Prosba o kontrolu logů

[Alatar]

Problémy zejména s ff - redirecty při vyhledávání, "samovolné" spouštění jak ff oken tak i ff procesů v návaznosti na spouštění jiných aplikací.

________________________________________________________________________________

Logfile of random's system information tool 1.08 (written by random/random)
Run by Alatar at 2010-12-09 10:16:48
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 259 GB (56%) free of 466 GB
Total RAM: 3065 MB (57% free)

HijackThis download failed

======Scheduled tasks folder======

C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3134413B-49B4-425C-98A5-893C1F195601}]
BHO_Startup Class - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2010-10-20 167936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll [2009-07-16 664888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
Credential Manager for HP ProtectTools - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll [2009-01-28 98064]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-12-16 186904]
"accrdsub"=c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [2007-11-28 298536]
"PTHOSTTR"=c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [2009-02-12 355896]
"CognizanceTS"=c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll [2009-01-28 24848]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2008-08-08 319000]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-03-10 506936]
"HP Health Check Scheduler"=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-12-04 75016]
"File Sanitizer"=C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [2010-10-28 11280384]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2009-02-18 177720]
"HPCam_Menu"=c:\Program Files\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe [2009-02-25 218408]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-07-01 37888]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-10-24 475136]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-10-24 118784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-12-11 1310720]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2010-10-28 139264]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-01-10 2393376]
"ehTray.exe"=C:\windows\ehome\ehTray.exe [2008-01-21 125952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [2010-10-24 278528]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"Rapport"=C:\Users\Alatar\AppData\Roaming\sorrypeople2\smss.exe [2010-12-09 152064]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Users\Public\Documents\Windows
OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\APSHook.dll APSHook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP]
C:\windows\system32\DeviceNP.dll [2008-08-06 69632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 3 months======

