2010-07-25 14:53 -------- d-----w- c:\program files\iPod
2010-07-25 14:47 . 2010-07-25 14:47 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-08 19:13 . 2009-02-22 20:55 -------- d-----w- c:\program files\DNA
2010-08-06 09:49 . 2009-04-21 14:35 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-08-06 09:49 . 2008-04-09 16:23 -------- d-----w- c:\program files\WorldNet
2010-08-06 09:49 . 2007-04-20 07:31 -------- d-----w- c:\program files\Apple Software Update
2010-08-01 09:34 . 2007-05-14 19:55 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-25 14:54 . 2008-11-10 12:18 -------- d-----w- c:\program files\iTunes
2010-07-25 14:53 . 2007-07-03 08:08 -------- d-----w- c:\program files\Common Files\Apple
2010-07-25 14:43 . 2008-03-19 08:30 -------- d-----w- c:\program files\Safari
2010-06-25 18:30 . 2001-10-25 12:00 84078 ----a-w- c:\windows\system32\perfc005.dat
2010-06-25 18:30 . 2001-10-25 12:00 441422 ----a-w- c:\windows\system32\perfh005.dat
2010-06-21 17:39 . 2007-03-30 14:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-21 17:19 . 2010-06-21 17:19 -------- d-----w- c:\program files\Ubi Soft
2010-06-20 06:33 . 2007-04-07 06:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-18 14:40 . 2008-09-07 11:01 51764 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-14 14:30 . 2007-03-30 14:06 743936 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-06 13:31 . 2008-09-21 16:58 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-06 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-21 68856]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-07-02 2347216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2000-10-16 32768]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"RTHDCPL"=RTHDCPL.EXE
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\v8010\\DMMultiView\\MultiView.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22146:TCP"= 22146:TCP:BitComet 22146 TCP
"22146:UDP"= 22146:UDP:BitComet 22146 UDP

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [11.4.2010 18:20 19320]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\ACEDRV11.sys [23.1.2008 10:19 501560]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [30.3.2007 16:14 34944]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.12.2009 17:55 135664]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.4.2007 8:38 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-08-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 15:55]

2010-08-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-790525478-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-08-08 c:\windows\Tasks\User_Feed_Synchronization-{F7A6ADA6-3D06-44FD-BC50-AA49DB618CEC}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: {865005C8-6FB1-46D5-B78A-D3319BB361E3} = 192.168.1.1
DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} - hxxp://192.168.1.249/cab/DownloadCenter_8200.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-08 22:24
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ee,a2,7c,b8,d0,c3,88,b9,ff,30,f2,43,29,21,cb,95,74,77,28,5f,16,4c,6c,
ec,9c,25,44,80,db,54,82,7b,6f,56,4d,1e,dc,1f,46,e8,77,99,e6,05,6e,2e,13,ed,\
"??"=hex:3a,46,89,ff,8f,f6,a7,52,cc,e2,41,ab,8a,8a,e6,2d

[HKEY_USERS\S-1-5-21-1659004503-790525478-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:1d,a0,de,74,ad,4f,82,93,ca,69,5d,f4,bf,b7,80,63,06,65,4d,38,18,
e3,73,b9,dd,4f,5b,04,b2,1d,56,22,08,d5,a6,41,3e,38,09,95,5c,8f,55,2d,b1,2b,\
"rkeysecu"=hex:da,5f,36,6f,b9,70,3a,fa,8f,c3,fe,b8,7a,d1,a5,8b
.
Celkový čas: 2010-08-08 22:26:58
ComboFix-quarantined-files.txt 2010-08-08 20:26
ComboFix2.txt 2010-08-06 21:11
ComboFix3.txt 2010-08-06 14:57

Před spuštěním: Volných bajtů: 30 411 038 720
Po spuštění: Volných bajtů: 30 864 678 912

- - End Of File - - 741140C4A31EFEE2B0CDCDB3B4F771C1

[motji]

Co počítač?

[Zaitsev]

Program qip chce pořád dělat změny v registrech, což mu zakazuji...Jinak mi počítač přijde v tuto chvíli uplně v pořádku a blíží se chvíle Vám převelice poděkovat, že jste z mého vraku, který byl zralý na potopení udělala obstojně plující "zánovní" parník Děláte tu skvělé služby, jsem nadšen!