win32/cracked.gb

[kaaposch]

píše mi to, že Norton je stále aktivní, ale už je odinstalovanej a nemůžu ho nikde najít, můžu to spustit?

[cernohous13]

ignoruj a zkus spustit

[kaaposch]

teď mi to zas dokola hází okno "V aplikaci Catchme.tmp došlo k chybě a je třeba ji zavřít. Omlouváme se za vzniklé potíže."


ComboFix 11-01-24.02 - kaaposch007 25.01.2011 16:39:58.2.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1592 [GMT 1:00]
Spuštěný z: c:\documents and settings\kaaposch007\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\nt.dll
.
---- Předchozí spuštění -------
.
c:\documents and settings\kaaposch007\Data aplikací\Local
c:\windows\TEMP\explorer.dat

-- Předchozí spuštění --

Nakažená kopie c:\windows\system32\winlogon.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{9C9C0AC9-47F1-4D8E-B1B7-3515C943BA7A}\RP9\A0000695.EXE

Nakažená kopie c:\windows\system32\winlogon.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{9C9C0AC9-47F1-4D8E-B1B7-3515C943BA7A}\RP9\A0000695.EXE

Nakažená kopie c:\windows\explorer.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{9C9C0AC9-47F1-4D8E-B1B7-3515C943BA7A}\RP17\A0002546.EXE

--------

Nakažená kopie c:\windows\system32\winlogon.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{9C9C0AC9-47F1-4D8E-B1B7-3515C943BA7A}\RP9\A0000695.EXE

Nakažená kopie c:\windows\explorer.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\system volume information\_restore{9C9C0AC9-47F1-4D8E-B1B7-3515C943BA7A}\RP18\A0003533.EXE

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Soubory vytvořené od 2010-12-25 do 2011-01-25 )))))))))))))))))))))))))))))))
.

