po spuštení windows hlasky o nenalezeni dll knihoven

[Liner]

Zdravim.
po vyčišteni počitace od viru s dalsi haveti, se mi po spušteni windows objevuji dve hlášky o nenalezeni knihen clswdis.dll a pschmdrf.dll.
Vypadá to na pozustatek od viru, zkoušel sem vypnout všechny položky po s pušteni v msconfig a nepomohlo to.
Předem diky za pomoc:)

log z RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Michaela Šteffelová at 2010-11-14 09:07:51
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 123 GB (81%) free of 153 GB
Total RAM: 1015 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:08:06, on 14.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HPBTWD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Michaela Šteffelová\Plocha\RSIT.exe
C:\Program Files\trend micro\Michaela Šteffelová.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP BTW Detect Program] C:\Program Files\HP\HPBTWD.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

--
End of file - 8768 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
C:\WINDOWS\tasks\RMSchedule.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-06-02 1018616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-07-23 498744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-01-16 1418536]
"HP BTW Detect Program"=C:\Program Files\HP\HPBTWD.exe [2009-03-30 319488]
"AESTFltr"=C:\WINDOWS\system32\AESTFltr.exe [2009-07-06 737280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe [2008-02-15 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2008-02-15 135168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe [2008-02-15 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-11-13 3037696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
C:\Program Files\IDT\WDM\sttray.exe [2009-06-29 458844]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\rodina\Plocha\TmNationsForever\TmForever.exe"="C:\Documents and Settings\rodina\Plocha\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-11-13 19:42:52 ----A---- C:\WINDOWS\system32\CleanMFT32.exe
2010-11-13 19:42:44 ----D---- C:\Program Files\Common Files\PC Tools
2010-11-13 19:42:43 ----D---- C:\Program Files\Registry Mechanic
2010-11-13 19:36:34 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:35:03 ----A---- C:\WINDOWS\system32\DfSdkBt.exe
2010-11-13 18:34:48 ----D---- C:\Program Files\Ashampoo
2010-11-13 18:14:27 ----ASH---- C:\pagefile.sys
2010-11-13 16:35:09 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2010-11-13 16:35:08 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 16:35:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 16:35:03 ----D---- C:\Program Files\Spyware Terminator
2010-11-13 16:33:38 ----D---- C:\Program Files\CCleaner
2010-11-13 14:50:51 ----D---- C:\Program Files\trend micro
2010-11-13 14:50:50 ----D---- C:\rsit
2010-11-13 14:30:58 ----SHD---- C:\RECYCLER
2010-11-13 14:27:43 ----A---- C:\ComboFix.txt
2010-11-13 14:24:13 ----A---- C:\WINDOWS\system.ini
2010-11-13 13:57:21 ----A---- C:\Boot.bak
2010-11-13 13:57:15 ----RASHD---- C:\cmdcons
2010-11-13 13:48:12 ----A---- C:\WINDOWS\zip.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\SWSC.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\SWREG.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\sed.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\PEV.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\NIRCMD.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\MBR.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\grep.exe
2010-11-13 13:48:11 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-11-13 13:02:43 ----D---- C:\Program Files\TrendMicro
2010-11-13 12:54:57 ----D---- C:\WINDOWS\ERDNT
2010-11-13 12:49:34 ----D---- C:\Qoobox
2010-11-13 11:48:22 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 11:47:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:35:09 ----D---- C:\Program Files\ESET
2010-11-12 17:31:19 ----ASH---- C:\hiberfil.sys
2010-11-07 19:00:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\TrackMania
2010-11-06 09:11:44 ----D---- C:\Program Files\Common Files\Adobe
2010-11-06 09:11:44 ----D---- C:\Program Files\Adobe
2010-11-06 09:04:04 ----A---- C:\WINDOWS\win.ini
2010-11-06 08:56:48 ----D---- C:\WINDOWS\pss
2010-11-05 23:51:46 ----D---- C:\WINDOWS\Downloaded Program Files
2010-11-05 23:39:51 ----D---- C:\WINDOWS\Registration
2010-11-05 23:23:09 ----A---- C:\WINDOWS\vmmreg32.dll
2010-11-05 23:23:09 ----A---- C:\WINDOWS\twunk_32.exe
2010-11-05 23:23:08 ----A---- C:\WINDOWS\twunk_16.exe
2010-11-05 23:23:08 ----A---- C:\WINDOWS\twain.dll
2010-11-05 23:23:07 ----A---- C:\WINDOWS\taskman.exe
2010-11-05 23:23:07 ----A---- C:\WINDOWS\notepad.exe
2010-11-05 23:23:06 ----A---- C:\WINDOWS\twain_32.dll
2010-11-05 23:22:29 ----A---- C:\WINDOWS\winhlp32.exe
2010-11-05 23:22:27 ----A---- C:\WINDOWS\hh.exe
2010-11-05 21:29:31 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\SMIIPVUE
2010-11-05 21:28:40 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\45e034
2010-11-05 19:41:11 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 19:39:10 ----A---- C:\WINDOWS\system32\wdisrvac.exe
2010-11-05 13:59:39 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-10-23 15:51:16 ----D---- C:\Program Files\Games
2010-10-18 15:02:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2279986$
2010-10-18 15:02:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2345886$
2010-10-18 15:01:55 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2010-10-18 15:01:26 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2010-10-18 15:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB981957$
2010-10-16 19:03:53 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 16:49:51 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2010-10-16 16:40:06 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 16:19:02 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 08:37:13 ----D---- C:\Program Files\Restaurace U Amálky

