Volání o pomoc

[Michele]

Volám o pomoc logem níže . Předem díky.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Michal at 2011-01-14 19:10:18
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 58 GB (76%) free of 76 GB
Total RAM: 1023 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:10:25, on 14.1.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PrintCtrl.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Michal\Local Settings\Data aplikací\Opera\Opera\temporary_downloads\RSIT.exe
C:\Program Files\trend micro\Michal.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25577
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [PrintDisp] C:\WINDOWS\system32\PrintDisp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [strayk] C:\Program Files\STRAYK\strayk.exe -ds
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Printer Control - ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM - C:\WINDOWS\system32\PrintCtrl.exe

--
End of file - 3531 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"PrintDisp"=C:\WINDOWS\system32\PrintDisp.exe [2010-07-23 975360]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-10-16 110696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-10-16 13851752]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"strayk"=C:\Program Files\STRAYK\strayk.exe [2010-01-30 872448]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-05 1305408]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-01-14 19:10:18 ----D---- C:\rsit
2011-01-14 19:10:18 ----D---- C:\Program Files\trend micro
2011-01-14 18:55:52 ----D---- C:\WINDOWS\temp
2011-01-14 18:55:50 ----A---- C:\ComboFix.txt
2011-01-14 18:34:35 ----D---- C:\Config.Msi
2011-01-12 10:23:07 ----D---- C:\Documents and Settings\Michal\Data aplikací\AVG10
2011-01-12 10:20:42 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2011-01-11 21:34:48 ----D---- C:\Qoobox
2011-01-11 20:01:15 ----A---- C:\Boot.bak
2011-01-11 20:01:09 ----RASHD---- C:\cmdcons
2011-01-11 19:59:53 ----A---- C:\WINDOWS\zip.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\SWSC.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\SWREG.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\sed.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\PEV.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\NIRCMD.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\MBR.exe
2011-01-11 19:59:53 ----A---- C:\WINDOWS\grep.exe
2011-01-11 19:56:58 ----D---- C:\WINDOWS\ERDNT
2011-01-11 19:25:15 ----D---- C:\WINDOWS\Prefetch
2011-01-11 18:55:35 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2011-01-11 18:51:21 ----A---- C:\WINDOWS\pnplog.txt
2011-01-11 18:47:36 ----A---- C:\WINDOWS\system32\drivers\RTL8139.sys
2011-01-11 18:44:28 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-01-11 18:44:28 ----A---- C:\WINDOWS\system32\irclass.dll
2011-01-11 18:44:10 ----RA---- C:\WINDOWS\SET33.tmp
2011-01-11 18:44:05 ----RA---- C:\WINDOWS\SET27.tmp
2011-01-11 18:44:03 ----RA---- C:\WINDOWS\SET24.tmp
2011-01-11 18:35:40 ----A---- C:\WINDOWS\UPGRADE.TXT
2011-01-11 18:35:37 ----D---- C:\WINDOWS\setup.pss
2011-01-11 18:29:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG10
