Pravdepodobne vir

[milan76]

Dobry den, prosil by som pomoct s nasledujucim problemom.

Pri spusteni PC mi nabehne okno, vid screen tu
http://imghost.sk/image/329833-screenvir.jpeg

a neviem co s tym, prosil by som o radu, jedna sa pravdepodobne o vir,
prikladam log s RSIT

dakujem

Logfile of random's system information tool 1.08 (written by random/random)
Run by ivanka at 2010-10-03 17:11:24
Microsoft Windows XP Professional Service Pack 2
System drive C: has 582 MB (6%) free of 10 GB
Total RAM: 503 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:11:43, on 3. 10. 2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\program files\common files\microsoft shared\filters\formatoffice.exe
C:\program files\common files\microsoft shared\filters\formatoffice.exe
C:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe
C:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\ivanka\Application Data\Desktop Security\Desktop Security 2010.exe
C:\Documents and Settings\ivanka\Application Data\Desktop Security\securitycenter.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\WINDOWS\system32\devldr32.exe
c:\documents and settings\ivanka\local settings\temporary internet files\content.ie5\sr5babrd\movie[1].exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ivanka\Desktop\RSIT.exe
C:\Program Files\trend micro\ivanka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe nhemkk
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [MessageMicrosoft] c:\program files\common files\microsoft shared\filters\formatoffice.exe
O4 - HKLM\..\Run: [msgfiltFormat] C:\program files\common files\microsoft shared\filters\formatoffice.exe
O4 - HKLM\..\Run: [systemOffice] C:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe
O4 - HKLM\..\Run: [AcrobatAdobe] c:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe
O4 - HKLM\..\RunServices: [movie[1]] C:\Documents and Settings\ivanka\Local Settings\Temporary Internet Files\Content.IE5\SR5BABRD\movie[1].exe
O4 - HKLM\..\RunServices: [MicrosoftMsoEuro] c:\program files\common files\microsoft shared\euro\systemmsoeuro12.0.4518.1014.exe
O4 - HKLM\..\RunServices: [mshy3gemsth3ge] c:\program files\common files\microsoft shared\proof\mslidmshy3sk.exe
O4 - HKLM\..\RunServices: [GoogleVisual] c:\program files\google\google earth\plugin\googleearthvisual5.2.0.5932.exe
O4 - HKLM\..\RunServices: [NPPDF32Adobe] c:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe
O4 - HKLM\..\RunServices: [Officeosetupui12.0.4518.1014] c:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe
O4 - HKLM\..\RunServices: [msgfiltFilter] C:\program files\common files\microsoft shared\filters\formatoffice.exe
O4 - HKLM\..\RunServices: [osetupuiMicrosoft] C:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe
O4 - HKLM\..\RunServices: [AcrobatNPPDF32] c:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Desktop Security] "C:\Documents and Settings\ivanka\Application Data\Desktop Security\Desktop Security 2010.exe" /STARTUP
O4 - HKCU\..\Run: [SecurityCenter] C:\Documents and Settings\ivanka\Application Data\Desktop Security\securitycenter.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výrezy obrazovky a spuštení aplikace OneNote 2007.lnk
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9036054396
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Služba Google Update (gupdate1c9d417ec219670) (gupdate1c9d417ec219670) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Windows Security Center Service (SvrWsc) - Unknown owner - C:\WINDOWS\system32\svrwsc.exe

--
End of file - 7961 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\gsvqbjxjk.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL [2007-03-30 722472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-10 77824]
"snp2std"=C:\WINDOWS\vsnp2std.exe [2006-09-15 675840]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"MessageMicrosoft"=c:\program files\common files\microsoft shared\filters\formatoffice.exe [2010-09-29 165376]
"msgfiltFormat"=C:\program files\common files\microsoft shared\filters\formatoffice.exe [2010-09-29 165376]
"systemOffice"=C:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe [2010-09-29 165376]
"AcrobatAdobe"=c:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe [2010-09-29 165376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"OM_Monitor"=C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart []
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584]
"Desktop Security"=C:\Documents and Settings\ivanka\Application Data\Desktop Security\Desktop Security 2010.exe [2010-09-28 1609728]
"SecurityCenter"=C:\Documents and Settings\ivanka\Application Data\Desktop Security\securitycenter.exe [2010-09-28 286208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced Virus Remover]
C:\Program Files\AdvancedVirusRemover\AVR.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\df61j1uwcck5]
C:\Documents and Settings\ivanka\Local Settings\Temp\m.2D.tmp.exe [2010-09-29 2747392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\movie[1]]
C:\Documents and Settings\ivanka\Local Settings\Temporary Internet Files\Content.IE5\SR5BABRD\movie[1].exe [2010-09-29 165376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Documents and Settings\ivanka\Desktop\Winamp\winampa.exe [2009-07-01 37888]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe

C:\Documents and Settings\ivanka\Start Menu\Programs\Startup
Výrezy obrazovky a spuštení aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSetActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoSetActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\TeamViewer\Version4\TeamViewer.exe"="C:\Program Files\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\DOCUME~1\ivanka\LOCALS~1\Temp\4_pinnew.exe"="C:\DOCUME~1\ivanka\LOCALS~1\Temp\4_pinnew.exe:*:Enabled:Enabled"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-10-03 17:11:27 ----D---- C:\Program Files\trend micro
2010-10-03 17:11:24 ----D---- C:\rsit
2010-10-03 16:33:52 ----D---- C:\Documents and Settings\ivanka\Application Data\Malwarebytes
2010-10-03 16:33:36 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-03 16:33:31 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-10-03 16:33:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-03 16:33:30 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-09-29 07:09:32 ----D---- C:\Documents and Settings\ivanka\Application Data\Desktop Security
2010-09-24 12:15:54 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 months======

2010-10-03 17:11:27 ----D---- C:\Program Files
2010-10-03 17:11:09 ----D---- C:\WINDOWS\Prefetch
2010-10-03 17:04:45 ----D---- C:\Program Files\Mozilla Firefox
2010-10-03 17:01:31 ----D---- C:\WINDOWS\Temp
2010-10-03 17:00:50 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-03 16:58:47 ----D---- C:\WINDOWS\system32\drivers
2010-10-03 16:58:20 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-03 16:57:17 ----D---- C:\WINDOWS
2010-10-03 16:57:08 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-10-03 16:53:15 ----D---- C:\WINDOWS\system32
2010-10-03 16:27:09 ----SH---- C:\boot.ini
2010-10-03 16:27:09 ----A---- C:\WINDOWS\win.ini
2010-10-03 16:27:09 ----A---- C:\WINDOWS\System.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-04-06 20747]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-23 5888]
R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-03-08 255232]
R3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD); C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-04-09 12039552]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\ac97via.sys [2004-08-04 84480]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 FreshIO;FreshIO; \??\C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 trid3d;trid3d; C:\WINDOWS\system32\DRIVERS\trid3dm.sys [2001-08-17 222336]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 gupdate1c9d417ec219670;Služba Google Update (gupdate1c9d417ec219670); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-09 136176]
S2 SvrWsc;Windows Security Center Service; C:\WINDOWS\system32\svrwsc.exe [2004-08-04 385024]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

[Rudy]

Vir máte zcela jistě. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[milan76]

Dakujem za Vas venovany cas,
po scenovani combofixom restartlo PC a okno desctop security 2010 uz nenaskocilo, prikladam log s combofixu.



ComboFix 10-10-02.02 - ivanka . 10. 2010 17:31:37.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.69 [GMT 2:00]
Running from: c:\documents and settings\ivanka\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ivanka\Application Data\ACD Systems\ACDSee\ImageDB.ddf
c:\documents and settings\ivanka\Application Data\BTManager
c:\documents and settings\ivanka\Application Data\BTManager\downloads\ManFuckADog.wmv.rar
c:\documents and settings\ivanka\Application Data\BTManager\pumpa.state
c:\documents and settings\ivanka\Application Data\Desktop Security
c:\documents and settings\ivanka\Application Data\Desktop Security\Desktop Security 2010.exe
c:\documents and settings\ivanka\Application Data\Desktop Security\securitycenter.exe
c:\documents and settings\ivanka\Application Data\Desktop Security\securityhelper.exe
c:\documents and settings\ivanka\Application Data\Desktop Security\taskmgr.dll
c:\documents and settings\ivanka\Application Data\MSA
c:\documents and settings\ivanka\Local Settings\Temporary Internet Files\Content.IE5\SR5BABRD\movie[1].exe
c:\documents and settings\ivanka\Start Menu\Advanced Virus Remover.lnk
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security.lnk
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security\Activate Desktop Security.lnk
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security\Desktop Security.lnk
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security\Help Desktop Security.lnk
c:\documents and settings\ivanka\Start Menu\Programs\Desktop Security\How to Activate Desktop Security.lnk
c:\program files\Adobe\Acrobat 6.0\Reader\Browser\AdobeNPPDF32.exe
c:\program files\Common Files\Microsoft Shared\EURO\systemMsoEuro12.0.4518.1014.exe
c:\program files\Common Files\Microsoft Shared\Filters\FormatOffice.exe
c:\program files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\Office.cs-cz\osetupuisystem.exe
c:\program files\Common Files\Microsoft Shared\PROOF\mslidMSHY3SK.exe
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\windows\10064spambo5zd9.cpl
c:\windows\10535hacktzol5cf9.bin
c:\windows\1057659t-a-viruzac.dll
c:\windows\10bz5kdoor990.bin
c:\windows\117645ack9ool5f3z.ocx
c:\windows\1195zv9rus675.cpl
c:\windows\1231zs9y945.exe
c:\windows\12358not-a9vzrus2c15.dll
c:\windows\12826t5o96dz.bin
c:\windows\131095zrm2ac.bin
c:\windows\1340th9zf16925.exe
c:\windows\13668hack5ool296z.bin
c:\windows\137dbaczdo9r27575.exe
c:\windows\13892not5a9virus6z.bin
c:\windows\13935virus6z0.ocx
c:\windows\13c6zh95f1515.cpl
c:\windows\142745zrm7859.ocx
c:\windows\14305t9oj66z.cpl
c:\windows\14785spazbot1be9.bin
c:\windows\14885zpa5bot339.cpl
c:\windows\150z9not-a-vir5s798.dll
c:\windows\15486worm192z.dll
c:\windows\155dvirz915.cpl
c:\windows\15659hz9ktool320.bin
c:\windows\15676v9rus55z.bin
c:\windows\15701not-a-viruz539.exe
c:\windows\157zsteal20489.cpl
c:\windows\1593backdzor1998.exe
c:\windows\15989vir596bz.exe
c:\windows\167409paz5ot793.cpl
c:\windows\16833not-a-vir5s19z.dll
c:\windows\170459roj524z.ocx
c:\windows\17112ziru965.dll
c:\windows\17398w5rm591z.cpl
c:\windows\17595pywarz378.ocx
c:\windows\17e65hrea92z289.cpl
c:\windows\18204s9zmb5t78a.cpl
c:\windows\184589pz40b.dll
c:\windows\18489h5cktzo97c.bin
c:\windows\186zsp5984.ocx
c:\windows\18a4addw5rz2399.dll
c:\windows\18bdz9eal5929.cpl
c:\windows\19008tro5za9.dll
c:\windows\190z059rus2a7.exe
c:\windows\19130zirus485.dll
c:\windows\19135virzs5e59.dll
c:\windows\19461virus5z55.bin
c:\windows\1953backdo591360z.ocx
c:\windows\1956backdzor2041.ocx
c:\windows\19654hackt9ol11z.dll
c:\windows\19859v5ru9262z.ocx
c:\windows\1998zhr5at26035.cpl
c:\windows\19z9sparse11579.cpl
c:\windows\1a25tealz2009.ocx
c:\windows\1b78tz9ef752.cpl
c:\windows\1c79stea9z457.exe
c:\windows\1c95a5dwar971z.exe
c:\windows\1d59backdooz733.dll
c:\windows\1f93thiefz959.ocx
c:\windows\1z270tro9755.exe
c:\windows\1z2955acktool6b7.cpl
c:\windows\1z59threat6109.dll
c:\windows\1z6085irus2b09.bin
c:\windows\20098n5z-a-virus777.ocx
c:\windows\20545ha5ztoo918e.bin
c:\windows\20975sz9275.exe
c:\windows\21099viruz2e5.exe
c:\windows\22584not-a-vzrus79b.ocx
c:\windows\22755i9uz2b2.cpl
c:\windows\229fsparse5712z.bin
c:\windows\23015no9-azvirus35a.cpl
c:\windows\23460s9zmb5t53b.bin
c:\windows\235zt5o9451.bin
c:\windows\236c95zeat15677.cpl
c:\windows\23798spz5999.bin
c:\windows\2384ba5kdoorz199.ocx
c:\windows\23z97s5y43d9.exe
c:\windows\23z9threat5514.bin
c:\windows\24365worz3d99.bin
c:\windows\24570vi9uz5d6.dll
c:\windows\248z8spamb9t454.bin
c:\windows\249fthi5z2439.exe
c:\windows\249s5ywaze225.exe
c:\windows\24z92t5oj653.cpl
c:\windows\25187wormz91.cpl
c:\windows\259zst95l738.bin
c:\windows\25a9thief45z.cpl
c:\windows\25cbvi932z5.dll
c:\windows\25zthreat29992.bin
c:\windows\26025viz597b8.ocx
c:\windows\26537not-azvirus595.ocx
c:\windows\2658threat9122z.ocx
c:\windows\269719pambot35z.bin
c:\windows\26f0bzckd5or9333.exe
c:\windows\27693sp97z5.ocx
c:\windows\278149zambot159.dll
c:\windows\279759rm3z2.dll
c:\windows\27985zor5439.exe
c:\windows\279aspars95z54.bin
c:\windows\28187hackt9ol5z5.cpl
c:\windows\28245spz9bot779.ocx
c:\windows\2883sp59bot48dz.bin
c:\windows\28894ha5ktoo9z45.cpl
c:\windows\2898sparse99z65.cpl
c:\windows\29180virus1z5.cpl
c:\windows\29286zot5a-virus730.exe
c:\windows\29289zirus945.dll
c:\windows\2929zvirus657.ocx
c:\windows\2958zddw5re809.bin
c:\windows\295905ot-z-virusaa.bin
c:\windows\295asparse2522z.cpl
c:\windows\295not-a-59ruz15.exe
c:\windows\296549iruz147.ocx
c:\windows\29673not-5-viruz500.exe
c:\windows\29856z5t-a-virus219.dll
c:\windows\2995s5arze187.bin
c:\windows\29z38tr5j921.exe
c:\windows\2a04a59warz522.ocx
c:\windows\2a7zs9ywa5e3028.dll
c:\windows\2aac5pywarez3899.cpl
c:\windows\2b7795dwzre1579.ocx
c:\windows\2d9as9yzar52199.cpl
c:\windows\2da0b9czdoor5483.cpl
c:\windows\2dcfs9azse555.exe
c:\windows\2ez7vir3569.dll
c:\windows\2f65addza9e1684.cpl
c:\windows\2fb95zr338.ocx
c:\windows\2z50thr5at87589.exe
c:\windows\2z530spy1d9.ocx
c:\windows\2z55threat151929.ocx
c:\windows\2z598troj4b9.dll
c:\windows\2z59addware63.cpl
c:\windows\2z785s9y2bc.dll
c:\windows\30386tro95z6.ocx
c:\windows\305z0vi9us2a7.cpl
c:\windows\3069259zktool1b3.exe
c:\windows\30705nzt-95virusb6.cpl
c:\windows\30781zot9a-vi5us662.cpl
c:\windows\31229notza-vir5s681.dll
c:\windows\313baddwarez590.ocx
c:\windows\314z9spambot4259.exe
c:\windows\31953v9rz55a8.bin
c:\windows\3222adzware4589.cpl
c:\windows\32490spz56d.cpl
c:\windows\327zs95rse2289.bin
c:\windows\32bf5parse200z9.dll
c:\windows\3395tzreat29299.dll
c:\windows\33d5viz1559.exe
c:\windows\3519stezl1235.exe
c:\windows\3549sparse30z4.cpl
c:\windows\354athr5at925z.cpl
c:\windows\3584spyz795.dll
c:\windows\359evir253z.cpl
c:\windows\35f2sp9wzre2804.exe
c:\windows\3646worm65z9.cpl
c:\windows\372zt9oj6bc5.exe
c:\windows\3796vir51z.dll
c:\windows\3799vir45z.exe
c:\windows\37z3sp9735.dll
c:\windows\384bvz5972.exe
c:\windows\395znot-a-v5rus11e.ocx
c:\windows\396abazkdoor9512.dll
c:\windows\396ebzckdoor1053.ocx
c:\windows\39z15troj1f2.ocx
c:\windows\39z5roj1d39.cpl
c:\windows\39zcs9eal1500.cpl
c:\windows\3a85ad5w9re586z.exe
c:\windows\3c79szars51155.ocx
c:\windows\3d24szyware26529.cpl
c:\windows\3eaado9zload5r3094.dll
c:\windows\3ff49hzef21155.dll
c:\windows\4041no5-azv9rus1fe.cpl
c:\windows\4125vzr3963.ocx
c:\windows\41659zcktool6af.ocx
c:\windows\429ethr5az14664.exe
c:\windows\4319spamb5t34z.cpl
c:\windows\4340not-a-v5ruz9c4.bin
c:\windows\43b4baz9door275.exe
c:\windows\44cabaczd5or2059.exe
c:\windows\44faddw9rez556.cpl
c:\windows\4551spa9bo51z9.dll
c:\windows\45a3s9ealz052.ocx
c:\windows\45a5dow9loader2z50.dll
c:\windows\4608n5tza-virus94.bin
c:\windows\4678adz5are32249.ocx
c:\windows\480wo5m6z59.bin
c:\windows\484dzhie92965.dll
c:\windows\484not-a9zirus625.bin
c:\windows\4944not-a-viru5425z.ocx
c:\windows\49zspyw5re1899.bin
c:\windows\4b7z9hreat351.cpl
c:\windows\4cf5down9oader55z.exe
c:\windows\4d9ds9az5e1129.ocx
c:\windows\4f78t5zef49.dll
c:\windows\4f8fth5eaz9961.bin
c:\windows\4f9faddwa5e3z18.ocx
c:\windows\503eszarse24859.exe
c:\windows\5065downloader2z95.bin
c:\windows\5099zhief2253.ocx
c:\windows\51058w9zm71f.bin
c:\windows\51z7sparse28189.ocx
c:\windows\52917zpy1689.bin
c:\windows\52d1d9wnloa5erz319.bin
c:\windows\52d8vir59z.exe
c:\windows\5300zhr5a99726.bin
c:\windows\5344haczt9o57fa.cpl
c:\windows\536azdwar59517.exe
c:\windows\5375w9rz18.exe
c:\windows\54649ot-a-virzs2dc.bin
c:\windows\5505spyza9.dll
c:\windows\5508a9dwarz3120.bin
c:\windows\55098t9oj7zb.cpl
c:\windows\5531s9ywaze.cpl
c:\windows\55b5bac9door1452z.bin
c:\windows\55z15worm591.dll
c:\windows\55z9spy9a5e2628.ocx
c:\windows\55zs9y69d.cpl
c:\windows\5624stea51z149.dll
c:\windows\56792not-a-vizus479.cpl
c:\windows\57079wzrm5e9.dll
c:\windows\57891zorm5a.dll
c:\windows\57z5spy937.exe
c:\windows\583aaddwzre529.ocx
c:\windows\58458v9zus546.dll
c:\windows\58b5thz9f2011.ocx
c:\windows\59089rzj5b9.ocx
c:\windows\5910downloadz92570.dll
c:\windows\5932zi94705.bin
c:\windows\595zvir2694.ocx
c:\windows\5962viz2531.dll
c:\windows\598cdzwn5oade91306.exe
c:\windows\59bcba5kdzor1895.cpl
c:\windows\59cbzir581.bin
c:\windows\59ddsz5w9re2935.bin
c:\windows\59e2downloader1z51.dll
c:\windows\59z0s5y35b.ocx
c:\windows\59z0s9ambo5787.dll
c:\windows\59z3downl9ad5r89.ocx
c:\windows\59z5py209.exe
c:\windows\5a9b5pyware3169z.bin
c:\windows\5a9bvzr5584.ocx
c:\windows\5addthi952z08.dll
c:\windows\5b50bac9dooz3196.bin
c:\windows\5b56steal1z69.cpl
c:\windows\5b85sp9ware2882z.cpl
c:\windows\5c15stzal1269.dll
c:\windows\5c4caddware191z.dll
c:\windows\5cfdsteal3z59.ocx
c:\windows\5e32backdo5r109z.cpl
c:\windows\5fdd5zwnloader399.ocx
c:\windows\5z28spyware9552.bin
c:\windows\5z59virus754.cpl
c:\windows\5z7bth9eat25581.exe
c:\windows\5z8559t-a-virus4ef.bin
c:\windows\5z977hacktool494.exe
c:\windows\5za6backdoor1902.ocx
c:\windows\5zb5thief5595.dll
c:\windows\6128th5ef15z79.dll
c:\windows\61zbspyware599.cpl
c:\windows\63ac9h5zf1765.cpl
c:\windows\64a8do9nloader15z4.ocx
c:\windows\6591ad9wa5e2z71.bin
c:\windows\6599threatz7248.exe
c:\windows\659spa5se92z8.ocx
c:\windows\659ztr5j293.ocx
c:\windows\66faddw5r92635z.bin
c:\windows\68455o9m22z.bin
c:\windows\6913zddwar52876.cpl
c:\windows\6996tzi9f3513.ocx
c:\windows\6a04t5reat309z9.dll
c:\windows\6a1795dzare2554.cpl
c:\windows\6ab6stz9l5152.dll
c:\windows\6ba49zief10895.exe
c:\windows\6f3bdownlo5d9rz459.bin
c:\windows\6z22steal1659.dll
c:\windows\6z949hief1957.exe
c:\windows\6z99s9ea552.dll
c:\windows\6za8do9nloader19085.cpl
c:\windows\6zc8threa925897.bin
c:\windows\702zspywa5e969.dll
c:\windows\7068do9nloader2795z.bin
c:\windows\70z9dow5loa9er987.bin
c:\windows\7299vzrus9a5.bin
c:\windows\734zs9yware2155.dll
c:\windows\7429trzj55b5.bin
c:\windows\7458zteal32539.bin
c:\windows\74c5dowzloader9221.ocx
c:\windows\7554backdoo91z9.ocx
c:\windows\7561z5t-a-virus975.exe
c:\windows\75d4thz9f2831.bin
c:\windows\75ddthzeat58879.cpl
c:\windows\7609spar599z.ocx
c:\windows\764ct9reaz54629.dll
c:\windows\7723zorm59a.bin
c:\windows\7864szy5a9e360.dll
c:\windows\792not-z-virus55d.cpl
c:\windows\7949szeal2645.ocx
c:\windows\7950sparsez305.dll
c:\windows\7954zd9ware1192.ocx
c:\windows\7969not-9-5zrus5f5.cpl
c:\windows\7985not-z-virus37e9.cpl
c:\windows\7986n5t-a-vi9zs380.dll
c:\windows\79z9addwa9e1695.exe
c:\windows\7a19sp5wzre1090.bin
c:\windows\7b2ftzreat9451.dll
c:\windows\7d2dback5ozr19769.exe
c:\windows\7d359teal5z6.cpl
c:\windows\7d4czpar5e2959.dll
c:\windows\7e09spyza5e2012.bin
c:\windows\7e59spzrse325.ocx
c:\windows\7e93tzreat1556.bin
c:\windows\7ffzthie93556.ocx
c:\windows\7z7c5a9kdoor2643.exe
c:\windows\7ze6b9ckdoor2354.bin
c:\windows\8049w5zm38.cpl
c:\windows\8399s5y3z2.bin
c:\windows\85zdown95ader2921.ocx
c:\windows\86189ackzool5b5.ocx
c:\windows\8638vir5sz39.dll
c:\windows\897zwo9m55f5.cpl
c:\windows\8b69h5efz96.dll
c:\windows\915hack9zol254.exe
c:\windows\919avir5z53.dll
c:\windows\91cfthr5at21556z.cpl
c:\windows\921fzhreat99935.bin
c:\windows\925cthreaz21548.exe
c:\windows\92dspywar5300z.bin
c:\windows\9305steal1z38.cpl
c:\windows\9335spy26z.cpl
c:\windows\9346w5rm6ez.ocx
c:\windows\949szarse1505.bin
c:\windows\951abackdoz5431.exe
c:\windows\95365wzrm5.cpl
c:\windows\955z7spy6b3.bin
c:\windows\958tro926z.bin
c:\windows\96e5thrzat12315.dll
c:\windows\96z14s5y445.cpl
c:\windows\9853noz9a-virus639.dll
c:\windows\9899azdware5836.exe
c:\windows\98z45tro554b.ocx
c:\windows\9918sp52ze.bin
c:\windows\9933hacktzo5128.bin
c:\windows\9935trzj755.cpl
c:\windows\9947spambot56z.exe
c:\windows\99dsteaz588.cpl
c:\windows\9a45spyzare255.exe
c:\windows\9adzspyware1855.ocx
c:\windows\9d8as5ywarez263.exe
c:\windows\9f5spywaze16969.cpl
c:\windows\9fds5zal2577.cpl
c:\windows\9z15threat271695.exe
c:\windows\9z31troj9415.exe
c:\windows\9z59troj6fb.cpl
c:\windows\9z7945orm204.cpl
c:\windows\abedownlo9der5z91.bin
c:\windows\b1459yware2z84.ocx
c:\windows\b90t5iz91904.bin
c:\windows\bbathre5z4891.dll
c:\windows\d4d5tez9288.cpl
c:\windows\dezadd9are755.bin
c:\windows\df0thizf595.ocx
c:\windows\ec6thizf15699.dll
c:\windows\ff79hizf5010.cpl
c:\windows\fz5add95re72.bin
c:\windows\system32\10539vizus356.cpl
c:\windows\system32\1065859zj5eb.dll
c:\windows\system32\10882not-a-zir5s931.cpl
c:\windows\system32\10958hackto5l3zf.bin
c:\windows\system32\10958hazk9ool3e4.dll
c:\windows\system32\1135s9zmbo5d8.cpl
c:\windows\system32\11478.exe
c:\windows\system32\115z99rojc5.exe
c:\windows\system32\11613sp94z05.dll
c:\windows\system32\11959zckdoor350.bin
c:\windows\system32\121489oz576d.ocx
c:\windows\system32\12499o5mz2b.dll
c:\windows\system32\1251vzr2629.exe
c:\windows\system32\13135spamzo5b9.dll
c:\windows\system32\13259spamb9tz2.exe
c:\windows\system32\1326szywar59522.cpl
c:\windows\system32\13574zir5s369.cpl
c:\windows\system32\135asparsez921.bin
c:\windows\system32\14053zorm3995.dll
c:\windows\system32\14341ha5k9oolz5c.cpl
c:\windows\system32\14cfstzal26905.dll
c:\windows\system32\15095not-z-virus493.ocx
c:\windows\system32\15104hazktoo9255.ocx
c:\windows\system32\15724.exe
c:\windows\system32\15729spy25z.ocx
c:\windows\system32\1593steal26z9.exe
c:\windows\system32\16827.exe
c:\windows\system32\175219pz4695.bin
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\23281.exe
c:\windows\system32\24464.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\29358.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\svrwsc.exe
c:\windows\z0559troj7e3.dll
c:\windows\z1685wor9a4.exe
c:\windows\z2052w9r5292.dll
c:\windows\z325do9nloader239.bin
c:\windows\z393thie95048.cpl
c:\windows\z39faddware1531.cpl
c:\windows\z41139py455.exe
c:\windows\z4est5al9765.ocx
c:\windows\z5106hackto9lc1.ocx
c:\windows\z5259spy35.cpl
c:\windows\z552not9a-virus4cf.exe
c:\windows\z572back9oor1510.cpl
c:\windows\z57599roj15a.cpl
c:\windows\z797w5rm3b49.cpl
c:\windows\z86559r2949.dll
c:\windows\z8f759reat286.ocx
c:\windows\z9588virus122.ocx
c:\windows\z958thief1481.ocx
c:\windows\z96565irus7ec.cpl
c:\windows\z976sparse675.exe
c:\windows\zbeespars5290.bin
c:\windows\zc1fvi5549.bin
c:\windows\zc8addw9re1959.dll
c:\windows\zdthrea919715.exe
c:\windows\zec5steal9557.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SVRWSC
-------\Service_SvrWsc


((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
.

2010-10-03 15:11 . 2010-10-03 15:11 -------- d-----w- c:\program files\trend micro
2010-10-03 15:11 . 2010-10-03 15:11 -------- d-----w- C:\rsit
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\documents and settings\ivanka\Application Data\Malwarebytes
2010-10-03 14:33 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-03 14:33 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-03 15:21 . 2009-05-13 22:12 -------- d-----w- c:\program files\Google
2010-08-19 16:30 . 2009-04-06 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-08-19 16:28 . 2010-08-19 16:28 -------- d-----w- c:\documents and settings\ivanka\Application Data\ACD Systems
2009-10-15 21:49 . 2009-10-15 21:49 68608 --sha-r- c:\windows\system32\Heuhqe.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-10 77824]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-4-6 593920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-07-01 16:37 37888 ----a-w- c:\documents and settings\ivanka\Desktop\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8. 7. 2010 16:55 135336]
S2 gupdate1c9d417ec219670;Služba Google Update (gupdate1c9d417ec219670);c:\program files\Google\Update\GoogleUpdate.exe [9. 5. 2010 13:07 136176]
S3 trid3d;trid3d;c:\windows\system32\drivers\trid3dm.sys [1. 4. 2009 23:44 222336]
.
Contents of the 'Scheduled Tasks' folder

2010-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-09 11:06]

2010-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-09 11:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\ivanka\Application Data\Mozilla\Firefox\Profiles\jdqznaz3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\ivanka\Application Data\Mozilla\Firefox\Profiles\jdqznaz3.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-OM_Monitor - c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe
HKLM-Run-MessageMicrosoft - c:\program files\common files\microsoft shared\filters\formatoffice.exe
HKLM-Run-msgfiltFormat - c:\program files\common files\microsoft shared\filters\formatoffice.exe
HKLM-Run-systemOffice - c:\program files\common files\microsoft shared\office12\office setup controller\office.cs-cz\osetupuisystem.exe
HKLM-Run-AcrobatAdobe - c:\program files\adobe\acrobat 6.0\reader\browser\adobenppdf32.exe
HKLM-Run-googleearthvisual5.2.0.5932 - c:\program files\google\google earth\plugin\googleearthvisual5.2.0.5932.exe
MSConfigStartUp-Advanced Virus Remover - c:\program files\AdvancedVirusRemover\AVR.exe
MSConfigStartUp-df61j1uwcck5 - c:\documents and settings\ivanka\Local Settings\Temp\m.2D.tmp.exe
MSConfigStartUp-movie[1] - c:\documents and settings\ivanka\Local Settings\Temporary Internet Files\Content.IE5\SR5BABRD\movie[1].exe
AddRemove-Your Uninstaller! 2008_is1 - c:\program files\Your Uninstaller 2008\unins000.exe
AddRemove-Desktop Security - c:\documents and settings\ivanka\Application Data\Desktop Security\securityhelper.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-03 17:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3096)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\devldr32.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
.
**************************************************************************
.
Completion time: 2010-10-03 17:57:05 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-03 15:57

Pre-Run: 347 004 928 bytes free
Post-Run: 2 884 186 112 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

- - End Of File - - 82F541FA2E5809010613013B15767E0A

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\Heuhqe.dll

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pustte. CF se spustí a vykoná příkaz ze skriptu.

[milan76]

Doporuceny ukon som vykonal, prikladam log:


ComboFix 10-10-02.02 - ivanka . 10. 2010 18:24:00.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.109 [GMT 2:00]
Running from: c:\documents and settings\ivanka\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ivanka\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\17717sp5mbz9707.dll
c:\windows\system32\1905vir134z.bin
c:\windows\system32\19141w5zm39f.bin
c:\windows\system32\1937vir3158z.cpl
c:\windows\system32\19536troj159z.cpl
c:\windows\system32\19734szya5.bin
c:\windows\system32\19f15ddwzre2677.cpl
c:\windows\system32\1ab4do5zloade9383.dll
c:\windows\system32\1b649zwnloade5494.bin
c:\windows\system32\1b9fs5ywar91994z.bin
c:\windows\system32\1c9downlza5er3056.exe
c:\windows\system32\1e54z9arse79.bin
c:\windows\system32\1not-z5viru9436.dll
c:\windows\system32\1z6215ot-a-vir9s60c.cpl
c:\windows\system32\1z914spambot5185.dll
c:\windows\system32\1z9605ot-a-virus294.bin
c:\windows\system32\200cba9kdoor1z435.dll
c:\windows\system32\206zspar952.cpl
c:\windows\system32\20z75worm5695.ocx
c:\windows\system32\211719irus265z.ocx
c:\windows\system32\21194zacktool35c.bin
c:\windows\system32\213z5worm309.bin
c:\windows\system32\21z06worm5e9.exe
c:\windows\system32\21z59worm29d9.bin
c:\windows\system32\22183wormz659.exe
c:\windows\system32\22254w9r5z58.ocx
c:\windows\system32\22517not-a-vizu9635.cpl
c:\windows\system32\22559z9cktool4ed.dll
c:\windows\system32\22564zpa9botf95.ocx
c:\windows\system32\2258szeal2359.dll
c:\windows\system32\22652n9t-z-vi5us4c8.exe
c:\windows\system32\229085iruz65a.exe
c:\windows\system32\22ezadd95re372.ocx
c:\windows\system32\23049no9-a-virzs352.ocx
c:\windows\system32\23049s5y394z.dll
c:\windows\system32\2395zs9y606.exe
c:\windows\system32\23961ha5ztoo960e.bin
c:\windows\system32\2396sp5z369.ocx
c:\windows\system32\24355h9cktooz9f.dll
c:\windows\system32\2535zh9ef1997.ocx
c:\windows\system32\254829pzmbot6bf.ocx
c:\windows\system32\254zv9r586.ocx
c:\windows\system32\255189ormz3b.ocx
c:\windows\system32\256409roj5za.bin
c:\windows\system32\25993notza-v9rus32e.cpl
c:\windows\system32\26235spyz979.exe
c:\windows\system32\263h5ckto9l302z.bin
c:\windows\system32\2654zspam59t553.ocx
c:\windows\system32\26555trz91b1.ocx
c:\windows\system32\2677not5azvirus998.dll
c:\windows\system32\268v9ruz588.exe
c:\windows\system32\2693spywaze7785.cpl
c:\windows\system32\270z5hief2629.dll
c:\windows\system32\27407spamb5z49b.ocx
c:\windows\system32\27499vzrus645.dll
c:\windows\system32\277z0not5a-virus590.exe
c:\windows\system32\27914spzmbo912f5.ocx
c:\windows\system32\2795baczdoor1732.dll
c:\windows\system32\2795z95us72.cpl
c:\windows\system32\2796zv9rus15b.cpl
c:\windows\system32\2844no9-a-vi5uz460.ocx
c:\windows\system32\28556no9-a-virzs74.bin
c:\windows\system32\2857vir9z462.dll
c:\windows\system32\2871795ambzt454.cpl
c:\windows\system32\28981vi5uz74c.cpl
c:\windows\system32\29045noz-a-vi9us405.cpl
c:\windows\system32\290z5not-a-virus5b5.exe
c:\windows\system32\2920znot-a-virus259.cpl
c:\windows\system32\29285viru5zf9.ocx
c:\windows\system32\293185irus2z8.bin
c:\windows\system32\29398virz56ca.dll
c:\windows\system32\293c9zr57.ocx
c:\windows\system32\29405viru5190z.ocx
c:\windows\system32\295z7w5rm5d5.cpl
c:\windows\system32\29z9wo5m4a7.dll
c:\windows\system32\29zdthr5at25095.cpl
c:\windows\system32\2aa25tzal9773.exe
c:\windows\system32\2acz5te9l2231.bin
c:\windows\system32\2e10down5oad9z2263.exe
c:\windows\system32\2e21spyw5z9368.ocx
c:\windows\system32\2e2dsparze91375.ocx
c:\windows\system32\2e4zba9kdoor7445.cpl
c:\windows\system32\2z695ackdoor2908.dll
c:\windows\system32\2z798virus685.ocx
c:\windows\system32\2z85s9yware32225.ocx
c:\windows\system32\2z899troj357.cpl
c:\windows\system32\2z90s9y159.dll
c:\windows\system32\2z991wor9151.exe
c:\windows\system32\3005sparsz5579.cpl
c:\windows\system32\30938v5rus72z.cpl
c:\windows\system32\30b9tz5e92090.bin
c:\windows\system32\3143ztr5j7e59.cpl
c:\windows\system32\31765wor950z5.cpl
c:\windows\system32\31a9vzr3513.ocx
c:\windows\system32\31zat9reat5923.exe
c:\windows\system32\32735w9zm761.cpl
c:\windows\system32\32845ackzoor2998.exe
c:\windows\system32\32a9b9czdoor2625.ocx
c:\windows\system32\32abv9r1z75.bin
c:\windows\system32\3409spa5se19z4.bin
c:\windows\system32\3433ad5warez019.bin
c:\windows\system32\3475th5ef90z1.cpl
c:\windows\system32\34z3a5dware3927.exe
c:\windows\system32\35426viz9s221.exe
c:\windows\system32\35e1spar9ez928.bin
c:\windows\system32\36f1dowzloa95r2266.dll
c:\windows\system32\3767backdzor9175.exe
c:\windows\system32\3789threat235z.bin
c:\windows\system32\3866ba9zdoor5852.ocx
c:\windows\system32\39109szamb5t50d.dll
c:\windows\system32\3971zspambo5371.cpl
c:\windows\system32\3a285hze91607.cpl
c:\windows\system32\3b90thz5at12750.bin
c:\windows\system32\3b92v5r1287z.exe
c:\windows\system32\3bf65zreat17988.ocx
c:\windows\system32\3c59stezl1605.dll
c:\windows\system32\3c75down5oazer1978.bin
c:\windows\system32\3cd7down9oade5307z.bin
c:\windows\system32\3dz59parse1302.exe
c:\windows\system32\3ffddownl9a5ez556.exe
c:\windows\system32\3z71vi95555.ocx
c:\windows\system32\40725pambot392z.cpl
c:\windows\system32\40729zy45d.ocx
c:\windows\system32\4097troz1955.ocx
c:\windows\system32\40z0t95ef2173.exe
c:\windows\system32\4203a5d9are2z04.dll
c:\windows\system32\429eaddwarz23945.ocx
c:\windows\system32\4359sparse19z.dll
c:\windows\system32\435astea927z3.cpl
c:\windows\system32\44d1azd9are2585.ocx
c:\windows\system32\4500tzoj1269.ocx
c:\windows\system32\4502down9oad5r6z9.cpl
c:\windows\system32\4509zownlo9der825.cpl
c:\windows\system32\450zspy9are2182.cpl
c:\windows\system32\4529pazbot585.ocx
c:\windows\system32\4530spar9z2193.exe
c:\windows\system32\4555t59j63z.bin
c:\windows\system32\455zdow9loader735.bin
c:\windows\system32\4599t59j6z2.cpl
c:\windows\system32\45cz9teal2242.bin
c:\windows\system32\475daddwz9e6385.exe
c:\windows\system32\495fvzr5935.ocx
c:\windows\system32\4975do5nloadzr17599.dll
c:\windows\system32\49ebs5zal92.dll
c:\windows\system32\4a89d9wnlozder2725.bin
c:\windows\system32\4b18za5kd9or2525.dll
c:\windows\system32\4b2e5pars9800z.cpl
c:\windows\system32\4e4aback5oo92918z.exe
c:\windows\system32\4e91doznloader5904.cpl
c:\windows\system32\4f75tz9ef8055.exe
c:\windows\system32\4fz5spa9se1969.ocx
c:\windows\system32\4z19thief2955.ocx
c:\windows\system32\4z99s5y74a.exe
c:\windows\system32\5094viz509.ocx
c:\windows\system32\50ebsparse99z9.dll
c:\windows\system32\50z5sparse50529.cpl
c:\windows\system32\5109sp55bfz.exe
c:\windows\system32\5135vir9s2zd.bin
c:\windows\system32\5192backdoo5z46.exe
c:\windows\system32\51b15te9l24z1.exe
c:\windows\system32\51c3ad9ware16z9.exe
c:\windows\system32\52040not-a-zirus69a.bin
c:\windows\system32\52099teaz5001.exe
c:\windows\system32\5245thr9az16167.bin
c:\windows\system32\5250virusz9f9.ocx
c:\windows\system32\52549trozf4.bin
c:\windows\system32\5470tzoj190.ocx
c:\windows\system32\54853h9cztool744.ocx
c:\windows\system32\550aszars91710.dll
c:\windows\system32\552dspyzar9726.dll
c:\windows\system32\55426szy39c.exe
c:\windows\system32\5592szy20e.bin
c:\windows\system32\55982not-a-viru91z9.dll
c:\windows\system32\559cbackdozr1528.cpl
c:\windows\system32\55b5tzreat207699.exe
c:\windows\system32\55f9threzt94626.cpl
c:\windows\system32\5621z9pambotb7.exe
c:\windows\system32\5655zworm7999.dll
c:\windows\system32\57119s9y5z8.exe
c:\windows\system32\57d9back5ooz2903.exe
c:\windows\system32\57e9thief75z9.cpl
c:\windows\system32\5853addware83z9.bin
c:\windows\system32\5878th5eatz99.exe
c:\windows\system32\58b9zp9rse1965.dll
c:\windows\system32\58z9addware825.ocx
c:\windows\system32\59013szambot359.ocx
c:\windows\system32\5915s5yware2554z.ocx
c:\windows\system32\593zv95us71b.bin
c:\windows\system32\5965n9t-a-virus23dz.cpl
c:\windows\system32\5965spyza9e2638.bin
c:\windows\system32\597cstzal951.dll
c:\windows\system32\5989z59m2b5.exe
c:\windows\system32\599znot-a-virus724.cpl
c:\windows\system32\59a95wnloazer2709.cpl
c:\windows\system32\59fspyw5rez93.bin
c:\windows\system32\5a409hz5f2490.dll
c:\windows\system32\5a95azdwar51288.ocx
c:\windows\system32\5acfbackdo5z32749.cpl
c:\windows\system32\5b48zh9ef5448.dll
c:\windows\system32\5b4stzal32279.cpl
c:\windows\system32\5b51bzckdo5r999.cpl
c:\windows\system32\5b57sparz92925.dll
c:\windows\system32\5b99thzeat5939.ocx
c:\windows\system32\5ba1za9kdoor2293.cpl
c:\windows\system32\5d0d9pazse1372.exe
c:\windows\system32\5d2caddw9rez208.ocx
c:\windows\system32\5e0spzrse995.cpl
c:\windows\system32\5e39thie52z69.dll
c:\windows\system32\5edabazk59or1113.dll
c:\windows\system32\5f09ad9zare2852.exe
c:\windows\system32\5f71downzoade92643.bin
c:\windows\system32\5f99az9ware5282.bin
c:\windows\system32\5zbaaddware9377.bin
c:\windows\system32\612avz51299.cpl
c:\windows\system32\6150vzrus6b69.dll
c:\windows\system32\621dz5ief28869.ocx
c:\windows\system32\6393thr9az57528.ocx
c:\windows\system32\64ze9h5eat29113.cpl
c:\windows\system32\6509spywarz549.exe
c:\windows\system32\65b0a9dware255z.exe
c:\windows\system32\65bbsparsz619.exe
c:\windows\system32\65cab9ckdoor28z9.exe
c:\windows\system32\6792vir3z50.exe
c:\windows\system32\6853zot-a-9irus4bd.exe
c:\windows\system32\6899ste5l2399z.cpl
c:\windows\system32\68d45azk9oor798.exe
c:\windows\system32\6955thief5z72.exe
c:\windows\system32\69zfs5eal1894.cpl
c:\windows\system32\6e0bszywar59690.cpl
c:\windows\system32\6z185ackd9or2584.exe
c:\windows\system32\6z2c9ir5951.ocx
c:\windows\system32\6z525ir9s56c.ocx
c:\windows\system32\71609pambotzc5.ocx
c:\windows\system32\7193not-9-5irusz7c.cpl
c:\windows\system32\723cbz9kdo5r756.dll
c:\windows\system32\7359iruz237.ocx
c:\windows\system32\7485wz5m3c9.ocx
c:\windows\system32\7546hacztool794.dll
c:\windows\system32\765fzhreat66909.dll
c:\windows\system32\775a9hzeat11352.ocx
c:\windows\system32\79z9spars53164.dll
c:\windows\system32\7a25addware93z9.cpl
c:\windows\system32\7a91addwaze2555.cpl
c:\windows\system32\7aethrza931585.bin
c:\windows\system32\7c99downlozder855.bin
c:\windows\system32\7cb95hreatz167.bin
c:\windows\system32\7d93threa5164z4.exe
c:\windows\system32\7d9zspyware19955.bin
c:\windows\system32\7e1zsp5ware3269.exe
c:\windows\system32\7f8zsteal2695.bin
c:\windows\system32\7z33thief29235.ocx
c:\windows\system32\7z465ir9s714.cpl
c:\windows\system32\7zbddownl9ade52641.dll
c:\windows\system32\81249o5za3.bin
c:\windows\system32\8186zpam9ot35f.bin
c:\windows\system32\84715orm4c9z.bin
c:\windows\system32\856spy689z.ocx
c:\windows\system32\8850szy915.ocx
c:\windows\system32\8afdown9oad5rz65.bin
c:\windows\system32\8z34not5a-viru9556.ocx
c:\windows\system32\90166virzs359.bin
c:\windows\system32\9073addw5re183z.dll
c:\windows\system32\908ztroj56.dll
c:\windows\system32\90dz5hreat30342.exe
c:\windows\system32\91328not-a-viru5619z.ocx
c:\windows\system32\919stz5l1409.bin
c:\windows\system32\929cb5ckdoor2387z.bin
c:\windows\system32\935vir941z.ocx
c:\windows\system32\936cbackdoo5z705.cpl
c:\windows\system32\9385b5ckdzor2134.dll
c:\windows\system32\94392hacktozl5f0.ocx
c:\windows\system32\9455thr5at31161z.bin
c:\windows\system32\94713viru5z99.dll
c:\windows\system32\94d5dzware1193.exe
c:\windows\system32\9501z9y4e4.bin
c:\windows\system32\9559z5rm77c.cpl
c:\windows\system32\956thief1188z.exe
c:\windows\system32\9572not-a-95rus4z2.cpl
c:\windows\system32\958spywzr92142.cpl
c:\windows\system32\9593hazktool245.cpl
c:\windows\system32\95a3viz741.bin
c:\windows\system32\9650tzoj790.bin
c:\windows\system32\97255acktooz71b.dll
c:\windows\system32\979estzal5760.cpl
c:\windows\system32\97zspy551.bin
c:\windows\system32\9865vi9uz117.bin
c:\windows\system32\9985troz3985.bin
c:\windows\system32\9999addwaze13125.ocx
c:\windows\system32\9b155parsez73.ocx
c:\windows\system32\9bb4threat15504z.dll
c:\windows\system32\9bes5yware2z39.cpl
c:\windows\system32\9c50sparse3087z.bin
c:\windows\system32\9d59zpar5e525.exe
c:\windows\system32\9d95addware90z.dll
c:\windows\system32\9e5b9ckdozr2535.exe
c:\windows\system32\9z555hacktool2a5.exe
c:\windows\system32\a95thiez2025.exe
c:\windows\system32\b5zvir15969.ocx
c:\windows\system32\bb9addwa5e98z.dll
c:\windows\system32\c19vz5769.exe
c:\windows\system32\c63add5ar92476z.ocx
c:\windows\system32\defstea9z95.cpl
c:\windows\system32\fb59ir191z.exe
c:\windows\system32\z0067wor59c5.dll
c:\windows\system32\z049wor5af.dll
c:\windows\system32\z10785or946.ocx
c:\windows\system32\z1552vir9s5be.ocx
c:\windows\system32\z3933not-a-viru527a.dll
c:\windows\system32\z4264not-a-vi9us355.exe
c:\windows\system32\z48s5eal26309.dll
c:\windows\system32\z506steal2598.cpl
c:\windows\system32\z51159o5m7e9.exe
c:\windows\system32\z539spyware2490.cpl
c:\windows\system32\z53f5pyware9114.bin
c:\windows\system32\z5955s5a9bot70c.cpl
c:\windows\system32\z595spyware1970.cpl
c:\windows\system32\z7339no5-a-virus49c.ocx
c:\windows\system32\z7869hac5tool62a.ocx
c:\windows\system32\z9725hr9at32584.cpl
c:\windows\system32\z980steal10935.bin
c:\windows\system32\z9955vi5us59b.cpl
c:\windows\system32\z9970t5oj194.exe
c:\windows\system32\z99b9ir17315.cpl
c:\windows\system32\z9a8addwa9e750.cpl
c:\windows\system32\za5a9dware3245.exe
c:\windows\system32\za75bac9doo51852.bin
c:\windows\system32\zb76thief22759.exe
c:\windows\system32\zbb7t9reat10256.cpl
c:\windows\system32\zcc5spars9315.bin
c:\windows\system32\zd6daddw5re23189.dll
c:\windows\system32\zde1spy9are14165.ocx
c:\windows\system32\ze925i91094.exe

.
((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
.

2010-10-03 15:11 . 2010-10-03 15:11 -------- d-----w- c:\program files\trend micro
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\documents and settings\ivanka\Application Data\Malwarebytes
2010-10-03 14:33 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-03 14:33 . 2010-10-03 14:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-03 14:33 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-03 15:21 . 2009-05-13 22:12 -------- d-----w- c:\program files\Google
2010-08-19 16:30 . 2009-04-06 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-08-19 16:28 . 2010-08-19 16:28 -------- d-----w- c:\documents and settings\ivanka\Application Data\ACD Systems
2009-10-15 21:49 . 2009-10-15 21:49 68608 --sha-r- c:\windows\system32\Heuhqe.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-10 77824]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-4-6 593920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-07-01 16:37 37888 ----a-w- c:\documents and settings\ivanka\Desktop\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8. 7. 2010 16:55 135336]
S2 gupdate1c9d417ec219670;Služba Google Update (gupdate1c9d417ec219670);c:\program files\Google\Update\GoogleUpdate.exe [9. 5. 2010 13:07 136176]
S3 trid3d;trid3d;c:\windows\system32\drivers\trid3dm.sys [1. 4. 2009 23:44 222336]
.
Contents of the 'Scheduled Tasks' folder

2010-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-09 11:06]

2010-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-09 11:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\ivanka\Application Data\Mozilla\Firefox\Profiles\jdqznaz3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\ivanka\Application Data\Mozilla\Firefox\Profiles\jdqznaz3.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-03 18:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
@DACL=(02 0000)
.
Completion time: 2010-10-03 18:38:38
ComboFix-quarantined-files.txt 2010-10-03 16:38

Pre-Run: 2 893 742 080 bytes free
Post-Run: 2 878 111 744 bytes free

- - End Of File - - 01B3A8BEE1F552B1D58A43D4BF21AA18

[Rudy]

Zůstalo to tam. Zkuste to ještě jednou, ale v nouz. režimu.