======List of files/folders modified in the last 1 months======

2010-11-14 09:07:58 ----D---- C:\WINDOWS\Prefetch
2010-11-14 09:02:41 ----D---- C:\WINDOWS\temp
2010-11-14 09:01:28 ----A---- C:\Documents and Settings\All Users\Data aplikací\HPWALog.txt
2010-11-14 09:01:22 ----SD---- C:\WINDOWS\Tasks
2010-11-13 20:59:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-13 20:21:59 ----SHD---- C:\WINDOWS\Installer
2010-11-13 20:21:58 ----RD---- C:\Program Files\Skype
2010-11-13 19:50:20 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-11-13 19:49:47 ----SD---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Microsoft
2010-11-13 19:42:52 ----D---- C:\WINDOWS\system32
2010-11-13 19:42:44 ----D---- C:\Program Files\Common Files
2010-11-13 19:42:43 ----RD---- C:\Program Files
2010-11-13 19:41:55 ----RASH---- C:\boot.ini
2010-11-13 19:30:31 ----D---- C:\WINDOWS\system32\config
2010-11-13 18:51:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-11-13 17:48:27 ----SHD---- C:\System Volume Information
2010-11-13 17:48:27 ----D---- C:\WINDOWS\system32\Restore
2010-11-13 17:04:26 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-13 16:41:24 ----D---- C:\WINDOWS
2010-11-13 16:35:09 ----D---- C:\WINDOWS\system32\drivers
2010-11-13 14:39:48 ----D---- C:\WINDOWS\system32\drivers\etc
2010-11-13 14:30:58 ----D---- C:\WINDOWS\Debug
2010-11-13 14:08:40 ----D---- C:\WINDOWS\AppPatch
2010-11-13 12:57:24 ----D---- C:\WINDOWS\Network Diagnostic
2010-11-13 12:51:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2010-11-13 12:35:39 ----HD---- C:\WINDOWS\inf
2010-11-13 12:26:45 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$
2010-11-12 17:23:00 ----D---- C:\Documents and Settings
2010-11-12 17:21:57 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\uTorrent
2010-11-12 17:21:57 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Skype
2010-11-09 17:16:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-06 20:09:22 ----D---- C:\WINDOWS\SoftwareDistribution
2010-11-06 16:18:45 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\ICQ
2010-11-06 09:18:49 ----D---- C:\Program Files\Windows Media Connect 2
2010-11-06 09:12:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-11-05 21:05:33 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\skypePM
2010-11-03 20:34:13 ----D---- C:\Program Files\ICQ7.2
2010-10-23 00:07:43 ----D---- C:\Program Files\HP Games
2010-10-18 15:12:25 ----A---- C:\WINDOWS\system32\MRT.exe
2010-10-18 15:02:45 ----RSHD---- C:\WINDOWS\system32\dllcache
2010-10-16 16:58:46 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\System32\DRIVERS\iaStor.sys [2009-06-05 330264]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-05-20 45200]
R0 SahdIa32;HDD Filter Driver; C:\WINDOWS\System32\Drivers\SahdIa32.sys [2009-06-02 21488]
R0 SaibIa32;Volume Filter Driver; C:\WINDOWS\System32\Drivers\SaibIa32.sys [2009-06-02 15856]
R0 SysCow;SysCow; C:\WINDOWS\system32\drivers\syscow32x.sys [2009-07-01 103792]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-15 40192]
R1 SaibVd32;Virtual Disk Driver; C:\WINDOWS\System32\Drivers\SaibVd32.sys [2009-06-02 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2009-04-21 113664]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2009-06-02 1746432]
R3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2009-05-07 37160]
R3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2009-05-07 992424]
R3 Cam3820;Cam3820 PC Camera Driver; C:\WINDOWS\System32\Drivers\cam3820a.sys [2009-06-18 308608]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-15 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-03-31 39424]
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-06-29 1642931]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-01-16 206512]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2009-06-19 533024]
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2009-05-07 156816]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2009-05-07 47272]
S3 catchme;catchme; \??\C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-15 40320]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys [2008-11-22 160256]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
S3 Rts516xIR;Realtek IR Driver; C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBCCID;Realtek Smartcard Reader Driver; C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
S4 agpCPQ;Filtr Compaq sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]
S4 alim1541;Filtr ALI sběrnice AGP; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]
S4 amdagp;Ovladač filtru AMD portu AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]
S4 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-02 436792]
S4 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service; C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
R2 BOTService;BOTService; C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2009-05-05 349528]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-09 153376]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-08-05 583640]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-11-13 488960]
R2 STacSV;Audio Service; c:\program files\idt\wdm\STacSV.exe [2009-06-29 221266]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 PASW;Process Activation Service; C:\WINDOWS\system32\psactive.exe [2006-08-01 5120]
S2 WdiSrvHost;Wdi Service Host; C:\WINDOWS\system32\wdisrvac.exe [2006-07-11 5120]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe [2009-08-24 406016]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe [2010-06-19 246520]
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Hezké dopoledne
Kdopak Vám poradil combofix?
Poprosím o tento log
C:\ComboFix.txt

[Liner]

combofix mi občas pomuze,tak ho obcas taky zkusim:)

log combofix:

ComboFix 10-11-12.06 - Michaela Šteffelová 14.11.2010 10:47:41.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.680 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-14 do 2010-11-14 )))))))))))))))))))))))))))))))
.

2010-11-14 09:15 . 2010-11-14 09:14 390144 ----a-w- c:\windows\system32\CF31741.exe
2010-11-13 18:42 . 2010-08-05 07:46 37336 ----a-w- c:\windows\system32\CleanMFT32.exe
2010-11-13 18:42 . 2008-04-02 14:54 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2010-11-13 18:42 . 2008-04-02 14:53 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2010-11-13 18:42 . 2008-04-02 14:53 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2010-11-13 18:42 . 2008-09-17 20:17 658432 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2010-11-13 18:42 . 2010-11-13 18:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-11-13 18:36 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:19 . 2004-03-08 23:00 1081616 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-11-13 17:35 . 2009-08-24 21:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-11-13 17:34 . 2010-11-13 17:34 -------- d-----w- c:\program files\Ashampoo
2010-11-13 15:35 . 2010-11-13 15:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-11-13 15:35 . 2010-11-13 15:36 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-13 15:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-13 15:35 -------- d-----w- c:\program files\Spyware Terminator
2010-11-13 15:33 . 2010-11-13 15:33 -------- d-----w- c:\program files\CCleaner
2010-11-13 13:50 . 2010-11-14 08:07 -------- d-----w- c:\program files\trend micro
2010-11-13 13:50 . 2010-11-13 13:51 -------- d-----w- C:\rsit
2010-11-13 12:02 . 2010-11-13 12:02 388096 ----a-r- c:\documents and settings\Michaela Šteffelová\Data aplikací\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-11-13 12:02 . 2010-11-13 12:02 -------- d-----w- c:\program files\TrendMicro
2010-11-13 10:48 . 2010-11-13 10:48 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 10:47 . 2010-11-13 10:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:18 . 2010-11-13 09:18 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Local Settings\Data aplikací\ESET
2010-11-13 08:35 . 2010-11-13 08:35 -------- d-----w- c:\program files\ESET
2010-11-12 16:23 . 2010-11-13 18:30 -------- d-----w- c:\documents and settings\Administrator.YOUR-210CB98EE3
2010-11-07 18:00 . 2010-11-09 14:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TrackMania
2010-11-06 08:11 . 2010-11-06 08:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-11-05 22:51 . 2010-11-05 22:51 -------- d-----w- c:\windows\Downloaded Program Files
2010-11-05 22:23 . 2008-04-15 04:00 25600 ----a-w- c:\windows\twunk_32.exe
2010-11-05 22:23 . 2008-04-15 04:00 18944 ----a-w- c:\windows\vmmreg32.dll
2010-11-05 22:23 . 2008-04-15 04:00 94784 ----a-w- c:\windows\twain.dll
2010-11-05 22:23 . 2008-04-15 04:00 49680 ----a-w- c:\windows\twunk_16.exe
2010-11-05 22:23 . 2008-04-15 04:00 69632 ----a-w- c:\windows\notepad.exe
2010-11-05 22:23 . 2008-04-15 04:00 15360 ----a-w- c:\windows\taskman.exe
2010-11-05 22:23 . 2008-04-15 04:00 50688 ----a-w- c:\windows\twain_32.dll
2010-11-05 22:22 . 2008-04-15 04:00 283648 ----a-w- c:\windows\winhlp32.exe
2010-11-05 22:22 . 2008-04-15 04:00 10752 ----a-w- c:\windows\hh.exe
2010-11-05 20:29 . 2010-11-05 20:29 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\SMIIPVUE
2010-11-05 20:28 . 2010-11-05 22:09 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\45e034
2010-11-05 18:41 . 2010-11-05 18:41 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 18:39 . 2006-07-11 09:00 5120 ----a-w- c:\windows\system32\wdisrvac.exe
2010-11-05 12:59 . 2010-11-05 12:59 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-11-02 11:04 . 2010-11-02 11:30 -------- d-----w- c:\documents and settings\rodina\Data aplikací\DivX
2010-10-27 21:21 . 2010-10-27 21:21 -------- d-----w- c:\documents and settings\rodina\PrivacIE
2010-10-27 14:04 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\Conduit
2010-10-27 14:03 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\free-downloads.net
2010-10-23 14:51 . 2010-10-23 14:51 -------- d-----w- c:\program files\Games
2010-10-16 18:03 . 2010-10-16 18:03 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 15:49 . 2010-10-16 15:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-10-16 15:40 . 2010-10-16 15:40 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 15:19 . 2010-10-16 15:19 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 07:37 . 2010-10-16 07:37 -------- d-----w- c:\program files\Restaurace U Amálky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-02 12:16 . 2010-05-29 15:47 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 10:23 . 2010-09-18 10:23 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2010-10-13 15:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2010-10-13 15:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2010-10-13 15:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2010-10-13 14:26 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2010-10-13 14:26 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2010-10-13 14:26 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2010-09-01 11:52 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2010-09-01 07:57 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2010-08-27 08:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2010-08-27 05:54 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-27 01:43 5632 ------w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2010-08-26 13:39 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2010-10-13 14:56 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2010-08-17 13:17 58880 ----a-w- c:\windows\system32\spoolsv.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-11-13_13.24.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-14 09:36 . 2010-11-14 09:36 16384 c:\windows\temp\Perflib_Perfdata_2a8.dat
+ 2009-08-28 07:54 . 2010-11-13 17:51 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-09-17 05:04 . 2010-09-17 05:04 9401856 c:\windows\Installer\551f1.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43 1980416 c:\windows\Installer\551e0.msp
- 2009-08-28 07:54 . 2010-10-13 15:11 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-11-10 01:41 . 2008-11-10 01:41 2014584 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6425\PPTVIEW.EXE
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-5-5 607584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-15 21:46 159744 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-15 21:46 135168 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-15 21:46 131072 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-11-13 15:35 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-06-29 20:44 458844 ----a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\rodina\\Plocha\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:TCP"= 21:TCP:FTP
"443:TCP"= 443:TCP:HTTPS

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [28.8.2009 8:56 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [28.8.2009 8:56 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [1.7.2009 22:10 103792]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [28.8.2009 8:56 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13.11.2010 16:35 142592]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2.6.2009 18:05 457200]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [9.7.2009 3:08 199152]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.6.2010 20:22 246520]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [13.11.2010 19:42 583640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [28.8.2009 8:44 113664]
R3 Cam3820;Cam3820 PC Camera Driver;c:\windows\system32\drivers\cam3820a.sys [18.6.2009 10:36 308608]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [31.3.2009 21:11 39424]
S2 PASW;Process Activation Service;c:\windows\system32\psactive.exe [26.9.2010 14:23 5120]
S2 WdiSrvHost;Wdi Service Host;c:\windows\system32\wdisrvac.exe [5.11.2010 19:39 5120]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [13.11.2010 18:35 406016]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [28.8.2009 8:42 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.5.2010 16:47 436792]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-14 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-11-13 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2010-11-13 07:46]

2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=cs_CZ&c=94&bd=Pavilion&pf=cnnb
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:25555
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 10:59
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3512)
c:\windows\system32\btmmhook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-11-14 11:01:58
ComboFix-quarantined-files.txt 2010-11-14 10:01

Před spuštěním: Volných bajtů: 129 466 122 240
Po spuštění: Volných bajtů: 129 447 501 824

- - End Of File - - E3EAA35EAC5227059A2AEE7647F8B97C

[motji]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:TCP"= 21:TCP:FTP
"443:TCP"= 443:TCP:HTTPS

- ty porty máte povoleny schválně?



Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.


Combofix není program, který se dá jen tak používat. Občas má bugy, kdy Vám může smazat nějaký systémový soubor a už nenabootujete. Navíc nemaže automaticky vše, log se musí zkontrolovat a napsat dočišťovací skript.

[Liner]

s tei porty si nejsme jist... pocitac byl znacn zavirovny a nesel ani internet...a jediny viditelny pozuststky sou t vyskakujici hlasky

log z mbam:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 5111

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14.11.2010 14:43:25
mbam-log-2010-11-14 (14-43-25).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 322845
Uplynulý čas: 2 hodina(y), 38 minuta(y), 14 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\System Rollback Data\Restore\Archive\00000046\00000045\0\Target\Documents and Settings\Michaela Šteffelová\Plocha\SM45e_2204.exe (Rogue.SmartEngine) -> No action taken.

[motji]

V mbamu to smažte.
Můžu Vám ty porty zavřít? Moc se mi nelíbí
Máte někde nějaký svůj web, ke kterému by mohli ty porty patřit?
Hlášky stále vyskakují?

[Liner]

portx klidne zavrit, nic spatnyho byto udelt nemelo snad:D
a hlasky porad stejne.
neslo by napriklad udelat na oko ty pozadovane soubory? nevim jestli by to slo,ale problem by to prinejmensim skrylo, jinak se to totiz neprojevuje

[motji]

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Folder::
c:\documents and settings\All Users\Data aplikací\SMIIPVUE
c:\documents and settings\All Users\Data aplikací\45e034

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:TCP"=-
"443:TCP"=-

DDS::
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



Otestujte na http://www.virustotal.com
c:\windows\system32\wdisrvac.exe
c:\windows\system32\drivers\syscow32x.sys


Naoko by udělat šli, ale když nevíme umístění, tak je nám to na houby. Já tu budu večer, zkusíme je dohledat v registrech.

[Liner]

v regitrech sme se je snazil najit a nic

comboxif log:

ComboFix 10-11-12.06 - Michaela Šteffelová 14.11.2010 19:06:39.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.639 [GMT 1:00]
Spuštěný z: c:\documents and settings\Michaela Šteffelová\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Michaela Šteffelová\Plocha\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\45e034
c:\documents and settings\All Users\Data aplikací\SMIIPVUE
c:\documents and settings\All Users\Data aplikací\SMIIPVUE\SMQRZBE.cfg

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-14 do 2010-11-14 )))))))))))))))))))))))))))))))
.