2011-01-11 18:24:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2011-01-11 18:16:20 ----D---- C:\Program Files\Alwil Software
2011-01-11 18:16:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2011-01-11 18:09:04 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\PIYTQYCS
2011-01-10 19:07:49 ----D---- C:\Documents and Settings\Michal\Data aplikací\Iceni
2011-01-10 19:07:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\Iceni
2011-01-10 19:07:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\Aspell
2011-01-10 19:07:45 ----D---- C:\Program Files\Iceni
2011-01-10 18:24:46 ----A---- C:\WINDOWS\Mnideb.exe
2011-01-10 18:10:40 ----A---- C:\WINDOWS\Mnidea.exe
2011-01-10 17:46:49 ----A---- C:\WINDOWS\system32\SaveTo.dll
2011-01-10 17:46:29 ----A---- C:\WINDOWS\system32\PrintDisp.exe
2011-01-10 17:46:29 ----A---- C:\WINDOWS\system32\PrintCtrl.exe
2011-01-10 17:46:29 ----A---- C:\WINDOWS\system32\CPDF.dll
2011-01-10 17:46:29 ----A---- C:\WINDOWS\system32\ActPDF.dll
2011-01-10 17:46:25 ----AD---- C:\Documents and Settings\All Users\Data aplikací\Temp
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\SetupDrv.exe
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\SetPrinter.exe
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\PrtTools.exe
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\PrtPass.exe
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\PrtClient.exe
2011-01-10 17:46:22 ----A---- C:\WINDOWS\system32\PrintLog.exe
2011-01-10 17:46:12 ----D---- C:\Documents and Settings\Michal\Data aplikací\Aspell
2011-01-10 16:54:48 ----D---- C:\Documents and Settings\Michal\Data aplikací\Foxit Software
2011-01-10 14:34:35 ----D---- C:\Program Files\Foxit Software
2011-01-06 21:04:23 ----D---- C:\Documents and Settings\Michal\Data aplikací\WinRAR
2011-01-06 21:04:08 ----D---- C:\Program Files\WinRAR
2011-01-06 20:52:38 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2011-01-06 20:52:34 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2011-01-06 20:48:15 ----D---- C:\Program Files\Microsoft Games
2011-01-06 19:58:32 ----D---- C:\Program Files\Creative
2011-01-06 19:58:32 ----A---- C:\WINDOWS\system32\eax.dll
2011-01-06 19:58:30 ----A---- C:\WINDOWS\IsUninst.exe
2011-01-06 19:47:55 ----D---- C:\Program Files\Mafia
2011-01-06 19:47:52 ----RA---- C:\WINDOWS\system32\MafiaSetup.exe
2011-01-06 19:23:45 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-01-06 19:23:34 ----D---- C:\Program Files\DAEMON Tools Lite
2011-01-06 19:23:12 ----D---- C:\Documents and Settings\Michal\Data aplikací\DAEMON Tools Lite
2011-01-06 19:23:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-01-06 19:16:52 ----D---- C:\Program Files\uTorrent
2011-01-06 19:16:24 ----D---- C:\Documents and Settings\Michal\Data aplikací\uTorrent
2011-01-06 19:12:56 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-01-06 19:12:56 ----A---- C:\WINDOWS\system32\nvgenco32.dll
2011-01-06 19:12:56 ----A---- C:\WINDOWS\system32\nvdispco32.dll
2011-01-06 19:12:54 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-01-06 19:12:24 ----D---- C:\NVIDIA
2010-12-15 20:04:40 ----D---- C:\Documents and Settings\Michal\Data aplikací\STRAYK
2010-12-15 20:04:34 ----D---- C:\Program Files\STRAYK
2010-12-15 20:04:34 ----A---- C:\Documents and Settings\Michal\Data aplikací\unins000.exe

======List of files/folders modified in the last 1 months======

2011-01-14 19:10:18 ----RD---- C:\Program Files
2011-01-14 18:56:54 ----D---- C:\WINDOWS\system32
2011-01-14 18:56:54 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-01-14 18:55:52 ----D---- C:\WINDOWS
2011-01-14 18:54:44 ----A---- C:\WINDOWS\system.ini
2011-01-14 18:53:33 ----D---- C:\WINDOWS\system32\drivers
2011-01-14 18:53:33 ----D---- C:\WINDOWS\AppPatch
2011-01-14 18:53:29 ----D---- C:\Program Files\Common Files
2011-01-14 18:50:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-14 18:50:35 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-14 18:35:34 ----SHD---- C:\WINDOWS\Installer
2011-01-14 18:35:00 ----HD---- C:\WINDOWS\inf
2011-01-14 18:34:18 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-01-12 13:52:16 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-01-12 10:25:26 ----D---- C:\WINDOWS\pchealth
2011-01-11 20:17:15 ----SD---- C:\WINDOWS\Tasks
2011-01-11 20:15:31 ----D---- C:\WINDOWS\system32\drivers\etc
2011-01-11 20:13:19 ----D---- C:\WINDOWS\system32\config
2011-01-11 20:04:55 ----D---- C:\WINDOWS\security
2011-01-11 20:01:15 ----RASH---- C:\boot.ini
2011-01-11 19:41:51 ----D---- C:\WINDOWS\system32\Setup
2011-01-11 19:41:51 ----D---- C:\WINDOWS\system
2011-01-11 19:41:43 ----D---- C:\WINDOWS\system32\usmt
2011-01-11 19:41:32 ----D---- C:\WINDOWS\ime
2011-01-11 19:41:32 ----D---- C:\WINDOWS\ehome
2011-01-11 19:41:30 ----RSD---- C:\WINDOWS\Fonts
2011-01-11 19:41:30 ----D---- C:\WINDOWS\Media
2011-01-11 19:41:20 ----D---- C:\WINDOWS\PeerNet
2011-01-11 19:41:09 ----D---- C:\WINDOWS\system32\npp
2011-01-11 19:41:03 ----D---- C:\WINDOWS\msagent
2011-01-11 19:39:21 ----D---- C:\WINDOWS\system32\1029
2011-01-11 19:39:16 ----D---- C:\WINDOWS\twain_32
2011-01-11 19:39:05 ----D---- C:\WINDOWS\system32\icsxml
2011-01-11 19:38:39 ----D---- C:\WINDOWS\system32\1033
2011-01-11 19:37:46 ----D---- C:\WINDOWS\Driver Cache
2011-01-11 19:37:45 ----D---- C:\WINDOWS\WinSxS
2011-01-11 19:26:38 ----D---- C:\WINDOWS\Registration
2011-01-11 19:25:31 ----SHD---- C:\System Volume Information
2011-01-11 19:25:31 ----D---- C:\WINDOWS\system32\Restore
2011-01-11 18:59:44 ----A---- C:\WINDOWS\setuplog.txt
2011-01-11 18:56:36 ----A---- C:\WINDOWS\OEWABLog.txt
2011-01-11 18:56:32 ----A---- C:\WINDOWS\ODBCINST.INI
2011-01-11 18:56:13 ----ASH---- C:\WINDOWS\fonts\desktop.ini
2011-01-11 18:56:09 ----D---- C:\WINDOWS\system32\ias
2011-01-11 18:55:39 ----RD---- C:\WINDOWS\Web
2011-01-11 18:55:29 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-01-11 18:55:17 ----A---- C:\WINDOWS\win.ini
2011-01-11 18:55:13 ----D---- C:\WINDOWS\system32\oobe
2011-01-11 18:54:29 ----D---- C:\WINDOWS\system32\Com
2011-01-11 18:53:57 ----D---- C:\Program Files\Messenger
2011-01-11 18:53:56 ----D---- C:\WINDOWS\system32\wbem
2011-01-11 18:48:21 ----D---- C:\WINDOWS\Help
2011-01-11 18:47:59 ----D---- C:\WINDOWS\system32\CatRoot
2011-01-11 18:44:15 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini
2011-01-11 17:53:24 ----D---- C:\Program Files\TacxFortius
2011-01-11 16:36:02 ----D---- C:\WINDOWS\SoftwareDistribution
2011-01-06 21:16:12 ----HD---- C:\Program Files\InstallShield Installation Information
2011-01-06 21:16:05 ----D---- C:\WINDOWS\system32\DirectX
2011-01-06 20:52:35 ----RSD---- C:\WINDOWS\assembly
2011-01-06 20:52:35 ----D---- C:\WINDOWS\Microsoft.NET
2011-01-06 19:13:51 ----D---- C:\Program Files\NVIDIA Corporation
2011-01-06 19:08:00 ----SD---- C:\Documents and Settings\Michal\Data aplikací\Microsoft
2010-12-23 13:14:23 ----D---- C:\Program Files\Opera

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 prohlp02;StarForce Protection Helper Driver v2; C:\WINDOWS\System32\drivers\prohlp02.sys [2003-10-10 62720]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\WINDOWS\System32\drivers\prosync1.sys [2003-09-06 6944]
R0 sfhlp01;StarForce Protection Helper Driver; C:\WINDOWS\System32\drivers\sfhlp01.sys [2003-09-06 4832]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-01-06 218176]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2003-10-10 52128]
R3 catchme;catchme; \??\C:\DOCUME~1\Michal\LOCALS~1\Temp\catchme.sys []
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-10-16 9623680]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WinDriver6;WinDriver6; C:\WINDOWS\system32\drivers\windrvr6.sys [2004-10-11 316192]
S2 TACXDEV;Tacx I-magic Trainer USB Driver (I-magic.sys); C:\WINDOWS\System32\Drivers\I-magic.sys [2004-09-29 26356]
S3 mbr;mbr; \??\C:\DOCUME~1\Michal\LOCALS~1\Temp\mbr.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-10-16 156776]
R2 Printer Control;Printer Control; C:\WINDOWS\system32\PrintCtrl.exe [2009-10-28 65536]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-06-11 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]

-----------------EOF-----------------

[Rudy]

1. Toto znáte: C:\Program Files\STRAYK ?
2. Rád bych viděl log z ComboFix, který jste provedl.
3. Tento log vypadá čistý.
4. Jaký konkrétní problém máte?

[Michele]

1. Toto znáte: C:\Program Files\STRAYK ?
2. Rád bych viděl log z ComboFix, který jste provedl.
3. Tento log vypadá čistý.
4. Jaký konkrétní problém máte?

------------------------------------------------------------------------
1. Díky "Strayk"jsem smazal a problem zmizel.
2. log Combifixu posílám níže
4. při běžné práci na počítači se mi samovolně spustil mně neznámý a mnou neinstalovaný program , který hlásil napadení virem a automaticky mne "hodil" na stránky s nabídkou nákupu antivirového programu.
ComboFix ho paralizoval , ale při další kontrole se dožadoval vypnutí onoho záhadného antivirováho programu "Personal Internet Security 2011" . Vše ustalo až po odstranění Vámi označeného souboru.
Ještě jednou Díky
M

ComboFix 11-01-10.08 - Michal 11.01.2011 20:09:28.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.793 [GMT 1:00]
Spuštěný z: c:\documents and settings\Michal\Dokumenty\Downloads\ComboFix.exe
AV: Personal Internet Security 2011 *Enabled/Updated* {6C1F0DCF-8B33-45C2-8C60-A7B5BB7F4C56}
FW: Personal Internet Security 2011 *Enabled* {6139C92F-6C08-4A57-8BBC-8928B75A1C02}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\62ed84
c:\documents and settings\All Users\Data aplikací\62ed84\09c3c29efbcfbf1f8e7db3c7d8c4a3df.ocx
c:\documents and settings\All Users\Data aplikací\62ed84\1721.mof
c:\documents and settings\All Users\Data aplikací\62ed84\62ed84f7129fd213d249ae802c53fa98.ocx
c:\documents and settings\All Users\Data aplikací\62ed84\BackUp\Microsoft Office.lnk
c:\documents and settings\All Users\Data aplikací\62ed84\ksgik01uw5e7tgu8zix1u8z6argm9q01u8bny2p45ek.dll
c:\documents and settings\All Users\Data aplikací\62ed84\PI62e_231.exe
c:\documents and settings\All Users\Data aplikací\62ed84\PIS.ico
c:\documents and settings\Michal\Data aplikací\Personal Internet Security 2011
c:\documents and settings\Michal\Data aplikací\Personal Internet Security 2011\Instructions.ini
c:\documents and settings\Michal\Plocha\Personal Internet Security 2011.lnk
c:\documents and settings\Michal\Recent\ANTIGEN.dll
c:\documents and settings\Michal\Recent\cb.tmp
c:\documents and settings\Michal\Recent\CLSV.exe
c:\documents and settings\Michal\Recent\CLSV.sys
c:\documents and settings\Michal\Recent\CLSV.tmp
c:\documents and settings\Michal\Recent\energy.sys
c:\documents and settings\Michal\Recent\fan.dll
c:\documents and settings\Michal\Recent\hymt.tmp
c:\documents and settings\Michal\Recent\kernel32.drv
c:\documents and settings\Michal\Recent\kernel32.tmp
c:\documents and settings\Michal\Recent\pal.dll
c:\documents and settings\Michal\Recent\pal.exe
c:\documents and settings\Michal\Recent\PE.dll
c:\documents and settings\Michal\Recent\ppal.tmp
c:\documents and settings\Michal\Recent\SICKBOY.tmp
c:\documents and settings\Michal\Recent\tjd.drv
c:\documents and settings\Michal\Recent\tjd.exe
c:\windows\system32\sshnas21.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS
-------\Service_SSHNAS


((((((((((((((((((((((((( Soubory vytvořené od 2010-12-11 do 2011-01-11 )))))))))))))))))))))))))))))))
.

2011-01-11 18:29 . 2011-01-11 18:29 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG Security Toolbar
2011-01-11 17:58 . 2004-08-03 20:32 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2011-01-11 17:57 . 2004-08-03 20:32 233527 -c--a-w- c:\windows\system32\dllcache\imjprw.exe
2011-01-11 17:56 . 2004-08-17 13:49 834048 -c--a-w- c:\windows\system32\dllcache\inetmgr.dll
2011-01-11 17:47 . 2004-08-03 21:31 20992 ----a-w- c:\windows\system32\drivers\RTL8139.sys
2011-01-11 17:44 . 2001-10-25 14:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2011-01-11 17:44 . 2001-10-25 14:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-01-11 17:44 . 2001-10-25 14:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2011-01-11 17:44 . 2001-10-25 14:00 13312 ----a-w- c:\windows\system32\irclass.dll
2011-01-11 17:44 . 2004-08-17 14:46 14043 ----a-r- c:\windows\SET33.tmp
2011-01-11 17:44 . 2004-08-17 14:46 1086058 ----a-r- c:\windows\SET27.tmp
2011-01-11 17:44 . 2004-08-17 14:50 1014483 ----a-r- c:\windows\SET24.tmp
2011-01-11 17:29 . 2011-01-11 18:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG10
2011-01-11 17:24 . 2011-01-11 18:26 -------- d-----w- c:\documents and settings\All Users\Data aplikací\MFAData
2011-01-11 17:16 . 2011-01-11 17:21 -------- d-----w- c:\program files\Alwil Software
2011-01-11 17:16 . 2011-01-11 17:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2011-01-11 17:09 . 2011-01-11 17:09 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\PIYTQYCS
2011-01-10 18:07 . 2011-01-10 18:07 -------- d-----w- c:\documents and settings\Michal\Data aplikací\Iceni
2011-01-10 18:07 . 2011-01-10 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Iceni
2011-01-10 18:07 . 2011-01-10 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Aspell
2011-01-10 18:07 . 2011-01-10 18:07 -------- d-----w- c:\program files\Iceni
2011-01-10 17:24 . 2011-01-10 17:13 215040 ----a-w- c:\windows\Mnideb.exe
2011-01-10 17:10 . 2011-01-10 17:10 215040 ----a-w- c:\windows\Mnidea.exe
2011-01-10 16:48 . 2011-01-10 16:48 -------- d-----w- c:\documents and settings\Michal\Local Settings\Data aplikací\Iceni
2011-01-10 15:54 . 2011-01-10 15:54 -------- d-----w- c:\documents and settings\Michal\Data aplikací\Foxit Software
2011-01-10 13:39 . 2011-01-10 13:39 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Foxit Software
2011-01-10 13:34 . 2011-01-10 16:41 -------- d-----w- c:\program files\Foxit Software
2011-01-06 19:52 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2011-01-06 19:48 . 2011-01-06 19:48 -------- d-----w- c:\program files\Microsoft Games
2011-01-06 18:58 . 2011-01-06 18:58 -------- d-----w- c:\program files\Creative
2011-01-06 18:58 . 2002-06-06 13:38 139264 ----a-w- c:\windows\system32\eax.dll
2011-01-06 18:58 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2011-01-06 18:47 . 2011-01-06 19:00 -------- d-----w- c:\program files\Mafia
2011-01-06 18:47 . 2002-08-29 17:33 319488 ----a-r- c:\windows\system32\MafiaSetup.exe
2011-01-06 18:23 . 2011-01-06 18:23 218176 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-01-06 18:23 . 2011-01-06 18:23 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-01-06 18:23 . 2011-01-06 18:47 -------- d-----w- c:\documents and settings\Michal\Data aplikací\DAEMON Tools Lite
2011-01-06 18:23 . 2011-01-06 18:23 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2011-01-06 18:16 . 2011-01-06 18:16 -------- d-----w- c:\program files\uTorrent
2011-01-06 18:16 . 2011-01-10 21:46 -------- d-----w- c:\documents and settings\Michal\Data aplikací\uTorrent
2011-01-06 18:13 . 2011-01-11 17:47 240592 ----a-w- c:\windows\system32\nvdrsdb0.bin
2011-01-06 18:13 . 2011-01-11 17:47 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-01-06 18:13 . 2011-01-11 17:47 240592 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-01-06 18:12 . 2010-10-16 18:55 888424 ----a-w- c:\windows\system32\nvdispco32.dll
2011-01-06 18:12 . 2010-10-16 18:55 813672 ----a-w- c:\windows\system32\nvgenco32.dll
2011-01-06 18:12 . 2010-10-16 18:55 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-01-06 18:12 . 2010-10-16 18:55 13012992 ----a-w- c:\windows\system32\nvcompiler.dll
2011-01-06 18:12 . 2011-01-06 18:12 -------- d-----w- C:\NVIDIA
2010-12-15 19:04 . 2011-01-11 07:58 -------- d-----w- c:\documents and settings\Michal\Data aplikací\STRAYK
2010-12-15 19:04 . 2010-12-15 19:04 -------- d-----w- c:\program files\STRAYK
2010-12-15 19:04 . 2010-12-15 19:04 844129 ----a-w- c:\documents and settings\Michal\Data aplikací\unins000.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-16 18:55 . 2009-10-29 13:54 14532608 ----a-w- c:\windows\system32\nvoglnt.dll
2010-10-16 18:55 . 2009-10-29 13:54 4882432 ----a-w- c:\windows\system32\nvcuda.dll
2010-10-16 18:55 . 2009-10-29 13:54 2932840 ----a-w- c:\windows\system32\nvcuvid.dll
2010-10-16 18:55 . 2009-10-29 13:54 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-10-16 18:55 . 2009-10-29 13:54 9623680 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-10-16 18:55 . 2009-10-29 13:54 6359552 ----a-w- c:\windows\system32\nv4_disp.dll
2010-10-16 18:55 . 2009-10-29 13:54 1462272 ----a-w- c:\windows\system32\nvapi.dll
2010-10-16 11:04 . 2010-10-16 11:04 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-10-16 11:04 . 2010-10-16 11:04 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-10-16 11:04 . 2010-10-16 11:04 13851752 ----a-w- c:\windows\system32\nvcpl.dll
2010-10-16 11:04 . 2010-10-16 11:04 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-10-16 11:04 . 2010-10-16 11:04 156776 ----a-w- c:\windows\system32\nvsvc32.exe
2010-10-16 11:04 . 2010-10-16 11:04 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-10-14 23:44 . 2010-10-14 23:44 4280320 ----a-w- c:\windows\system32\GPhotos.scr
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"strayk"="c:\program files\STRAYK\strayk.exe" [2010-01-30 872448]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-05 1305408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"PrintDisp"="c:\windows\system32\PrintDisp.exe" [2010-07-23 975360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [6.1.2011 19:23 218176]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [10.1.2011 17:46 65536]
S2 TACXDEV;Tacx I-magic Trainer USB Driver (I-magic.sys);c:\windows\system32\drivers\I-magic.sys [7.12.2010 18:09 26356]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe --> c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyServer = http=127.0.0.1:25577
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
HKCU-Run-Personal Internet Security 2011 - c:\documents and settings\All Users\Data aplikací\62ed84\PI62e_231.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-11 20:15
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(436)
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2011-01-11 20:17:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-11 19:17

Před spuštěním: Volných bajtů: 61 479 026 688
Po spuštění: Volných bajtů: 61 539 926 016

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 9A023AA81AD5A414A3F7B6D3FDAFC6B9

[Rudy]

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\SET33.tmp
c:\windows\SET27.tmp
c:\windows\SET24.tmp
c:\windows\Mnideb.exe
c:\windows\Mnidea.exe

Folder::
c:\program files\STRAYK

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"strayk"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.