2010-12-09 10:01:15 ----SHD---- C:\$RECYCLE.BIN
2010-12-09 10:01:14 ----A---- C:\windows\explorerSrv.exe
2010-12-09 10:01:10 ----D---- C:\windows\temp
2010-12-09 10:01:08 ----A---- C:\ComboFix.txt
2010-12-09 09:22:44 ----A---- C:\windows\zip.exe
2010-12-09 09:22:44 ----A---- C:\windows\SWSC.exe
2010-12-09 09:22:44 ----A---- C:\windows\SWREG.exe
2010-12-09 09:22:44 ----A---- C:\windows\sed.exe
2010-12-09 09:22:44 ----A---- C:\windows\PEV.exe
2010-12-09 09:22:44 ----A---- C:\windows\NIRCMD.exe
2010-12-09 09:22:44 ----A---- C:\windows\MBR.exe
2010-12-09 09:22:44 ----A---- C:\windows\grep.exe
2010-12-09 09:21:49 ----D---- C:\windows\ERDNT
2010-12-09 09:21:45 ----D---- C:\ComboFix
2010-12-09 09:20:32 ----D---- C:\Qoobox
2010-12-09 09:20:14 ----A---- C:\windows\SWXCACLS.exe
2010-11-27 09:55:18 ----D---- C:\ProgramData\WindowsSearch
2010-11-25 16:25:14 ----D---- C:\Program Files\trend micro
2010-11-25 16:25:11 ----D---- C:\rsit
2010-11-23 03:09:48 ----A---- C:\windows\system32\MRT.INI
2010-11-18 16:43:20 ----D---- C:\Users\Alatar\AppData\Roaming\sorrypeople
2010-11-18 16:21:03 ----D---- C:\found.001
2010-11-15 10:03:02 ----D---- C:\Program Files\tmp
2010-11-12 03:05:11 ----D---- C:\Program Files\Microsoft.NET
2010-11-11 05:47:32 ----A---- C:\ProgramData\pluglog.txt
2010-11-11 05:47:24 ----D---- C:\Program Files\win
2010-10-31 20:19:20 ----D---- C:\Users\Alatar\AppData\Roaming\sorrypeople2
2010-10-27 06:54:42 ----A---- C:\windows\system32\GameUXLegacyGDFs.dll
2010-10-27 06:54:42 ----A---- C:\windows\system32\gameux.dll
2010-10-27 06:54:42 ----A---- C:\windows\system32\Apphlpdm.dll
2010-10-24 21:32:32 ----D---- C:\Program Files\Microsoft
2010-10-24 17:07:36 ----A---- C:\windows\system32\XAudio2_3.dll
2010-10-24 17:07:36 ----A---- C:\windows\system32\XAPOFX1_2.dll
2010-10-24 17:07:36 ----A---- C:\windows\system32\xactengine3_3.dll
2010-10-24 17:07:36 ----A---- C:\windows\system32\D3DX9_40.dll
2010-10-24 17:07:36 ----A---- C:\windows\system32\d3dx10_40.dll
2010-10-24 17:07:36 ----A---- C:\windows\system32\D3DCompiler_40.dll
2010-10-24 17:07:35 ----A---- C:\windows\system32\X3DAudio1_5.dll
2010-10-24 17:00:45 ----D---- C:\Program Files\Deep Silver
2010-10-14 01:36:52 ----A---- C:\windows\system32\xlive.dll
2010-10-14 01:36:50 ----A---- C:\windows\system32\xlivefnt.dll
2010-10-14 01:36:44 ----A---- C:\windows\system32\xlive.dll.cat
2010-10-13 23:43:08 ----A---- C:\windows\system32\wmp.dll
2010-10-13 23:43:06 ----A---- C:\windows\system32\wmploc.DLL
2010-10-13 23:42:34 ----A---- C:\windows\system32\srvsvc.dll
2010-10-13 23:42:34 ----A---- C:\windows\system32\drivers\srvnet.sys
2010-10-13 23:42:34 ----A---- C:\windows\system32\drivers\srv2.sys
2010-10-13 23:42:34 ----A---- C:\windows\system32\drivers\srv.sys
2010-10-13 23:42:33 ----A---- C:\windows\system32\netevent.dll
2010-10-13 23:42:27 ----A---- C:\windows\system32\schannel.dll
2010-10-13 23:42:26 ----A---- C:\windows\system32\ole32.dll
2010-10-13 23:42:24 ----A---- C:\windows\system32\t2embed.dll
2010-10-13 23:42:23 ----A---- C:\windows\system32\mfc40u.dll
2010-10-13 23:42:23 ----A---- C:\windows\system32\mfc40.dll
2010-10-13 23:42:21 ----A---- C:\windows\system32\win32k.sys
2010-10-13 23:42:20 ----A---- C:\windows\system32\msshsq.dll
2010-10-13 23:42:19 ----A---- C:\windows\system32\wmpmde.dll
2010-10-13 23:42:18 ----A---- C:\windows\system32\comctl32.dll
2010-10-13 23:42:12 ----A---- C:\windows\system32\ieframe.dll
2010-10-13 23:42:11 ----A---- C:\windows\system32\msfeeds.dll
2010-10-13 23:42:10 ----A---- C:\windows\system32\mshtmled.dll
2010-10-13 23:42:10 ----A---- C:\windows\system32\mshtml.dll
2010-10-13 23:42:09 ----A---- C:\windows\system32\wininet.dll
2010-10-13 23:42:09 ----A---- C:\windows\system32\urlmon.dll
2010-10-13 23:42:09 ----A---- C:\windows\system32\iepeers.dll
2010-10-13 23:42:09 ----A---- C:\windows\system32\ieencode.dll
2010-10-13 23:42:08 ----A---- C:\windows\system32\ieapfltr.dll
2010-09-29 17:27:39 ----A---- C:\windows\system32\tzres.dll
2010-09-23 17:21:31 ----D---- C:\Program Files\THQ
2010-09-16 19:46:30 ----D---- C:\Users\Alatar\AppData\Roaming\Microsoft Games
2010-09-15 10:51:02 ----A---- C:\windows\system32\usp10.dll
2010-09-15 10:51:01 ----A---- C:\windows\system32\spoolsv.exe
2010-09-15 10:50:59 ----A---- C:\windows\system32\MP4SDECD.DLL
2010-09-15 10:49:30 ----A---- C:\windows\system32\inetcomm.dll