2010-11-14 11:00 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-14 11:00 . 2010-11-14 11:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-14 11:00 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-14 09:15 . 2010-11-14 09:14 390144 ----a-w- c:\windows\system32\CF31741.exe
2010-11-13 18:42 . 2010-08-05 07:46 37336 ----a-w- c:\windows\system32\CleanMFT32.exe
2010-11-13 18:42 . 2008-04-02 14:54 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2010-11-13 18:42 . 2008-04-02 14:53 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2010-11-13 18:42 . 2008-04-02 14:53 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2010-11-13 18:42 . 2008-09-17 20:17 658432 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2010-11-13 18:42 . 2010-11-13 18:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-11-13 18:36 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:19 . 2004-03-08 23:00 1081616 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-11-13 17:35 . 2009-08-24 21:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-11-13 17:34 . 2010-11-13 17:34 -------- d-----w- c:\program files\Ashampoo
2010-11-13 15:35 . 2010-11-13 15:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-11-13 15:35 . 2010-11-14 18:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-14 17:30 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-14 17:33 -------- d-----w- c:\program files\Spyware Terminator
2010-11-13 15:33 . 2010-11-13 15:33 -------- d-----w- c:\program files\CCleaner
2010-11-13 13:50 . 2010-11-14 08:07 -------- d-----w- c:\program files\trend micro
2010-11-13 13:50 . 2010-11-13 13:51 -------- d-----w- C:\rsit
2010-11-13 12:02 . 2010-11-13 12:02 388096 ----a-r- c:\documents and settings\Michaela Šteffelová\Data aplikací\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-11-13 12:02 . 2010-11-13 12:02 -------- d-----w- c:\program files\TrendMicro
2010-11-13 10:48 . 2010-11-13 10:48 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 10:47 . 2010-11-13 10:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:18 . 2010-11-13 09:18 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Local Settings\Data aplikací\ESET
2010-11-13 08:35 . 2010-11-13 08:35 -------- d-----w- c:\program files\ESET
2010-11-12 16:23 . 2010-11-13 18:30 -------- d-----w- c:\documents and settings\Administrator.YOUR-210CB98EE3
2010-11-07 18:00 . 2010-11-09 14:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TrackMania
2010-11-06 08:11 . 2010-11-06 08:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-11-05 22:51 . 2010-11-05 22:51 -------- d-----w- c:\windows\Downloaded Program Files
2010-11-05 22:23 . 2008-04-15 04:00 25600 ----a-w- c:\windows\twunk_32.exe
2010-11-05 22:23 . 2008-04-15 04:00 18944 ----a-w- c:\windows\vmmreg32.dll
2010-11-05 22:23 . 2008-04-15 04:00 94784 ----a-w- c:\windows\twain.dll
2010-11-05 22:23 . 2008-04-15 04:00 49680 ----a-w- c:\windows\twunk_16.exe
2010-11-05 22:23 . 2008-04-15 04:00 69632 ----a-w- c:\windows\notepad.exe
2010-11-05 22:23 . 2008-04-15 04:00 15360 ----a-w- c:\windows\taskman.exe
2010-11-05 22:23 . 2008-04-15 04:00 50688 ----a-w- c:\windows\twain_32.dll
2010-11-05 22:22 . 2008-04-15 04:00 283648 ----a-w- c:\windows\winhlp32.exe
2010-11-05 22:22 . 2008-04-15 04:00 10752 ----a-w- c:\windows\hh.exe
2010-11-05 18:41 . 2010-11-05 18:41 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 18:39 . 2006-07-11 09:00 5120 ----a-w- c:\windows\system32\wdisrvac.exe
2010-11-05 12:59 . 2010-11-05 12:59 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-11-02 11:04 . 2010-11-02 11:30 -------- d-----w- c:\documents and settings\rodina\Data aplikací\DivX
2010-10-27 21:21 . 2010-10-27 21:21 -------- d-----w- c:\documents and settings\rodina\PrivacIE
2010-10-27 14:04 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\Conduit
2010-10-27 14:03 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\free-downloads.net
2010-10-23 14:51 . 2010-10-23 14:51 -------- d-----w- c:\program files\Games
2010-10-16 18:03 . 2010-10-16 18:03 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 15:49 . 2010-10-16 15:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-10-16 15:40 . 2010-10-16 15:40 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 15:19 . 2010-10-16 15:19 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 07:37 . 2010-10-16 07:37 -------- d-----w- c:\program files\Restaurace U Amálky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-02 12:16 . 2010-05-29 15:47 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 10:23 . 2010-09-18 10:23 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2010-10-13 15:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2010-10-13 15:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2010-10-13 15:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2010-10-13 14:26 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2010-10-13 14:26 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2010-10-13 14:26 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2010-09-01 11:52 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2010-09-01 07:57 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2010-08-27 08:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2010-08-27 05:54 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-27 01:43 5632 ------w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2010-08-26 13:39 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2010-10-13 14:56 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2010-08-17 13:17 58880 ----a-w- c:\windows\system32\spoolsv.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-11-13_13.24.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-14 17:35 . 2010-11-14 17:35 16384 c:\windows\temp\Perflib_Perfdata_284.dat
+ 2009-08-28 07:54 . 2010-11-13 17:51 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-09-17 05:04 . 2010-09-17 05:04 9401856 c:\windows\Installer\551f1.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43 1980416 c:\windows\Installer\551e0.msp
- 2009-08-28 07:54 . 2010-10-13 15:11 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-11-10 01:41 . 2008-11-10 01:41 2014584 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6425\PPTVIEW.EXE
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-11-13 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-5-5 607584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-15 21:46 159744 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-15 21:46 135168 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-15 21:46 131072 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-11-13 15:35 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-06-29 20:44 458844 ----a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\rodina\\Plocha\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [28.8.2009 8:56 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [28.8.2009 8:56 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [1.7.2009 22:10 103792]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [28.8.2009 8:56 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13.11.2010 16:35 142592]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2.6.2009 18:05 457200]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [9.7.2009 3:08 199152]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.6.2010 20:22 246520]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [13.11.2010 19:42 583640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [28.8.2009 8:44 113664]
R3 Cam3820;Cam3820 PC Camera Driver;c:\windows\system32\drivers\cam3820a.sys [18.6.2009 10:36 308608]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [31.3.2009 21:11 39424]
S2 PASW;Process Activation Service;c:\windows\system32\psactive.exe [26.9.2010 14:23 5120]
S2 WdiSrvHost;Wdi Service Host;c:\windows\system32\wdisrvac.exe [5.11.2010 19:39 5120]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [13.11.2010 18:35 406016]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [28.8.2009 8:42 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.5.2010 16:47 436792]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-14 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-11-14 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2010-11-13 07:46]

2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:25555
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 19:18
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-11-14 19:21:32
ComboFix-quarantined-files.txt 2010-11-14 18:21
ComboFix2.txt 2010-11-14 10:01

Před spuštěním: Volných bajtů: 129 264 037 888
Po spuštění: Volných bajtů: 129 244 459 008

- - End Of File - - 635CDA67A2BFA6894AF2260C08B5AF75





File name: wdisrvac.exe
Submission date: 2010-11-14 18:26:51 (UTC)
Current status: queued (#3) queued (#3) analysing finished


Result: 10/ 43 (23.3%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.15.00 2010.11.14 Win-Trojan/Agent.8192.Z
Emsisoft 5.0.0.50 2010.11.14 Win32.SuspectCrc!IK
Ikarus T3.1.1.90.0 2010.11.14 Win32.SuspectCrc
Jiangmin 13.0.900 2010.11.14 TrojanDropper.Microjoin.anl
K7AntiVirus 9.67.2973 2010.11.12 Trojan
McAfee 5.400.0.1158 2010.11.14 Artemis!8D470776C368
McAfee-GW-Edition 2010.1C 2010.11.14 Heuristic.BehavesLike.Win32.Suspicious.H
nProtect 2010-11-14.01 2010.11.14 Trojan/W32.Agent.5120.CU
Prevx 3.0 2010.11.14 Medium Risk Malware
VBA32 3.12.14.2 2010.11.12 Trojan-Dropper.Win32.Microjoin.hfg

-prvni soubor sem smazal a jenda hlaska o chybejici knihovne zmizela... zustava pschmdrf.dll
a na druhy soubor to nic nenaslo

[motji]

Já ho smažu znovu přes combofix, má tak ještě funkční driver, tak ať je smazaný komplet, a pak se uvidí.


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Collect::
c:\windows\system32\wdisrvac.exe

Driver::
WdiSrvHost

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci