Nejde antivirák

[Flack007]

Dobrý den,
poslední dva dny mi nejde vůbec zpustit Eset Smart Security. Ikona mi zmizla z plochy(i dole na liště) a při spuštění systému se ukáže hlášení o špatném spuštění egui.exe. Eseta jsem zkoušela odinstalovat, jak mi poradila podpora ESS a znovu nainstalovat, ale problémy přetrvaly. Problém je, že nevim kolik mi nyní vlítne do počítače havěti.

Předem děkuji za pomoc.


Logfile of random's system information tool 1.08 (written by random/random)
Run by Laďka at 2010-09-18 12:53:49
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 62 GB (53%) free of 118 GB
Total RAM: 1022 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:54:29, on 18. 9. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Laďka\Plocha\RSIT.exe
C:\Program Files\trend micro\Laďka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} (ToolbarInetInstall Control) - https://download.seznam.cz/listicka/toolbar2007.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/ ... 2401391921
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} (VodClient Control Class) - http://www.vexcast.com/download/vexcast.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://icq.oberon-media.com/gameshell/g ... der_v6.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Služba Google Update (gupdate1c9bdf9855ac1d6) (gupdate1c9bdf9855ac1d6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 10606 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{5B5F163F-E1F5-48BD-85EB-0D783AD79EF2}.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{CC88871F-3F08-4908-92C3-07C73B30FB29}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Toolbar Helper

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe [2006-05-10 90112]
"MsmqIntCert"=regsvr32 /s mqrt.dll []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-02-20 1443072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\steam\steam.exe [2010-09-09 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Laďka^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE [2009-02-23 576000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-08-23 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Messenger\Msmsgs.exe"="C:\Program Files\Messenger\Msmsgs.exe:*:Disabled:Windows Messenger"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-09-18 12:53:49 ----DC---- C:\rsit
2010-09-18 12:50:57 ----SHDC---- C:\RECYCLER
2010-09-18 12:18:01 ----D---- C:\WINDOWS\LastGood
2010-09-18 12:05:03 ----A---- C:\WINDOWS\ntbtlog.txt
2010-09-17 21:48:25 ----D---- C:\WINDOWS\temp
2010-09-17 21:34:13 ----AC---- C:\Boot.bak
2010-09-17 21:34:08 ----RASHDC---- C:\cmdcons
2010-09-17 21:11:59 ----D---- C:\WINDOWS\ERDNT
2010-09-17 12:57:17 ----HDC---- C:\WINDOWS\$NtUninstallKB963093$
2010-09-15 12:04:03 ----HDC---- C:\WINDOWS\$NtUninstallKB2259922$
2010-09-15 12:03:57 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2010-09-15 12:03:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2010-09-15 12:03:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2121546$
2010-09-15 12:03:18 ----HDC---- C:\WINDOWS\$NtUninstallKB982802$
2010-09-15 12:02:45 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2010-09-15 12:01:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2141007$
2010-09-09 21:11:32 ----D---- C:\Documents and Settings\Laďka\Data aplikací\Desktop Sidebar
2010-08-30 21:41:36 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2010-08-29 23:12:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\InstallShield
2010-08-23 17:23:46 ----A---- C:\WINDOWS\system32\drivers\mcdbus.sys
2010-08-23 17:23:42 ----D---- C:\Program Files\MagicDisc
2010-08-23 17:22:12 ----D---- C:\Program Files\MagicISO
2010-08-22 20:37:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment

======List of files/folders modified in the last 1 months======

2010-09-18 12:54:29 ----D---- C:\Program Files\trend micro
2010-09-18 12:51:09 ----D---- C:\WINDOWS\Prefetch
2010-09-18 12:46:27 ----D---- C:\WINDOWS\Microsoft.NET
2010-09-18 12:46:25 ----RSD---- C:\WINDOWS\assembly
2010-09-18 12:38:29 ----D---- C:\WINDOWS
2010-09-18 12:18:21 ----SHD---- C:\WINDOWS\Installer
2010-09-18 12:18:20 ----D---- C:\Config.Msi
2010-09-18 12:18:15 ----HD---- C:\WINDOWS\inf
2010-09-18 12:18:15 ----D---- C:\WINDOWS\system32\drivers
2010-09-18 12:18:00 ----D---- C:\WINDOWS\system32\CatRoot2
2010-09-18 12:03:56 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-09-17 21:44:36 ----AC---- C:\WINDOWS\system.ini
2010-09-17 21:39:48 ----D---- C:\WINDOWS\system32
2010-09-17 21:39:48 ----D---- C:\WINDOWS\AppPatch
2010-09-17 21:39:40 ----D---- C:\Program Files\Common Files
2010-09-17 21:34:13 ----RASHC---- C:\boot.ini
2010-09-17 21:12:07 ----SHD---- C:\System Volume Information
2010-09-17 21:12:07 ----D---- C:\WINDOWS\system32\Restore
2010-09-17 19:36:22 ----D---- C:\Documents and Settings\Laďka\Data aplikací\Skype
2010-09-17 19:29:51 ----D---- C:\Documents and Settings\Laďka\Data aplikací\skypePM
2010-09-17 19:25:34 ----D---- C:\Program Files\Mozilla Firefox
2010-09-17 19:23:12 ----D---- C:\WINDOWS\system32\cs-cz
2010-09-17 19:23:12 ----D---- C:\Program Files\Windows Desktop Search
2010-09-17 16:53:48 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-09-17 16:53:29 ----D---- C:\WINDOWS\system32\wbem
2010-09-17 16:49:32 ----RD---- C:\Program Files
2010-09-17 16:47:02 ----D---- C:\WINDOWS\Debug
2010-09-16 15:32:33 ----D---- C:\Program Files\GoQ - NetRadio
2010-09-16 15:25:20 ----D---- C:\WINDOWS\system32\CatRoot
2010-09-16 15:25:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-09-16 13:02:20 ----D---- C:\Program Files\ESET
2010-09-16 13:00:34 ----A---- C:\WINDOWS\NeroDigital.ini
2010-09-15 12:04:02 ----HD---- C:\WINDOWS\$hf_mig$
2010-09-15 12:03:59 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-09-15 12:03:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-09-15 12:01:13 ----A---- C:\WINDOWS\system32\MRT.exe
2010-09-14 21:39:25 ----D---- C:\Documents and Settings\Laďka\Data aplikací\uTorrent
2010-09-14 18:28:53 ----SD---- C:\Documents and Settings\Laďka\Data aplikací\Microsoft
2010-09-13 19:32:17 ----HD---- C:\Program Files\InstallShield Installation Information
2010-09-13 19:16:02 ----D---- C:\Documents and Settings\Laďka\Data aplikací\Zoner
2010-09-12 10:22:18 ----D---- C:\WINDOWS\Minidump
2010-09-11 23:14:09 ----D---- C:\WINDOWS\system32\DirectX
2010-09-09 21:21:20 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-09-09 17:53:38 ----RSD---- C:\WINDOWS\Fonts
2010-09-09 17:19:47 ----D---- C:\Program Files\Steam
2010-09-08 14:35:38 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-04 19:23:33 ----DC---- C:\output
2010-09-04 11:22:47 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-08-29 23:06:14 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-08-29 23:06:14 ----D---- C:\Program Files\Common Files\InstallShield
2010-08-25 10:51:49 ----D---- C:\WINDOWS\pss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2006-01-27 99584]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 prohlp02;StarForce Protection Helper Driver v2; C:\WINDOWS\System32\drivers\prohlp02.sys [2004-10-07 115744]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-03-31 44944]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp01;StarForce Protection Helper Driver; C:\WINDOWS\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-05-16 66560]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-02-20 29704]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2008-02-20 54280]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-10-07 80576]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 acedrv11;acedrv11; \??\C:\WINDOWS\system32\drivers\acedrv11.sys []
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-06-28 278728]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-02-20 39944]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2008-02-20 71176]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-06-28 25416]
R3 actser;actser; C:\WINDOWS\system32\drivers\actser.sys [2005-11-30 29440]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-05 141312]
R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-08-23 1723904]
R3 ATIAVAIW;ATI T200 Unified AVStream service; C:\WINDOWS\system32\DRIVERS\atinavt2.sys [2006-08-02 168832]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-02-20 30728]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
R3 MQAC;Message Queuing access control; \??\C:\WINDOWS\system32\drivers\mqac.sys []
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2004-04-01 10368]
R3 RMCAST;Reliable Multicast Protocol driver; \??\C:\WINDOWS\system32\drivers\RMCast.sys []
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 atirage3;atirage3; C:\WINDOWS\system32\DRIVERS\atimpae.sys [2001-10-24 75136]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 EagleXNt;EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys []
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 hidgame;Microsoft Hid to Joystick Port Enabler; C:\WINDOWS\system32\DRIVERS\hidgame.sys [2001-08-17 8576]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 k310bus;Sony Ericsson K310 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\k310bus.sys [2006-03-10 60800]
S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k310mdfl.sys [2006-03-10 9264]
S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\k310mdm.sys [2006-03-10 96352]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 siusbmod;siusbmod; C:\WINDOWS\system32\DRIVERS\siusbmod.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vsbus;Virtual Serial Bus Enumerator; C:\WINDOWS\system32\DRIVERS\vsb.sys [2005-11-30 15264]
S3 vserial;ELTIMA Virtual Serial Ports Driver; C:\WINDOWS\System32\DRIVERS\vserial.sys [2005-11-30 47744]
S3 w200bus;Sony Ericsson W200 driver (WDM); C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 61504]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 9328]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 97056]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 88560]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 86368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-07-16 691696]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-08-23 413696]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Capture Device Service;Capture Device Service; C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2008-02-20 472320]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-02-17 139264]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-02-17 20543]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 MSMQ;Message Queuing; C:\WINDOWS\system32\mqsvc.exe [2008-04-14 4608]
R2 MSMQTriggers;Message Queuing Triggers; C:\WINDOWS\system32\mqtgsvc.exe [2008-04-14 117248]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-02-17 127035]
R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-02-17 61503]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-08-22 520192]
S2 gupdate1c9bdf9855ac1d6;Služba Google Update (gupdate1c9bdf9855ac1d6); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-15 133104]
S2 vvdsvc;VJVodClientServices; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-02-20 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-22 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Flack007]

Před začátkem mi to psalo, že mám zapnutý Eset, ale nevím, kde ho mám vypnout, když nejde ani otevřít.

ComboFix 10-09-17.04 - Ladislav . 09. 2010 15:02:36.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.434 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ladislav\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-08-18 do 2010-09-18 )))))))))))))))))))))))))))))))
.

2010-09-18 10:53 . 2010-09-18 10:54 -------- dc----w- C:\rsit
2010-09-18 10:18 . 2010-09-18 10:18 -------- d-----w- c:\windows\LastGood
2010-09-18 10:06 . 2010-09-18 10:06 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-09-16 16:35 . 2010-09-16 16:35 -------- d-----w- c:\documents and settings\NetworkService\Plocha
2010-09-16 13:28 . 2010-09-16 13:28 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-08-30 19:41 . 2010-08-30 19:41 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-23 15:23 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-08-23 15:23 . 2010-08-23 15:23 -------- d-----w- c:\program files\MagicDisc
2010-08-23 15:22 . 2010-08-31 17:31 -------- d-----w- c:\program files\MagicISO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 12:15 . 2010-06-12 10:11 106760 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-09-18 10:54 . 2010-07-14 13:05 -------- d-----w- c:\program files\trend micro
2010-09-17 17:23 . 2008-02-02 09:41 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-17 14:53 . 2006-03-02 12:00 516984 ----a-w- c:\windows\system32\perfh005.dat
2010-09-17 14:53 . 2006-03-02 12:00 112040 ----a-w- c:\windows\system32\perfc005.dat
2010-09-16 13:32 . 2008-02-01 17:26 -------- d-----w- c:\program files\GoQ - NetRadio
2010-09-16 11:02 . 2008-05-10 08:31 -------- d-----w- c:\program files\ESET
2010-09-13 17:32 . 2008-02-01 15:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-09 15:19 . 2010-08-12 15:21 -------- d-----w- c:\program files\Steam
2010-09-08 12:35 . 2008-08-28 15:04 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-04 09:22 . 2009-02-06 18:15 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-29 21:06 . 2008-02-01 15:02 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-17 13:17 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 13:28 . 2008-02-11 14:38 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-08-12 19:48 . 2008-02-01 15:34 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-12 19:48 . 2008-12-04 16:57 -------- d-----w- c:\program files\AGEIA Technologies
2010-08-12 19:48 . 2008-03-04 11:39 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-29 19:40 . 2010-07-29 11:40 -------- d-----w- c:\program files\Celtx
2010-07-22 15:46 . 2006-03-02 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 11:50 . 2010-07-21 11:50 -------- d-----w- c:\program files\CCleaner
2010-07-20 20:59 . 2010-07-20 20:59 -------- d-----w- c:\program files\Gameforge4D
2010-07-20 19:54 . 2010-07-20 19:54 -------- d-----w- c:\program files\Creative
2010-07-16 20:14 . 2009-09-24 15:18 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-30 12:33 . 2006-03-02 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2006-03-02 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2006-03-02 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-02-20 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Ladislav\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKLM\~\startupfolder\C:^Documents and Settings^Laďka^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
path=c:\documents and settings\Laďka\Nabídka Start\Programy\Po spuštění\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 14:17 159744 ----a-r- c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-09-09 15:16 1242448 ----a-w- c:\program files\Steam\steam.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"nTrayFw"=c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"
"PC-Checkup"="c:\program files\Speeditup Free\PCCheckUp.exe" -mini
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30. 7. 2008 7:51 277736]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [20. 2. 2008 11:08 472320]
S2 gupdate1c9bdf9855ac1d6;Služba Google Update (gupdate1c9bdf9855ac1d6);c:\program files\Google\Update\GoogleUpdate.exe [15. 4. 2009 20:39 133104]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 k310bus;Sony Ericsson K310 Driver driver (WDM);c:\windows\system32\drivers\k310bus.sys [8. 5. 2009 19:22 60800]
S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;c:\windows\system32\drivers\k310mdfl.sys [17. 5. 2009 19:16 9264]
S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;c:\windows\system32\drivers\k310mdm.sys [17. 5. 2009 19:16 96352]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24. 9. 2009 17:18 691696]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - EAMON
*NewlyCreated* - EASDRV
*NewlyCreated* - EKRN
*NewlyCreated* - EPFW
*NewlyCreated* - EPFWTDI

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-17 c:\windows\Tasks\User_Feed_Synchronization-{5B5F163F-E1F5-48BD-85EB-0D783AD79EF2}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-09-18 c:\windows\Tasks\User_Feed_Synchronization-{CC88871F-3F08-4908-92C3-07C73B30FB29}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxps://download.seznam.cz/listicka/toolbar2007.cab
FF - ProfilePath - c:\documents and settings\Ladislav\Data aplikací\Mozilla\Firefox\Profiles\mg6gnazy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-18 15:08
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c7,fa,a9,11,e1,3a,aa,7a,65,65,fd,7d,8f,20,d3,76,9a,5f,2a,c3,fb,84,fa,
92,84,53,e0,8a,e8,c3,63,54,ef,7b,55,cf,8b,f7,a2,30,40,89,0e,82,90,6d,65,a9,\
"??"=hex:9c,d1,9e,24,3d,a3,4d,ee,a3,6c,46,44,1d,cd,fb,e2

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:20,86,e4,81,4b,c8,6d,f2,d4,8d,68,38,f6,10,ba,02,fe,ef,05,90,99,
eb,9b,9e,29,f8,33,36,b1,7f,e5,a6,09,b9,00,34,55,6d,be,8b,a2,88,35,11,85,d9,\
"rkeysecu"=hex:0f,3d,48,d7,cc,f5,8f,f0,f5,5a,fe,09,b5,3b,35,13

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(3884)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-09-18 15:12:26
ComboFix-quarantined-files.txt 2010-09-18 13:12

Před spuštěním: Volných bajtů: 65 442 512 896
Po spuštění: Volných bajtů: 65 462 415 360

- - End Of File - - FFC9429FE9AA99C34DB9AB34CE719726

[Rudy]

Log vypadá čistý. Zkuste odinstalovat ESET pomocí ESET Eliminator: http://www.james008.net/web/pluginy/vir ... inator.zip . Pak PC vyčistěte CCleanerem: http://www.viry.cz/forum/viewtopic.php?f=46&t=7478 a zkuste ho znova n.ainstalovat

[Flack007]

Eliminator mi program vůbec nesmazal. Když vložím instalační CD, tak mi to nabízí možnost pouze opravit a odinstalovat, ale ani když zde dám odinstalovat nic se nestane. Vlastně se dokončí odinstalace, ale program v počítači pořád zůstane, i když nejde otevřít.

(před tím než jsem napsala první zprávu do tohoto threadu, tak se program i odinstaloval a už se vyskakovací okno při zapnutí neukazovalo, po nainstalování se opět zobrazovalo)

Zajímavé je, že po dokončené odinstalaci mám program pořád v pc a hlavně v 'centru zabezpečení' je vše jak má být. Ani mi to nepíše počítač může být ohrožen nebo něco....

[Rudy]

OK, odpálíme ho ComboFixem:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Dejte log.

[Flack007]

ComboFix 10-09-17.04 - Ladislav . 09. 2010 10:05:26.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.654 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ladislav\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-08-19 do 2010-09-19 )))))))))))))))))))))))))))))))
.

2010-09-18 10:53 . 2010-09-18 10:54 -------- dc----w- C:\rsit
2010-09-18 10:06 . 2010-09-18 10:06 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-09-16 16:35 . 2010-09-16 16:35 -------- d-----w- c:\documents and settings\NetworkService\Plocha
2010-09-16 13:28 . 2010-09-16 13:28 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-08-30 19:41 . 2010-08-30 19:41 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-23 15:23 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-08-23 15:23 . 2010-08-23 15:23 -------- d-----w- c:\program files\MagicDisc
2010-08-23 15:22 . 2010-08-31 17:31 -------- d-----w- c:\program files\MagicISO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 20:51 . 2008-05-10 08:31 -------- d-----w- c:\program files\ESET
2010-09-18 12:15 . 2010-06-12 10:11 106760 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-09-18 10:54 . 2010-07-14 13:05 -------- d-----w- c:\program files\trend micro
2010-09-17 17:23 . 2008-02-02 09:41 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-17 14:53 . 2006-03-02 12:00 516984 ----a-w- c:\windows\system32\perfh005.dat
2010-09-17 14:53 . 2006-03-02 12:00 112040 ----a-w- c:\windows\system32\perfc005.dat
2010-09-16 13:32 . 2008-02-01 17:26 -------- d-----w- c:\program files\GoQ - NetRadio
2010-09-13 17:32 . 2008-02-01 15:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-09 15:19 . 2010-08-12 15:21 -------- d-----w- c:\program files\Steam
2010-09-08 12:35 . 2008-08-28 15:04 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-04 09:22 . 2009-02-06 18:15 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-29 21:06 . 2008-02-01 15:02 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-17 13:17 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 13:28 . 2008-02-11 14:38 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-08-12 19:48 . 2008-02-01 15:34 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-12 19:48 . 2008-12-04 16:57 -------- d-----w- c:\program files\AGEIA Technologies
2010-08-12 19:48 . 2008-03-04 11:39 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-29 19:40 . 2010-07-29 11:40 -------- d-----w- c:\program files\Celtx
2010-07-22 15:46 . 2006-03-02 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 11:50 . 2010-07-21 11:50 -------- d-----w- c:\program files\CCleaner
2010-07-16 20:14 . 2009-09-24 15:18 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-30 12:33 . 2006-03-02 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2006-03-02 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2006-03-02 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-09-18_13.08.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-18 10:18 . 2010-09-18 21:01 10134 c:\windows\Installer\{9CEC56BD-8860-41B0-927F-C81E89AA29F5}\callmsi.exe
- 2010-09-18 10:18 . 2010-09-18 10:18 10134 c:\windows\Installer\{9CEC56BD-8860-41B0-927F-C81E89AA29F5}\callmsi.exe
+ 2008-02-01 13:17 . 2010-09-18 20:43 355360 c:\windows\system32\FNTCACHE.DAT
- 2008-02-01 13:17 . 2010-09-09 16:51 355360 c:\windows\system32\FNTCACHE.DAT
+ 2010-09-18 10:18 . 2010-09-18 21:01 140544 c:\windows\Installer\{9CEC56BD-8860-41B0-927F-C81E89AA29F5}\egui.exe
- 2010-09-18 10:18 . 2010-09-18 10:18 140544 c:\windows\Installer\{9CEC56BD-8860-41B0-927F-C81E89AA29F5}\egui.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Ladislav\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKLM\~\startupfolder\C:^Documents and Settings^Laďka^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
path=c:\documents and settings\Laďka\Nabídka Start\Programy\Po spuštění\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 14:17 159744 ----a-r- c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-09-09 15:16 1242448 ----a-w- c:\program files\Steam\steam.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"nTrayFw"=c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"
"PC-Checkup"="c:\program files\Speeditup Free\PCCheckUp.exe" -mini
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30. 7. 2008 7:51 277736]
S2 gupdate1c9bdf9855ac1d6;Služba Google Update (gupdate1c9bdf9855ac1d6);c:\program files\Google\Update\GoogleUpdate.exe [15. 4. 2009 20:39 133104]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 k310bus;Sony Ericsson K310 Driver driver (WDM);c:\windows\system32\drivers\k310bus.sys [8. 5. 2009 19:22 60800]
S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;c:\windows\system32\drivers\k310mdfl.sys [17. 5. 2009 19:16 9264]
S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;c:\windows\system32\drivers\k310mdm.sys [17. 5. 2009 19:16 96352]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24. 9. 2009 17:18 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-18 c:\windows\Tasks\User_Feed_Synchronization-{5B5F163F-E1F5-48BD-85EB-0D783AD79EF2}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-09-19 c:\windows\Tasks\User_Feed_Synchronization-{CC88871F-3F08-4908-92C3-07C73B30FB29}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxps://download.seznam.cz/listicka/toolbar2007.cab
FF - ProfilePath - c:\documents and settings\Ladislav\Data aplikací\Mozilla\Firefox\Profiles\mg6gnazy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 10:12
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1076)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1132)
c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(2920)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-09-19 10:14:30
ComboFix-quarantined-files.txt 2010-09-19 08:14
ComboFix2.txt 2010-09-18 13:12

Před spuštěním: Volných bajtů: 65 890 971 648
Po spuštění: Volných bajtů: 65 891 700 736

- - End Of File - - 2FF579A3132258B6A6DD06453A63357A

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files\ESET

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkaz ze skriptu.

[Flack007]

Už mi v centru zabezpečení píše, že počítač může být ohrožen.


ComboFix 10-09-17.04 - Laďka . 09. 2010 17:50:59.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.496 [GMT 2:00]
Spuštěný z: c:\documents and settings\Laďka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Laďka\Plocha\CFScript.txt
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ESET
c:\program files\ESET\ESET Smart Security(2)\em000_32.dat
c:\program files\ESET\ESET Smart Security(2)\em001_32.dat
c:\program files\ESET\ESET Smart Security(2)\em002_32.dat
c:\program files\ESET\ESET Smart Security(2)\em003_32.dat
c:\program files\ESET\ESET Smart Security(2)\em004_32.dat
c:\program files\ESET\ESET Smart Security(2)\em005_32.dat
c:\program files\ESET\ESET Smart Security(2)\em006_32.dat
c:\program files\ESET\ESET Smart Security(2)\em008_32.dat
c:\program files\ESET\ESET Smart Security(2)\em009_32.dat
c:\program files\ESET\ESET Smart Security(2)\em010_32.dat
c:\program files\ESET\ESET Smart Security(2)\em013_32.dat
c:\program files\ESET\ESET Smart Security(2)\eset.chm
c:\program files\ESET\ESET Smart Security(2)\eula.rtf
c:\program files\ESET\ESET Smart Security\em000_32.dat
c:\program files\ESET\ESET Smart Security\em001_32.dat
c:\program files\ESET\ESET Smart Security\em002_32.dat
c:\program files\ESET\ESET Smart Security\em003_32.dat
c:\program files\ESET\ESET Smart Security\em004_32.dat
c:\program files\ESET\ESET Smart Security\em005_32.dat
c:\program files\ESET\ESET Smart Security\em006_32.dat
c:\program files\ESET\ESET Smart Security\em008_32.dat
c:\program files\ESET\ESET Smart Security\em009_32.dat
c:\program files\ESET\ESET Smart Security\em010_32.dat
c:\program files\ESET\ESET Smart Security\em013_32.dat
c:\program files\ESET\ESET Smart Security\em015_32.dat
c:\program files\ESET\ESET Smart Security\eset.chm
c:\program files\ESET\ESET Smart Security\eula.rtf
c:\program files\ESET\ESET Smart Security\Mozilla Thunderbird\install.rdf
c:\program files\ESET\Obsah aplikace OneNote.onetoc2

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-19 do 2010-09-19 )))))))))))))))))))))))))))))))
.

2010-09-19 14:55 . 2010-09-19 14:55 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-19 14:04 . 2010-09-19 14:04 0 ----a-w- c:\windows\ativpsrm.bin
2010-09-19 13:56 . 2010-09-19 13:56 -------- dc----w- C:\ATI
2010-09-19 12:11 . 2010-09-19 12:11 -------- d-----w- c:\documents and settings\Michal - admin\PrivacIE
2010-09-19 12:10 . 2010-09-19 14:27 -------- d-s---w- c:\documents and settings\Michal - admin
2010-09-19 12:10 . 2010-09-19 14:27 -------- d-----w- c:\documents and settings\Michal - admin\Šablony
2010-09-19 12:10 . 2010-09-19 14:27 -------- d-----w- c:\documents and settings\Michal - admin\Oblíbené položky
2010-09-19 12:10 . 2010-09-19 14:27 -------- d-----w- c:\documents and settings\Michal - admin\Data aplikací
2010-09-19 12:10 . 2010-09-19 14:27 -------- d-----w- c:\documents and settings\Michal - admin\Plocha
2010-09-19 12:10 . 2009-05-13 09:10 -------- d-----w- c:\documents and settings\Michal - admin\IETldCache
2010-09-19 11:57 . 2010-09-19 14:27 -------- dc----w- C:\RECYCLER(2)
2010-09-18 12:58 . 2010-09-19 14:27 -------- dc----w- C:\Qoobox(2)
2010-09-18 10:53 . 2010-09-18 10:54 -------- dc----w- C:\rsit
2010-09-18 10:06 . 2010-09-18 10:06 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2010-09-16 16:35 . 2010-09-16 16:35 -------- d-----w- c:\documents and settings\NetworkService\Plocha
2010-09-16 13:28 . 2010-09-16 13:28 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-08-30 19:41 . 2010-08-30 19:41 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-23 15:23 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-08-23 15:23 . 2010-08-23 15:23 -------- d-----w- c:\program files\MagicDisc
2010-08-23 15:22 . 2010-08-31 17:31 -------- d-----w- c:\program files\MagicISO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-19 15:17 . 2010-08-12 15:21 -------- d-----w- c:\program files\Steam
2010-09-19 14:31 . 2010-06-12 10:11 106760 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-09-19 14:27 . 2010-07-14 13:05 -------- d-----w- c:\program files\trend micro
2010-09-19 14:02 . 2008-02-02 12:33 -------- d-----w- c:\program files\ATI Technologies
2010-09-19 14:02 . 2008-02-01 15:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-17 17:23 . 2008-02-02 09:41 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-17 14:53 . 2006-03-02 12:00 516984 ----a-w- c:\windows\system32\perfh005.dat
2010-09-17 14:53 . 2006-03-02 12:00 112040 ----a-w- c:\windows\system32\perfc005.dat
2010-09-16 13:32 . 2008-02-01 17:26 -------- d-----w- c:\program files\GoQ - NetRadio
2010-09-08 12:35 . 2008-08-28 15:04 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-04 09:22 . 2009-02-06 18:15 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-29 21:06 . 2008-02-01 15:02 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-17 13:17 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 13:28 . 2008-02-11 14:38 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-08-12 19:48 . 2008-02-01 15:34 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-12 19:48 . 2008-12-04 16:57 -------- d-----w- c:\program files\AGEIA Technologies
2010-08-12 19:48 . 2008-03-04 11:39 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-29 19:40 . 2010-07-29 11:40 -------- d-----w- c:\program files\Celtx
2010-07-22 15:46 . 2006-03-02 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-16 20:14 . 2009-09-24 15:18 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-30 12:33 . 2006-03-02 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2006-03-02 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Ladislav\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"Picasa Media Detector"=c:\program files\Picasa2\PicasaMediaDetector.exe
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"nTrayFw"=c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"
"PC-Checkup"="c:\program files\Speeditup Free\PCCheckUp.exe" -mini
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30. 7. 2008 7:51 277736]
S2 gupdate1c9bdf9855ac1d6;Služba Google Update (gupdate1c9bdf9855ac1d6);c:\program files\Google\Update\GoogleUpdate.exe [15. 4. 2009 20:39 133104]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 k310bus;Sony Ericsson K310 Driver driver (WDM);c:\windows\system32\drivers\k310bus.sys [8. 5. 2009 19:22 60800]
S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;c:\windows\system32\drivers\k310mdfl.sys [17. 5. 2009 19:16 9264]
S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;c:\windows\system32\drivers\k310mdm.sys [17. 5. 2009 19:16 96352]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24. 9. 2009 17:18 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:39]

2010-09-18 c:\windows\Tasks\User_Feed_Synchronization-{5B5F163F-E1F5-48BD-85EB-0D783AD79EF2}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-09-19 c:\windows\Tasks\User_Feed_Synchronization-{CC88871F-3F08-4908-92C3-07C73B30FB29}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
Trusted Zone: microsoft.com\*.windowsupdate
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: windowsupdate.com
DPF: {3190CE28-0B6E-4133-A7D3-87D29CB92120} - hxxps://download.seznam.cz/listicka/toolbar2007.cab
FF - ProfilePath - c:\documents and settings\Laďka\Data aplikací\Mozilla\Firefox\Profiles\684fww4c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: c:\documents and settings\Laďka\Data aplikací\Mozilla\Firefox\Profiles\684fww4c.default\extensions\{4a8f88b8-4a70-41bd-bc89-385c364116d9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Laďka\Data aplikací\Mozilla\Firefox\Profiles\684fww4c.default\extensions\{4a8f88b8-4a70-41bd-bc89-385c364116d9}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 17:56
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c7,fa,a9,11,e1,3a,aa,7a,65,65,fd,7d,8f,20,d3,76,9a,5f,2a,c3,fb,84,fa,
92,84,53,e0,8a,e8,c3,63,54,ef,7b,55,cf,8b,f7,a2,30,40,89,0e,82,90,6d,65,a9,\
"??"=hex:9c,d1,9e,24,3d,a3,4d,ee,a3,6c,46,44,1d,cd,fb,e2

[HKEY_USERS\S-1-5-21-1659004503-1715567821-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:20,86,e4,81,4b,c8,6d,f2,d4,8d,68,38,f6,10,ba,02,fe,ef,05,90,99,
eb,9b,9e,29,f8,33,36,b1,7f,e5,a6,09,b9,00,34,55,6d,be,8b,a2,88,35,11,85,d9,\
"rkeysecu"=hex:0f,3d,48,d7,cc,f5,8f,f0,f5,5a,fe,09,b5,3b,35,13

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1080)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1136)
c:\windows\system32\nvappfilter.dll
.
Celkový čas: 2010-09-19 18:00:42
ComboFix-quarantined-files.txt 2010-09-19 16:00
ComboFix2.txt 2010-09-19 08:14

Před spuštěním: Volných bajtů: 64 039 378 944
Po spuštění: Volných bajtů: 64 067 584 000

- - End Of File - - 9E3DCA2B36F7708961CB51C1CDB32570

[Rudy]

Už je venku. Ted můžete zkusit nainstalovat nový AV.

[Flack007]

Opět po instalaci začalo vyskakovat okno jako před tím.

[Rudy]

Zkuste opravu systému XPManagerem: http://www.viry.cz/forum/viewtopic.php?f=46&t=17549 . Možná je v systému něco poškozeno. Pokud se to nepodaří ani potom, kontaktujte tech. podporu ESETu a sezamte je s novými skutečnostmi. Je i možné, že se s něčím, co máte nainstalováno, nesnáší.

[Flack007]

Díky moc. Trošku to zamrzí, když ten antivirák běží už dva roky normálně a když si opět prodloužím licenci o dva roky, tak to začne blbnout...

[Rudy]

Pro jistotu ještě můžeme zkusit ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Flack007]

Přes vzdálenou pomoc od Esetu mi řekli, že program i když nejde otevřít funguje a chrání počítač. Problém je někde v grafice.

Děkuju za pomoc