2011-01-24 22:00 . 2007-06-13 13:23 1033728 ----a-w- c:\windows\OLDA.tmp
2011-01-24 22:00 . 2008-04-14 19:00 1034240 ----a-w- c:\windows\explorer.exe
2011-01-24 19:39 . 2011-01-24 19:39 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\Malwarebytes
2011-01-24 19:39 . 2011-01-24 19:39 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-01-24 19:39 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-24 19:38 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-24 19:38 . 2011-01-24 19:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-24 16:27 . 2011-01-24 16:27 -------- d-----w- C:\rsit
2011-01-24 14:33 . 2011-01-24 14:33 388096 ----a-r- c:\documents and settings\kaaposch007\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-24 14:33 . 2011-01-24 14:33 -------- d-----w- c:\program files\HJT
2011-01-23 21:29 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-23 21:29 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-23 21:29 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-23 21:29 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-23 21:29 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-23 21:29 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-23 21:29 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-23 21:29 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
2011-01-23 21:29 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-23 21:29 . 2011-01-23 21:29 -------- d-----w- c:\program files\Alwil Software
2011-01-23 21:29 . 2011-01-23 21:29 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2011-01-23 21:19 . 2011-01-23 21:19 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\Tific
2011-01-23 20:52 . 2011-01-23 21:27 61440 ----a-w- c:\program files\Microsoft .NET Framework 3.6 SP8.exe
2011-01-20 20:19 . 2011-01-20 20:19 -------- d-----w- c:\program files\Windows Sidebar
2011-01-10 21:24 . 2011-01-10 21:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-01-10 20:39 . 2011-01-10 20:39 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-01-10 17:24 . 2011-01-10 17:24 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\DivX
2011-01-10 17:22 . 2011-01-10 17:22 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-01-10 17:20 . 2011-01-10 17:21 -------- d-----w- c:\program files\DivX
2011-01-09 19:11 . 2011-01-09 19:11 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DivX
2011-01-06 15:13 . 2011-01-06 15:13 -------- d-----w- c:\program files\Alcohol Soft
2011-01-06 15:06 . 2011-01-06 15:06 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-12-28 12:31 . 2010-12-28 12:31 -------- d-----w- c:\documents and settings\kaaposch007\Local Settings\Data aplikací\Opera
2010-12-28 12:31 . 2010-12-28 12:31 -------- d-----w- c:\program files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-25 15:50 . 2009-08-19 23:33 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2011-01-25 15:49 . 2009-09-05 20:40 57752 ----a-w- c:\windows\system32\rpcnet.dll
2011-01-25 15:30 . 2009-08-19 23:46 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2011-01-16 15:53 . 2009-09-05 20:40 57752 ------w- c:\windows\system32\rpcnet.exe
2010-12-22 23:22 . 2010-05-14 16:20 18944 ----a-w- c:\windows\system32\instgf32.exe
2010-11-18 18:15 . 2009-08-19 23:39 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 17:53 . 2010-04-15 21:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 15:34 . 2010-04-11 22:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-09 14:52 . 2009-04-02 11:13 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-06 00:23 . 2009-04-02 11:13 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:23 . 2009-04-02 11:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:23 . 2009-04-02 11:13 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2009-04-02 11:13 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2009-04-02 11:13 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2009-04-02 11:13 290048 ----a-w- c:\windows\system32\atmfd.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 16:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2009-04-07 3405048]
"Desktop Calendar"="c:\program files\Desktop Calendar\Desktop Calendar.exe" [2003-10-31 442368]
"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2007-11-30 51768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"JFSW2Launch"="c:\documents and settings\kaaposch007\Data aplikací\Transcend\JFSW2\JFSW2Launch.exe" [2010-03-25 176128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-16 13594624]
"nwiz"="nwiz.exe" [2009-04-16 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-16 86016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-12 1434920]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2009-03-20 174648]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-26 17567744]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-04-17 1593344]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-08-20 3054136]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-09-30 851968]
"ASDS"="c:\program files\ASUS\ASDS\ASDS.exe" [2009-03-18 98304]
"Power4Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2009-03-03 92728]
"ASUS Power4Gear Turbo"="c:\program files\ASUS\ASUS Power4Gear Turbo\P4GTurbo.exe" [2009-03-18 145976]
"Net4Switch"="c:\program files\ASUS\Net4Switch\Net4Switch.exe" [2007-11-20 1145400]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2009-06-24 272952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-8-2 2760704]
FancyStart daemon.lnk - c:\windows\Installer\{A9FEB6D7-9C52-49FC-B956-7AB275B78890}\_5598CE641C54B66A23693F.exe [2009-8-20 12862]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Aspwdflt]
2009-02-10 19:33 1556480 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]
2008-03-25 14:24 567560 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\kaaposch007\\Dokumenty\\Games\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"c:\\Documents and Settings\\kaaposch007\\Dokumenty\\Games\\World of Warcraft\\Launcher.exe"=
"C:/Program Files/iTALC\\ica.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.1.2011 16:06 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23.1.2011 22:29 294608]
R1 tidnet;TID NDIS Protocol Driver;c:\windows\system32\drivers\tidnet.sys [15.9.2009 10:51 19200]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23.1.2011 22:29 17744]
R2 icas;iTALC Client;c:\program files\iTALC\ica.exe [3.9.2010 15:40 806926]
R2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [7.4.2009 10:04 70880]
R3 CRFILTER;USB Mass Storage Filter;c:\windows\system32\drivers\CRFILTER.sys [6.4.2008 23:00 6656]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [22.1.2009 0:43 46752]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [20.8.2009 1:07 233128]
S2 gupdate1caba1b92b0872a;Služba Google Update (gupdate1caba1b92b0872a);c:\program files\Google\Update\GoogleUpdate.exe [2.3.2010 16:18 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [20.8.2009 1:01 1684736]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\drivers\ewdcsc.sys [24.12.2010 21:04 24448]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [24.12.2010 21:04 100736]
S3 ipswuio;ipswuio;c:\windows\system32\drivers\ipswuio.sys [8.9.2009 16:20 41656]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = proxy.pisek.elsat.cz:3128
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\kaaposch007\Data aplikací\Mozilla\Firefox\Profiles\rkmrqljh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.startup.homepage - hxxp://flvdirect.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: LoudMo Contextual Ad Assistant: {165da26e-8ee5-bc36-f4e3-da26ff7b6b27} - c:\program files\Mozilla Firefox\extensions\{165da26e-8ee5-bc36-f4e3-da26ff7b6b27}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-SmartRAM - c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-25 16:50
Windows 5.1.2600 Service Pack 3 FAT NTAPI

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1180)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll
c:\program files\Common Files\SPBA\homefus2.dll
c:\program files\Common Files\SPBA\infql2.dll
c:\program files\Common Files\SPBA\homepass.dll
c:\program files\Common Files\SPBA\bio.dll
c:\program files\Common Files\SPBA\qlbase.dll

- - - - - - - > 'lsass.exe'(1236)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll

- - - - - - - > 'explorer.exe'(3864)
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rpcnet.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\windows\system32\igfxext.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\ACEngSvr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Celkový čas: 2011-01-25 16:55:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-25 15:55

Před spuštěním: Volných bajtů: 39 173 619 712
Po spuštění: Volných bajtů: 39 086 227 456

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 2A6FC838A6D114BBB0AAB73DA8E9EF88

[cernohous13]

Pokud nemáš ComboFix na ploše, přesuň jej tam.
Otevři Poznámkový blok (Notepad) a zkopíruj celý zelený text z "CFscriptu".
Soubor ulož na plochu jako CFscript.txt a jeho ikonu přetáhni myší nad ikonu ComboFixu - tam pusť.

ComboFix se spustí - počkej na log a vlož ho sem.

CFscript

Kód: Vybrat vše

KillAll::

Rootkit::
c:\windows\OLDA.tmp

File::
c:\program files\Microsoft .NET Framework 3.6 SP8.exe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
c:\program files\Common Files\Symantec Shared

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-

Driver::
gupdate1caba1b92b0872a

SecCenter::

[kaaposch]

ComboFix 11-01-24.02 - kaaposch007 25.01.2011 18:03:41.3.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1502 [GMT 1:00]
Spuštěný z: c:\documents and settings\kaaposch007\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\kaaposch007\Plocha\CFScript.txt.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FILE ::
"c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy"
"c:\program files\Common Files\Symantec Shared"
"c:\program files\Microsoft .NET Framework 3.6 SP8.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GUPDATE1CABA1B92B0872A
-------\Service_gupdate1caba1b92b0872a


((((((((((((((((((((((((( Soubory vytvořené od 2010-12-25 do 2011-01-25 )))))))))))))))))))))))))))))))
.

2011-01-24 22:00 . 2007-06-13 13:23 1033728 ----a-w- c:\windows\OLDA.tmp
2011-01-24 22:00 . 2008-04-14 19:00 1034240 ----a-w- c:\windows\explorer.exe
2011-01-24 19:39 . 2011-01-24 19:39 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\Malwarebytes
2011-01-24 19:39 . 2011-01-24 19:39 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-01-24 19:39 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-24 19:38 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-24 19:38 . 2011-01-24 19:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-24 16:27 . 2011-01-24 16:27 -------- d-----w- C:\rsit
2011-01-24 14:33 . 2011-01-24 14:33 388096 ----a-r- c:\documents and settings\kaaposch007\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-24 14:33 . 2011-01-24 14:33 -------- d-----w- c:\program files\HJT
2011-01-23 21:29 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-23 21:29 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-23 21:29 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-23 21:29 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-23 21:29 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-23 21:29 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-23 21:29 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-23 21:29 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
2011-01-23 21:29 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-23 21:29 . 2011-01-23 21:29 -------- d-----w- c:\program files\Alwil Software
2011-01-23 21:29 . 2011-01-23 21:29 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2011-01-23 21:19 . 2011-01-23 21:19 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\Tific
2011-01-23 20:52 . 2011-01-23 21:27 61440 ----a-w- c:\program files\Microsoft .NET Framework 3.6 SP8.exe
2011-01-20 20:19 . 2011-01-20 20:19 -------- d-----w- c:\program files\Windows Sidebar
2011-01-10 21:24 . 2011-01-10 21:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-01-10 20:39 . 2011-01-10 20:39 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-01-10 17:24 . 2011-01-10 17:24 -------- d-----w- c:\documents and settings\kaaposch007\Data aplikací\DivX
2011-01-10 17:22 . 2011-01-10 17:22 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-01-10 17:20 . 2011-01-10 17:21 -------- d-----w- c:\program files\DivX
2011-01-09 19:11 . 2011-01-09 19:11 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DivX
2011-01-06 15:13 . 2011-01-06 15:13 -------- d-----w- c:\program files\Alcohol Soft
2011-01-06 15:06 . 2011-01-06 15:06 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-12-28 12:31 . 2010-12-28 12:31 -------- d-----w- c:\documents and settings\kaaposch007\Local Settings\Data aplikací\Opera
2010-12-28 12:31 . 2010-12-28 12:31 -------- d-----w- c:\program files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-25 17:13 . 2009-08-19 23:33 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2011-01-25 17:13 . 2009-09-05 20:40 57752 ----a-w- c:\windows\system32\rpcnet.dll
2011-01-25 15:30 . 2009-08-19 23:46 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2011-01-16 15:53 . 2009-09-05 20:40 57752 ------w- c:\windows\system32\rpcnet.exe
2010-12-22 23:22 . 2010-05-14 16:20 18944 ----a-w- c:\windows\system32\instgf32.exe
2010-11-18 18:15 . 2009-08-19 23:39 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 17:53 . 2010-04-15 21:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 15:34 . 2010-04-11 22:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-09 14:52 . 2009-04-02 11:13 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-06 00:23 . 2009-04-02 11:13 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:23 . 2009-04-02 11:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:23 . 2009-04-02 11:13 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2009-04-02 11:13 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2009-04-02 11:13 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2009-04-02 11:13 290048 ----a-w- c:\windows\system32\atmfd.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 16:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2009-04-07 3405048]
"Desktop Calendar"="c:\program files\Desktop Calendar\Desktop Calendar.exe" [2003-10-31 442368]
"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2007-11-30 51768]
"JFSW2Launch"="c:\documents and settings\kaaposch007\Data aplikací\Transcend\JFSW2\JFSW2Launch.exe" [2010-03-25 176128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-16 13594624]
"nwiz"="nwiz.exe" [2009-04-16 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-16 86016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-12 1434920]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2009-03-20 174648]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-26 17567744]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-04-17 1593344]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-08-20 3054136]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-09-30 851968]
"ASDS"="c:\program files\ASUS\ASDS\ASDS.exe" [2009-03-18 98304]
"Power4Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2009-03-03 92728]
"ASUS Power4Gear Turbo"="c:\program files\ASUS\ASUS Power4Gear Turbo\P4GTurbo.exe" [2009-03-18 145976]
"Net4Switch"="c:\program files\ASUS\Net4Switch\Net4Switch.exe" [2007-11-20 1145400]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2009-06-24 272952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-8-2 2760704]
FancyStart daemon.lnk - c:\windows\Installer\{A9FEB6D7-9C52-49FC-B956-7AB275B78890}\_5598CE641C54B66A23693F.exe [2009-8-20 12862]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Aspwdflt]
2009-02-10 19:33 1556480 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]
2008-03-25 14:24 567560 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\kaaposch007\\Dokumenty\\Games\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"c:\\Documents and Settings\\kaaposch007\\Dokumenty\\Games\\World of Warcraft\\Launcher.exe"=
"C:/Program Files/iTALC\\ica.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.1.2011 16:06 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23.1.2011 22:29 294608]
R1 tidnet;TID NDIS Protocol Driver;c:\windows\system32\drivers\tidnet.sys [15.9.2009 10:51 19200]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23.1.2011 22:29 17744]
R2 icas;iTALC Client;c:\program files\iTALC\ica.exe [3.9.2010 15:40 806926]
R2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [7.4.2009 10:04 70880]
R3 CRFILTER;USB Mass Storage Filter;c:\windows\system32\drivers\CRFILTER.sys [6.4.2008 23:00 6656]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [22.1.2009 0:43 46752]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [20.8.2009 1:07 233128]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [20.8.2009 1:01 1684736]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\drivers\ewdcsc.sys [24.12.2010 21:04 24448]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [24.12.2010 21:04 100736]
S3 ipswuio;ipswuio;c:\windows\system32\drivers\ipswuio.sys [8.9.2009 16:20 41656]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = proxy.pisek.elsat.cz:3128
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\kaaposch007\Data aplikací\Mozilla\Firefox\Profiles\rkmrqljh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.startup.homepage - hxxp://flvdirect.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: LoudMo Contextual Ad Assistant: {165da26e-8ee5-bc36-f4e3-da26ff7b6b27} - c:\program files\Mozilla Firefox\extensions\{165da26e-8ee5-bc36-f4e3-da26ff7b6b27}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-25 18:14
Windows 5.1.2600 Service Pack 3 FAT NTAPI

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1180)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll
c:\program files\Common Files\SPBA\homefus2.dll
c:\program files\Common Files\SPBA\infql2.dll
c:\program files\Common Files\SPBA\homepass.dll
c:\program files\Common Files\SPBA\bio.dll
c:\program files\Common Files\SPBA\qlbase.dll

- - - - - - - > 'lsass.exe'(1236)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll

- - - - - - - > 'explorer.exe'(3828)
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rpcnet.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\dwwin.exe
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\windows\RTHDCPL.EXE
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\ACEngSvr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Celkový čas: 2011-01-25 18:19:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-25 17:19
ComboFix2.txt 2011-01-25 15:55

Před spuštěním: Volných bajtů: 39 106 576 384
Po spuštění: Volných bajtů: 39 024 066 560

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 47AB7C6D3D39E55D214433B936A4410A

[cernohous13]

tak nám nějak CF nezabírá.

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“ (pro Vistu a Win7 – pravým a „Run As Administrator“).
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „Moveit!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\

OTMscript

Kód: Vybrat vše

:Files
c:\program files\Microsoft .NET Framework 3.6 SP8.exe
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
c:\program files\Common Files\Symantec Shared
c:\windows\OLDA.tmp
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:commands
[PURITY]
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[REBOOT]

[kaaposch]

All processes killed
========== FILES ==========
c:\program files\Microsoft .NET Framework 3.6 SP8.exe moved successfully.
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Recovery folder moved successfully.
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy\Logs folder moved successfully.
c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy folder moved successfully.
c:\program files\Common Files\Symantec Shared\EENGINE folder moved successfully.
c:\program files\Common Files\Symantec Shared folder moved successfully.
c:\windows\OLDA.tmp moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAF.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC6.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF9.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP13A.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4AE.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP517.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5F1.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP216.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP43.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP356.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP44F.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4C4.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP280.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP310.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP16C.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP195.tmp folder moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: kaaposch007
->Temp folder emptied: 82357 bytes
->Temporary Internet Files folder emptied: 10387482 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 34147663 bytes
->Google Chrome cache emptied: 73055098 bytes
->Opera cache emptied: 31145541 bytes
->Flash cache emptied: 3099 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 196 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 142,00 mb


Restore points cleared and new OTM Restore Point set!

OTM by OldTimer - Version 3.1.17.2 log created on 01252011_183541

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\italc_client.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[cernohous13]

zdá se, že máš čisto
a jestli už nenacházíš nic podivného, tak po sobě uklidím

ComboFix odinstalujeme
jdi Start -> Spustit... a zkopíruj ComboFix /Uninstall (pozor, za x je mezera) -> OK

Stáhni TempFolderCleaner http://oldtimer.geekstogo.com/TFC.exe
Zavři všechny programy a spusť. Po ukončení akce bude PC restartován.
Pokud ne, restartuj sám.
(čistí Temp složky , nečistí URL, historii, prefetch ani cookies)

stáhni program OTC tady: http://oldtimer.geekstogo.com/OTC.exe - spusť ho -> "CleanUp" (smaže dříve použité čističe)

Mohu doporučit kontrolu a vyčištění Ccleanerem

Stáhni Ccleaner - http://www.slunecnice.cz/sw/ccleaner/
Při instalaci vyhodit fajfku u "Instalovat Yahoo! Toolbar"

zavřít Internetový prohlížeč a
spustit "Čistič" > "Spustit Ccleaner" - odstraní nepotřebné
spustit "Registry" > "Hledej problémy" > "Opravit vybrané problémy"
souhlas se zálohou registrů - opakovat dokud nebudou registry čisté.
spustit "Nástroje" > "Start" - tady můžeš zkusit deaktivovat procesy, které při spuštění nepotřebuješ (pokud by ti potom něco nechodilo, stejným způsobem je povolíš)

Návod:http://jnp.zive.cz/Clanky/Prirucka-do-k ... fault.aspx

Ten si můžeš nechat i na budoucí občasné čištění.

Nakonec mi dej současný RSIT log

Po vyčištění by se hodila defragmentace
doporučuji http://www.slunecnice.cz/sw/defraggler/ + čeština

[kaaposch]

smázlo mi to lokální profil, to je normální? dá se to nějak vrátit?

[cernohous13]

můžeš specifikovat pojem lokální profil ?
zatím neví o co jde

[kaaposch]

celý účet kaaposch007 je nový, dokumenty, nastavení, vše...

prý nemůže nalézt místní profil...

[kaaposch]

tak v documents and settings pořád je, ale nenačetl se ani napodruhé, ještě zkusím restart...

[cernohous13]

skutečně nikde nevidím, že by se mazal profil

[kaaposch]

už ok

[cernohous13]

všechny procedury provedeny?

hoď RSIT