======List of files/folders modified in the last 3 months======

2010-12-09 10:12:38 ----D---- C:\windows\tracing
2010-12-09 10:10:52 ----D---- C:\Users\Alatar\AppData\Roaming\Skype
2010-12-09 10:01:14 ----D---- C:\Windows
2010-12-09 10:01:10 ----D---- C:\windows\system32\drivers
2010-12-09 09:51:16 ----D---- C:\Program Files\Internet Explorer
2010-12-09 09:50:12 ----A---- C:\windows\system.ini
2010-12-09 09:49:52 ----D---- C:\windows\system32\drivers\etc
2010-12-09 09:36:54 ----SHD---- C:\System Volume Information
2010-12-09 09:27:10 ----D---- C:\ProgramData
2010-12-09 09:22:48 ----D---- C:\windows\Prefetch
2010-12-09 09:20:43 ----D---- C:\windows\System32
2010-12-09 09:20:43 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-12-09 09:20:42 ----D---- C:\windows\inf
2010-12-09 09:17:44 ----D---- C:\Program Files\Mozilla Firefox
2010-12-09 09:13:30 ----D---- C:\windows\system32\Msdtc
2010-12-09 09:13:23 ----D---- C:\windows\system32\wbem
2010-12-09 09:12:27 ----D---- C:\windows\system32\config
2010-12-09 09:12:15 ----D---- C:\windows\Tasks
2010-12-09 09:12:15 ----D---- C:\windows\system32\Tasks
2010-12-09 09:12:15 ----D---- C:\windows\system32\spool
2010-12-09 09:12:15 ----D---- C:\windows\system32\catroot2
2010-12-09 09:12:14 ----D---- C:\Users\Alatar\AppData\Roaming\Winamp
2010-12-09 09:12:14 ----D---- C:\Users\Alatar\AppData\Roaming\GHISLER
2010-12-09 09:12:14 ----D---- C:\totalcmd
2010-12-09 09:12:13 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-12-09 09:12:13 ----D---- C:\Program Files\Diablo II
2010-12-09 09:12:12 ----D---- C:\windows\registration
2010-12-09 09:02:24 ----D---- C:\Users\Alatar\AppData\Roaming\skypePM
2010-12-06 14:12:08 ----D---- C:\Program Files\JDownloader
2010-11-25 16:25:14 ----RD---- C:\Program Files
2010-11-23 03:24:37 ----D---- C:\windows\winsxs
2010-11-23 03:10:10 ----D---- C:\windows\system32\catroot
2010-11-23 03:10:03 ----D---- C:\Program Files\Windows Mail
2010-11-23 03:05:36 ----A---- C:\windows\system32\mrt.exe
2010-11-23 03:05:32 ----SHD---- C:\windows\Installer
2010-11-22 14:03:08 ----D---- C:\Downloads
2010-11-18 18:50:18 ----D---- C:\windows\system32\drivers\UMDF
2010-11-18 18:50:18 ----D---- C:\windows\system32\CodeIntegrity
2010-11-18 18:50:10 ----HD---- C:\Program Files\InstallShield Installation Information
2010-11-18 18:50:10 ----D---- C:\Program Files\Bonjour
2010-11-17 03:06:55 ----D---- C:\Program Files\Common Files\microsoft shared
2010-11-12 03:14:44 ----D---- C:\windows\Microsoft.NET
2010-11-12 03:14:43 ----RSD---- C:\windows\assembly
2010-11-12 03:09:17 ----D---- C:\windows\system32\cs-CZ
2010-11-12 03:05:13 ----D---- C:\windows\system32\en-US
2010-11-02 11:06:30 ----D---- C:\Swsetup
2010-10-28 10:31:37 ----D---- C:\ProgramData\Apple Computer
2010-10-28 10:31:37 ----D---- C:\Program Files\Common Files
2010-10-28 10:31:09 ----DC---- C:\windows\system32\DRVSTORE
2010-10-28 09:25:07 ----D---- C:\windows\AppPatch
2010-10-25 16:27:15 ----D---- C:\Program Files\Bethesda Softworks
2010-10-24 21:33:49 ----D---- C:\Program Files\Microsoft Games
2010-10-14 03:05:30 ----D---- C:\windows\rescache
2010-10-14 02:26:38 ----D---- C:\windows\system32\sl-SI
2010-10-14 02:26:38 ----D---- C:\windows\system32\sk-SK
2010-10-14 02:26:38 ----D---- C:\Program Files\Windows Media Player
2010-10-07 10:52:03 ----SD---- C:\Users\Alatar\AppData\Roaming\Microsoft
2010-10-05 21:20:53 ----D---- C:\Program Files\Common Files\Steam
2010-10-04 15:12:12 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 02:03:15 ----D---- C:\windows\system32\hr-HR
2010-09-21 18:01:42 ----D---- C:\windows\Minidump

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hpdskflt;HP Filter; C:\windows\system32\DRIVERS\hpdskflt.sys [2008-08-27 25392]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\drivers\iastor.sys [2008-12-04 328728]
R0 MegaSR;MegaSR; C:\windows\system32\drivers\megasr.sys [2008-01-21 386616]
R0 PxHelp20;PxHelp20; C:\windows\System32\Drivers\PxHelp20.sys [2008-04-08 44944]
R0 SafeBoot;SafeBoot; C:\windows\system32\drivers\SafeBoot.sys [2008-10-01 109216]
R0 SbAlg;SbAlg; C:\windows\system32\drivers\SbAlg.sys [2008-10-01 51408]
R0 SbFsLock;SbFsLock; C:\windows\system32\drivers\SbFsLock.sys [2008-10-01 12960]
R0 sptd;sptd; C:\windows\System32\Drivers\sptd.sys [2009-10-15 721904]
R1 mfetdik;McAfee Inc. mfetdik; C:\windows\system32\drivers\mfetdik.sys [2008-04-29 55112]
R1 RsvLock;RsvLock; C:\windows\system32\drivers\RsvLock.sys [2008-10-01 12528]
R2 atksgt;atksgt; C:\windows\system32\DRIVERS\atksgt.sys [2010-10-24 281760]
R2 lirsgt;lirsgt; C:\windows\system32\DRIVERS\lirsgt.sys [2010-10-24 25888]
R2 regi;regi; C:\windows\system32\drivers\regi.sys [2007-04-17 11032]
R3 Accelerometer;HP Accelerometer; C:\windows\system32\DRIVERS\Accelerometer.sys [2008-08-27 34608]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\ADIHdAud.sys [2009-01-16 381440]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\windows\system32\drivers\AtiHdmi.sys [2009-04-24 95544]
R3 atikmdag;atikmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2009-05-14 4305920]
R3 BthEnum;Služba Bluetooth Enumerator; C:\windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
R3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys [2009-03-11 84008]
R3 btwavdt;Bluetooth AVDT Service; C:\windows\system32\drivers\btwavdt.sys [2009-03-11 109608]
R3 btwl2cap;Bluetooth L2CAP Service; C:\windows\system32\DRIVERS\btwl2cap.sys [2009-03-11 29736]
R3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys [2009-03-11 18344]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\windows\system32\DRIVERS\HpqKbFiltr.sys [2007-06-19 16768]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\windows\system32\DRIVERS\NETw5v32.sys [2009-03-31 4232704]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\windows\system32\DRIVERS\snp2uvc.sys [2009-03-26 1765168]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2009-07-29 213680]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\windows\system32\DRIVERS\yk60x86.sys [2008-11-23 310272]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\windows\system32\DRIVERS\AGRSM.sys [2008-10-29 1204128]
S3 am8d4tsx;am8d4tsx; C:\windows\system32\drivers\am8d4tsx.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 catchme;catchme; \??\C:\Users\Alatar\AppData\Local\Temp\catchme.sys []
S3 DAMDrv;DAMDrv; C:\windows\system32\DRIVERS\DAMDrv.sys [2008-08-06 32256]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\windows\system32\drivers\errdev.sys [2008-01-21 6656]
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Users\Alatar\Desktop\EVEREST ultimate edition 4,5\kerneld.wnt []
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WUDFRd;WUDFRd; C:\windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 accoca;ActivClient Middleware Service; c:\Program Files\ActivIdentity\ActivClient\accoca.exe [2007-11-28 185896]
R2 AEADIFilters;Andrea ADI Filters Service; C:\windows\system32\AEADISRV.EXE [2008-07-15 90112]
R2 ASBroker;Logon Session Broker; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 ASChannel;Local Communication Channel; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 Ati External Event Utility;Ati External Event Utility; C:\windows\system32\Ati2evxx.exe [2009-05-14 733184]
R2 ATService;AuthenTec Fingerprint Service; c:\Program Files\Fingerprint Sensor\AtService.exe [2008-10-03 1185016]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\windows\system32\svchost.exe [2008-01-21 21504]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-03-01 567848]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2008-12-04 94208]
R2 HpFkCryptService;Drive Encryption Service; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-10-01 256544]
R2 HPFSService;File Sanitizer for HP ProtectTools; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2009-01-14 77824]
R2 hpsrv;HP Service; C:\windows\system32\Hpservice.exe [2008-08-27 24880]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2008-12-16 354840]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-01-10 79136]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2008-08-08 777240]
R2 PnkBstrA;PnkBstrA; C:\windows\system32\PnkBstrA.exe [2010-08-03 75064]
R2 PSI_SVC_2;Protexis Licensing V2; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-12-05 222512]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2008-10-23 223232]
S2 EngineServer;EngineServer; C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
S2 myAgtSvc;McAfee Virus and Spyware Protection Service; C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe /ServiceStart []
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing; c:\Windows\system32\flcdlock.exe [2008-08-06 349432]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\windows\system32\svchost.exe [2008-01-21 21504]
S3 HP ProtectTools Service;HP ProtectTools Service; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2009-02-12 45056]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2010-10-24 126976]
S3 RoxMediaDB10;RoxMediaDB10; c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2008-04-08 1112560]
S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]

-----------------EOF-----------------

[Alatar]

Log z ComboFixu

____________________________________________________________________________________________________


ComboFix 10-11-28.04 - Alatar 09.12.2010 9:26.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3065.1905 [GMT 1:00]
Spuštěný z: c:\users\Alatar\Downloads\ComboFix.exe
AV: Total Protection *On-access scanning disabled* (Outdated) {8C354827-2F54-4E28-90DC-AD391E77808C}
SP: Total Protection *disabled* (Outdated) {DEBE977C-6A5A-49CC-937A-9E8BB3202260}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\complete.dat
c:\program files\Internet Explorer\dmlconf.dat
c:\program files\Microsoft\DesktopLayer.exe
c:\programdata\WmiModules
c:\users\Alatar\AppData\Roaming\download2
c:\users\Alatar\AppData\Roaming\Microsoft\Windows\Templates\memory.tmp
c:\users\Public\Documents\Server\admin.txt
c:\users\Public\Documents\Server\server.dat

c:\windows\explorer.exe . . . je infikován!!

c:\windows\System32\wininit.exe . . . je infikován!!

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-09 do 2010-12-09 )))))))))))))))))))))))))))))))
.

2010-12-09 08:49 . 2010-12-09 08:50 -------- d-----w- c:\users\Alatar\AppData\Local\temp
2010-12-09 08:49 . 2010-12-09 08:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-09 08:17 . 2010-12-09 08:50 53760 ----a-w- c:\program files\Mozilla Firefox\firefoxSrv.exe
2010-11-27 08:55 . 2010-11-27 08:55 -------- d-----w- c:\programdata\WindowsSearch
2010-11-25 15:25 . 2010-11-25 15:25 -------- d-----w- c:\program files\trend micro
2010-11-25 15:25 . 2010-11-25 15:25 -------- d-----w- C:\rsit
2010-11-22 09:05 . 2010-10-07 11:37 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-11-18 15:43 . 2010-11-18 15:43 -------- d-----w- c:\users\Alatar\AppData\Roaming\sorrypeople
2010-11-18 15:21 . 2010-11-18 15:21 -------- d-----w- C:\found.001
2010-11-15 09:03 . 2010-11-15 09:03 -------- d-----w- c:\program files\tmp
2010-11-12 02:05 . 2010-11-12 02:05 -------- d-----w- c:\program files\Microsoft.NET
2010-11-11 04:47 . 2010-12-08 19:44 -------- d-----w- c:\program files\win

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-24 16:07 . 2010-03-17 23:08 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-10-24 16:07 . 2010-03-17 23:08 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-10-14 00:36 . 2010-10-14 00:36 15451288 ----a-w- c:\windows\system32\xlive.dll
2010-10-14 00:36 . 2010-10-14 00:36 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2010-09-13 13:56 . 2010-10-13 22:43 8147456 ----a-w- c:\windows\system32\wmploc.DLL
.

------- Sigcheck -------

[7] 2009-06-22 . 37440D09DEAE0B672A04DCCF7ABF06BE . 2923520 . . [6.0.6000.16771] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[7] 2009-06-22 . E7156B0B74762D9DE0E66BDCDE06E5FB . 2923520 . . [6.0.6000.20947] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[7] 2009-06-22 . 4F554999D7D5F05DAAEBBA7B5BA1089D . 2927104 . . [6.0.6001.18164] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[7] 2009-06-22 . 50BA5850147410CDE89C523AD3BC606E . 2927616 . . [6.0.6001.22298] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[-] 2009-04-11 . A15F5A6CDADD0FFC545A5D92CF36E424 . 2926592 . . [6.0.6000.16386] . . c:\windows\explorer.exe
[7] 2009-04-11 . D07D4C3038F3578FFCE1C0237F2A1253 . 2926592 . . [6.0.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[7] 2008-01-21 . FFA764631CB70A30065C12EF8E174F9F . 2927104 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

[-] 2008-01-21 . EC82A30D991C86766C800359BFA9DA6A . 96768 . . [6.0.6000.16386] . . c:\windows\System32\wininit.exe
[7] 2008-01-21 . 101BA3EA053480BB5D957EF37C06B5ED . 96768 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-01-09 2393376]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2010-10-24 278528]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Rapport"="c:\users\Alatar\AppData\Roaming\sorrypeople2\smss.exe" [2010-10-31 96768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-16 186904]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-11-28 298536]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2009-02-12 355896]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2009-01-28 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-08-08 319000]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-03-10 506936]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-12-04 75016]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2010-10-28 11280384]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-02-18 177720]
"HPCam_Menu"="c:\program files\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-10-24 475136]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-24 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-12-11 1310720]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2010-10-28 139264]

c:\users\Alatar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-9-16 384512]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-3-1 789032]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe,c:\program files\actividentity\activclient\accocasrv.exe,c:\progra~1\diablo~1\diablo~1srv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2008-08-06 22:23 69632 ----a-w- c:\windows\System32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R2 EngineServer;EngineServer;c:\progra~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe [x]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2008-08-06 32256]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\users\Alatar\Desktop\EVEREST ultimate edition 4,5\kerneld.wnt [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\system32\flcdlock.exe [2008-08-06 349432]
R3 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2009-02-12 45056]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2008-04-08 1112560]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-15 721904]
S1 RsvLock;RsvLock; [x]
S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-11-28 185896]
S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2008-10-03 1185016]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-10-01 256544]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2009-01-14 77824]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-08-27 24880]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-08-08 777240]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-03-11 29736]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-12-05 222512]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-03-31 4232704]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Bioscrypt REG_MULTI_SZ ASBroker ASChannel
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72870b57-f33c-11df-9699-00247eb0bcbf}]
\shell\AutoRun\command - J:\avira.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{739c23dd-b4cf-11de-84f0-806e6f6e6963}]
\shell\AutoRun\command - E:\SETUP.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e2ef40b-b4d0-11de-806b-00247eb0bcbf}]
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL k:\.\RECYCLER\S-7-7-12-4404372060-0555626016-266778846-6338D0n\UjZbQRlH.exe
\shell\explore\command - k:\.\RECYCLER\S-7-7-12-4404372060-0555626016-266778846-6338D0n\UjZbQRlH.exe
\shell\Open\command - k:\.\RECYCLER\S-7-7-12-4404372060-0555626016-266778846-6338D0n\UjZbQRlH.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ae8c753-b94e-11de-9c5b-00247eb0bcbf}]
\shell\AutoRun\command - G:\AUTOSTARTER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ae8c755-b94e-11de-9c5b-00247eb0bcbf}]
\shell\AutoRun\command - I:\Setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-01-09 23:28 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 12:42]

2010-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 12:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=cs_cz&c=92&bd=all&pf=cmnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=cs_cz&c=92&bd=all&pf=cmnb
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
FF - ProfilePath - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\id Software\QuakeLive\npquakezero.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Extension: Image Zoom: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
FF - Extension: British English Dictionary: en-GB@dictionaries.addons.mozilla.org - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\en-GB@dictionaries.addons.mozilla.org
FF - Extension: meebo: firefox@meebo.com - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\firefox@meebo.com
FF - Extension: České slovníky pro kontrolu pravopisu: cs@dictionaries.addons.mozilla.org - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\cs@dictionaries.addons.mozilla.org
FF - Extension: Black Steel: {e2c58150-9d72-11dd-ad8b-0800200c9a66} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{e2c58150-9d72-11dd-ad8b-0800200c9a66}
FF - Extension: Forecastfox Weather: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF - Extension: Green Fox: {d122ad80-ff45-11dd-87af-0800200c9a66} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{d122ad80-ff45-11dd-87af-0800200c9a66}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Extension: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Extension: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - c:\users\Alatar\AppData\Roaming\Mozilla\Firefox\Profiles\i1uqy8c3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-MVS Splash - c:\program files\McAfee\Managed VirusScan\Agent\Splash.exe
HKLM-Run-McAfee Managed Services Tray - c:\program files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.Exe
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-RiseOfNations 1.0 - c:\program files\Microsoft Games\Rise of Nations\UNINSTAL.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-09 09:50
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\users\Alatar\Desktop\EVEREST ultimate edition 4,5\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\APSHook.dll

- - - - - - - > 'lsass.exe'(768)
c:\windows\system32\APSHook.dll
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\itmsg.dll
.
Celkový čas: 2010-12-09 10:01:08
ComboFix-quarantined-files.txt 2010-12-09 09:00

Před spuštěním: Volných bajtů: 271 747 010 560
Po spuštění: Volných bajtů: 271 243 833 344

- - End Of File - - 989D0AE3073B75F4DA199E0EBFBCB99D

[motji]

Dobrý večer
Příště nepoužívejte combofix bez doporučení zde na foru, můžete si znefunkčnit systém .
Co je jednotka K?


Stáhněte si nový combofix
Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

DDS::
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e2ef40b-b4d0-11de-806b-00247eb0bcbf}]

Restore::
c:\windows\explorer.exe
c:\windows\System32\wininit.exe 

Srpeek::
c:\windows\explorer.exe
c:\windows\System32\wininit.exe 

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci