prosím o konzultaci s výsledkem logu

[heavoc]

ComboFix 11-06-17.04 - Administrator 18.06.2011 7:56.1.2 - x86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2918 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Majitel\0.35537492909183166.exe
c:\documents and settings\Majitel\Data aplikací\Desktopicon
c:\documents and settings\Majitel\Local Settings\Data aplikací\mhk.exe
c:\drivergenius\DriverGenius.exe
c:\program files\Downloaded Installers
c:\program files\Downloaded Installers\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\setup.msi
c:\windows\IsUn0405.exe
c:\windows\system32\Drivers\ekjqywaf.sys
E:\resycled
F:\resycled
G:\resycled
H:\resycled
I:\resycled
J:\resycled
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-18 do 2011-06-18 )))))))))))))))))))))))))))))))
.
.
2011-06-18 05:50 . 2011-06-18 05:30 1007120 ----a-w- C:\rkill.scr
2011-06-18 05:50 . 2011-06-18 05:29 1007120 ----a-w- C:\rkill.exe
2011-06-18 05:50 . 2011-06-18 05:29 1007120 ----a-w- C:\rkill.com
2011-06-16 12:54 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-12 15:19 . 2011-05-25 07:25 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-06-12 15:19 . 2011-05-25 07:25 16068608 ----a-w- c:\windows\system32\nvoglnt.dll
2011-06-12 15:19 . 2011-05-25 07:25 2808936 ----a-w- c:\windows\system32\nvcuvid.dll
2011-06-12 15:19 . 2011-05-25 07:25 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-06-12 15:19 . 2011-05-25 07:25 5332992 ----a-w- c:\windows\system32\nvcuda.dll
2011-06-12 15:19 . 2011-05-25 07:25 13004800 ----a-w- c:\windows\system32\nvcompiler.dll
2011-06-12 15:19 . 2011-05-25 07:25 2328576 ----a-w- c:\windows\system32\nvapi.dll
2011-06-11 17:08 . 2005-05-04 07:20 53248 ------w- c:\windows\system32\wdmioctl.dll
2011-06-11 17:08 . 2001-09-11 13:20 1285632 ------w- c:\windows\system32\SMMedia.dll
2011-06-11 17:08 . 2006-07-10 13:42 49152 ------w- c:\windows\system32\DSndUp.exe
2011-06-11 17:08 . 2002-04-17 13:05 45056 ------w- c:\windows\system32\CleanUp.exe
2011-06-11 17:02 . 2006-08-18 08:30 446464 ----a-w- c:\windows\system32\CapabilityTable.exe
2011-06-11 17:01 . 2006-08-07 16:39 52736 ----a-r- c:\windows\system32\drivers\NVENETFD.sys
2011-06-11 17:01 . 2006-08-07 16:37 202240 ----a-w- c:\windows\system32\fdco1.dll
2011-06-11 17:01 . 2011-06-11 17:01 -------- d-----w- c:\windows\NV20203364.TMP
2011-06-11 17:01 . 2006-08-07 16:39 110080 ----a-r- c:\windows\system32\drivers\nvtcp.sys
2011-06-11 17:01 . 2006-08-03 23:48 35840 ----a-w- c:\windows\system32\nvconrm.dll
2011-06-11 17:01 . 2006-08-03 23:48 208896 ----a-w- c:\windows\system32\nvunrm.exe
2011-06-11 17:01 . 2006-08-07 16:39 18944 ----a-r- c:\windows\system32\drivers\nvnetbus.sys
2011-06-11 17:01 . 2006-08-07 16:39 1104896 ----a-r- c:\windows\system32\drivers\nvnrm.sys
2011-06-11 17:01 . 2006-08-07 16:38 261120 ----a-r- c:\windows\system32\drivers\nvsnpu.sys
2011-06-11 17:01 . 2006-08-07 16:37 10240 ----a-w- c:\windows\system32\bdco1.dll
2011-06-11 16:54 . 2006-10-25 07:48 12288 ----a-r- c:\windows\system32\drivers\EIO.sys
2011-06-11 16:39 . 2011-06-11 16:39 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-11 16:11 . 2011-06-11 16:11 -------- d-----w- c:\documents and settings\UpdatusUser
2011-06-11 16:10 . 2011-06-12 15:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\NVIDIA
2011-06-11 16:10 . 2011-05-25 07:26 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-06-11 16:10 . 2011-05-25 07:25 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-11 16:10 . 2011-05-25 07:25 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-11 16:01 . 2011-06-11 16:01 -------- d-----w- c:\program files\A4Tech
2011-06-11 15:56 . 2005-09-21 14:25 12800 ----a-r- c:\windows\system32\drivers\Amusbprt.sys
2011-06-11 15:56 . 2004-08-25 15:09 7424 ----a-w- c:\windows\system32\drivers\Arfumftr.sys
2011-06-11 15:56 . 2005-09-29 08:12 49152 ----a-w- c:\windows\system32\Amhooker.dll
2011-06-11 15:56 . 2005-09-21 14:27 12800 ----a-w- c:\windows\system32\drivers\Amps2prt.sys
2011-06-11 15:56 . 2005-09-21 14:26 6656 ----a-r- c:\windows\system32\drivers\Amfilter.sys
2011-06-06 06:33 . 2011-06-06 06:33 -------- d-----w- c:\program files\Real
2011-06-06 06:33 . 2011-06-06 06:33 -------- d-----w- c:\program files\Common Files\xing shared
2011-06-02 09:44 . 2011-06-06 14:09 -------- d-----w- C:\Mozilla Firefox 4
2011-05-29 07:09 . 2011-05-29 07:09 35296 ----a-w- c:\windows\system32\drivers\Dvd43.sys
2011-05-29 06:28 . 2011-06-18 06:00 -------- d-----w- C:\DriverGenius
2011-05-28 15:04 . 2010-09-30 15:57 30528 ----a-w- c:\windows\system32\TURegOpt.exe
2011-05-28 15:01 . 2011-05-28 15:01 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2011-05-28 14:48 . 2011-05-29 05:40 -------- d-----w- C:\YouTube Converter
2011-05-27 16:32 . 2011-05-27 16:32 10240 ----a-r- c:\documents and settings\Majitel\Data aplikací\Microsoft\Installer\{B94C3B9D-9996-42DC-B58C-A73A91A8FAF8}\IconB94C3B9D.exe
2011-05-27 16:31 . 2011-05-27 16:31 -------- d-----w- C:\InfoMapa 18 HE SPECIAL
2011-05-27 14:58 . 2011-05-27 14:58 -------- d-----w- C:\Virtual
2011-05-27 14:56 . 2011-05-29 07:01 -------- d-----w- c:\documents and settings\All Users\Data aplikací\BufferZone
2011-05-27 14:32 . 2011-05-27 14:32 -------- d-----w- c:\documents and settings\Majitel\Data aplikací\Ashampoo
2011-05-27 14:31 . 2011-05-27 14:31 -------- d-----w- c:\documents and settings\Majitel\Local Settings\Data aplikací\ashampoo
2011-05-27 14:31 . 2011-05-27 14:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ashampoo
2011-05-27 14:31 . 2011-05-27 14:31 -------- d-----w- C:\Ashampoo Photo Commander 8
2011-05-27 14:18 . 2011-02-23 14:54 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-05-27 14:18 . 2011-02-23 15:04 13496 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-05-27 14:18 . 2011-05-27 14:18 -------- d-----w- c:\program files\IObit
2011-05-27 14:18 . 2011-05-27 14:18 -------- d-----w- c:\documents and settings\All Users\Data aplikací\FreeApp
2011-05-27 14:15 . 2011-06-11 10:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
2011-05-22 05:33 . 2011-05-30 08:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-21 18:49 . 2011-05-21 18:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\GARMIN
2011-05-21 18:47 . 2011-05-21 18:54 -------- d-----w- C:\Garmin
2011-05-21 17:00 . 2011-05-21 17:00 -------- d-----w- c:\program files\Garmin GPS Plugin
2011-05-21 17:00 . 2011-05-21 17:00 -------- d-----w- c:\program files\Garmin
2011-05-21 06:29 . 2011-05-21 18:49 -------- d-----w- c:\documents and settings\Majitel\Data aplikací\GARMIN
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-06 11:06 . 2009-04-11 17:50 1390730 ----a-w- c:\windows\system32\AutoPartNt.exe
2011-05-29 07:11 . 2009-07-08 17:01 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2009-07-08 17:01 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-29 06:04 . 2011-02-23 12:30 14886 ----a-w- c:\windows\system32\cleartmp.cmd
2011-05-25 07:25 . 2008-10-27 07:38 4198272 ----a-w- c:\windows\system32\nv4_disp.dll
2011-05-25 07:25 . 2008-10-27 07:38 12753664 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-05-02 15:32 . 2008-10-28 11:58 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2004-08-18 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 07:25 . 2009-07-23 10:16 796672 ----a-w- c:\windows\GPInstall.exe
2011-04-25 16:06 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:06 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:06 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-18 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2004-08-18 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FullShot 9.5"="c:\fullshot 9\FULLSHOT.exe" [2011-05-29 3997696]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"Fraps"="c:\fraps\FRAPS.EXE" [2008-01-14 3182248]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\eset smart security\egui.exe" [2009-05-14 2029640]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-10-05 868352]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
"NvMediaCenter"="NvMCTray.dll" [2011-05-25 111208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Malwarebytes' Anti-Malware"="x:\malwarebytes' anti-malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Majitel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Obsah aplikace OneNote.onetoc2 [2011-3-9 3656]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Orbit.lnk - [N/A]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:22 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 07:26 13895272 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"O&O Defrag Container (Win32)"=c:\o&o defrag pro 10\oodcnt.exe
"Address Book"=c:\program files\Outlook Express\wab.exe /showexisting
"Google Update"="c:\documents and settings\Majitel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"Titan Backup"="i:\nainst~1\TITANB~1.5\TITANB~1\TITANB~2.EXE" /startup
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"PC Suite Tray"="c:\nokia pc suite 7\Nokia PC Suite 7\PCSuite.exe" -onlytray
"OEXPRESS"=c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE
"AlcoholAutomount"="c:\alcohol 120 black and bloody edit.4\axcmd.exe" /automount
"ICQ"="i:\nainstalovane programy\ICQ7.2\ICQ.exe" silent loginmode=4
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"SlimDrivers"="i:\nainstalovane programy\SLIM DRIVERS 2.0\SlimDrivers.exe" -boot
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SSS2007 HotKeys"="c:\steganos security suite 2007\SteganosHotKeyService.exe"
"SSS2007 File Redirection Starter"="c:\steganos security suite 2007\fredirstarter.exe"
"SSS2007 PasswordManagerFFAutoFill"="c:\steganos security suite 2007\PasswordManagerFFAutoFill.exe"
"PWRISOVM.EXE"=c:\power iso\PowerISO\PWRISOVM.EXE
"OpwareSE2"="c:\scansoft\OmniPageSE2.0\OpwareSE2.exe"
"Adobe Reader Speed Launcher"="c:\adobe reader 9\Reader\Reader_sl.exe"
"AsusStartupHelp"=c:\program files\ASUS\AASP\1.00.14\AsRunHelp.exe
"OSSelectorReinstall"=c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
"TrueImageMonitor.exe"=i:\nainstalovane programy\ACRONIS TRUE IMAGE\TrueImageMonitor.exe
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"AcronisTimounterMonitor"=i:\nainstalovane programy\ACRONIS TRUE IMAGE\TimounterMonitor.exe
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe"
"boincmgr"="c:\boinc\bionic\boincmgr.exe" /a /s
"boinctray"="c:\boinc\bionic\boinctray.exe"
"GrooveMonitor"="c:\microsoft office 2007\Office12\GrooveMonitor.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"TkBellExe"="i:\nainstalovane programy\RealPlayer\update\realsched.exe" -osboot
"rfagent"="c:\program files\RFA 8\rfagent32.exe"
"SpyHunter Security Suite"=c:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\MICROSOFT OFFICE 2007\\Office12\\OUTLOOK.EXE"=
"c:\\MICROSOFT OFFICE 2007\\Office12\\GROOVE.EXE"=
"c:\\MICROSOFT OFFICE 2007\\Office12\\ONENOTE.EXE"=
"c:\\ORBIT DOWNLOADER\\orbitdm.exe"=
"c:\\ORBIT DOWNLOADER\\orbitnet.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"i:\\NAINSTALOVANE PROGRAMY\\ICQ7.2\\ICQ.exe"=
"i:\\NAINSTALOVANE PROGRAMY\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Activision\\Wolfenstein Lite Server\\Wolf2MPLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [15.5.2009 19:30 40496]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 SLEE_15_DRIVER;Steganos Live Encryption Engine 15 [Driver];c:\windows\system32\drivers\sleen15.sys [21.2.2007 13:33 80232]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [9.5.2009 20:38 141312]
R2 ekrn;ESET Service;c:\eset smart security\ekrn.exe [14.5.2009 15:47 731840]
R2 MBAMService;MBAMService;x:\malwarebytes' anti-malware\mbamservice.exe [17.6.2011 20:06 366640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11.6.2011 18:10 2214504]
R3 Dvd43;Dvd43;c:\windows\system32\drivers\Dvd43.sys [29.5.2011 9:09 35296]
R3 MaplomL;MaplomL;c:\windows\system32\drivers\maploml.sys [27.11.2008 12:00 38848]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8.7.2009 19:01 22712]
S0 ogqtx;ogqtx;c:\windows\system32\drivers\pyanwbj.sys --> c:\windows\system32\drivers\pyanwbj.sys [?]
S3 FileObjInfo;STFileDriver;c:\documents and settings\All Users\Data aplikací\Spyware Terminator\fileobjinfo.sys [9.5.2009 20:38 5632]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [8.7.2009 19:01 39984]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [18.8.2004 14:00 14336]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WUAUSERV
*Deregistered* - Ndisprot.sys
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1960408961-1214440339-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-06-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1960408961-1214440339-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
IE: Analyzovat LeechGetem - file://i:\nainstalovane programy\LeechGet 2007\\Parser.html
IE: Download LeechGetem - file://i:\nainstalovane programy\LeechGet 2007\\AddUrl.html
IE: Download s průvodcem LeechGetu - file://i:\nainstalovane programy\LeechGet 2007\\Wizard.html
IE: Send to &Bluetooth Device... - c:\program files\AirLive\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
TCP: DhcpNameServer = 81.25.16.250 81.25.28.250
FF - ProfilePath - c:\documents and settings\Majitel\Data aplikací\Mozilla\Firefox\Profiles\o2vo0ivh.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://my.daemon-search.com/|http://cs.start3.mozilla.com/firefox?cl ... s:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-706282573 - c:\documents and settings\Majitel\Local Settings\Data aplikací\mhk.exe
ShellExecuteHooks-{93994DE8-8239-4655-B1D1-5F4E91300429} - (no file)
MSConfigStartUp-nwiz - nwiz.exe
AddRemove-2009 - c:\windows\IsUn0405.exe
AddRemove-IDOS - IDS JMK - c:\windows\IsUn0405.exe
AddRemove-IDOS - Letový řád Galileo - c:\windows\IsUn0405.exe
AddRemove-IDOS - MHD Olomouc - c:\windows\IsUn0405.exe
AddRemove-IDOS - MHD Ostrava - c:\windows\IsUn0405.exe
AddRemove-IDOS - MHD Plzeň - c:\windows\IsUn0405.exe
AddRemove-IDOS - MHD České Budějovice - c:\windows\IsUn0405.exe
AddRemove-IDOS - Pražská integrovaná doprava - c:\windows\IsUn0405.exe
AddRemove-IDOS - ProgramTT - c:\windows\IsUn0405.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-18 08:07
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SAMSUNG_HD501LJ rev.CR100-10 -> Harddisk0\DR0 -> \Device\0000009a
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 976773166 (+255): user != kernel
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1960408961-1214440339-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="CD7288AD6CBCAFC52AF6132A8E5E34DCBF42B9005978CF4184C1565CB6810446FA86DA64AFDA944A0E417365725C0AAAB542728A975306CC721A8A28CEABE7259233DD1AC71BC4644F145A2874DE25A5B09DE387990BA0AEC8E553DCB1693B453D9D41FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933FEBC9E127BECC74CFEBC9E127BECC74CD18DB4229DD50E51CB40E8034333074F6CA32F1632EF40300497FC3CFCA8687372D506290C864A5535D51D4DF2D0321A81F89E80C83EE5A96B0EF28DA5A1AA00A5A21A879EDF5DE4C49D4D68DABA937BA1B8A70936E8591EBEB96D68707B7289C406513BF49CB4DA8C02D951289069DB37444DCCCD144820DF8E2EA37A817E6F4DAB4FF7144CC0044181E9B8E7467416520C5515C73966395795BFC8C3D11208DECF7BA5E65376233EAE65818B257A78A5184A663F28E9E4D0E96995B1DFF51DBF4405DFBA6ACDEE802EFA47EBCA454607057AF4B2810D129C3C3D7D8AF0746A59EDD775BF1B440FAA3C99D3412723367102772A06BA8FA52E500DA77BA0DD21B5C52CE90CC6D9A3812677292B7FE57485D01725819D32789D7FEF6D965E85E5095977F598A1933FEFCD8EFAAB6B611F04497535CEC8BD55A736C15DCDECC3D2A54A760443B1FA6683A99B3329D97149D5D7ED617FADFAFB2AF321BBFB62747486CDA9B44DD31B936F459DEB6D89F17A047A25E28511B9A22A4C71FCDB29F54B462DD5DA5CB7853407BD5D782810452DBEC4FE27B78DCBEED068D94C8D022C4C2844817D79614EABC545615B6B55D0CFD8DE28CED29209FEE706C48996FC01E110067A5813A78ECEC9A278CDAC18FEC7C7828CB0765FCBDFE0F162445F035CE806F8CFDBF83862E7D33032BCC667BD69A8805FD5A489F1984E1426C6B3CD31B03832D5AAE1906BB5CB5C634779A8FC01393B97FBC5FC5F9FE9E24608C3EB710077E2251CE5064EE9B9282844E415344D5C29EC1525F5F8E18EE93D39A4C0948E384B993D0440B2A94CAA5B3A11B85B8119D75F467108AABEBACA4B3B4E04170B93BFD24C9B39C48F540F9DE5687471C41AE4B1E7BE96E30A94B974259DBEF89346A937BC74C3382AC992D53937FDF6B22E04698884DB150D637EFD42534FBC4132876BB6B681BDFAC408ABD6B25CF258C97C4E6A9E67B50292F4748F12EAE999D9E9DD95EE6A11F804548E99EFED6DBA81A87202CA19C11AB20FA5C163168E9B68F43F68104B6D0D6974AC0B69E2755091F9A5F82D29B6F8F64FA63CB42EB7372A648272EE4213157AF37C6EFD3F1D0459F17E2DCE1E173738CE4D9C545F79D18F83DE2DC445C763E27638B6EEDDF7B4D928573098D76ADF71B9B430782C6C452D3453C12F1AD33F6D315C8D63"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2276)
c:\fullshot 9\SHOT8.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\nokia pc suite 7\Nokia PC Suite 7\PhoneBrowser.dll
c:\nokia pc suite 7\Nokia PC Suite 7\NGSCM.DLL
c:\nokia pc suite 7\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\nokia pc suite 7\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
m:\virtual pc 1 w98\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\AirLive\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
i:\nainstalovane programy\CDBurnerXP\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\oodag.exe
c:\spyware terminator\sp_rsser.exe
c:\alcohol 120 black and bloody edit.4\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Celkový čas: 2011-06-18 08:12:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-18 06:12
.
Před spuštěním: 9 506 103 296
Po spuštění: 9 937 027 072
.
Current=9 Default=9 Failed=8 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10
- - End Of File - - 98307B6843F008C2D9A8F68084B99CA4

[vyosek]

Zdravim a pekny den preji

VY umite pouzivat ComboFix a lustit jeho logy Jelikoz toto je utilita urcena primarne pro radce a ne pro svevolne pouzitit - vizte nebezpeceni nize

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Ty disky E,F,G,H,I jsou co Jedna se o domaci PC ci firemni\pracovni

[heavoc]

dobrý den,
CFko bylo moje poslední šance před reinstalem w.tenhle program jsem objevil tady náhodou a přiznám se,že jsem to risknul.neměl jsem co ztratit.Jedná se o domácí pc a jsem dle mého názoru amatér.sice si dovedu splácat víceméně komp do kupy,trochu té soft.alchymie ,někdy pokus omyl,ale jak říkám amatér,který má rád rady raději jako pro blbce,než machrovat,jak b.pytlík.

[vyosek]

No tak tenhle risk Vam mohl ten PC pohrbit uplne, prosim o chvili strpeni nez napisu docistovaci skript...

[vyosek]

Ten ESET Smart Security mate predpokladam legalni = zakoupena licence

[heavoc]

bohužel ,moc mne neochránil,takže bych uvítal radu na nějaký spolehlivější soft a nejen antiv.doted jsem myslel,že vystačím s esetem,ccleanerm,terminatorem a antimalwarem.No a,, někde soudruzi udělali chybu,, .Ctěl bych se vrátit k té Vaší informaci o tom kleknutí kompu.Měl jsem tedy raději reinstalovat???zkoušel jsem napřed ty rkilly v nouzáku,ale ten šmejd mije blokoval.Tak jsem v nouzáku spustil ten Cf a nechal ho dělat svojí práci.pak jsem přišel k pc a už mi hlásil,že vytváří log.Můžete ni tedy aspon´ trochu nastínit co jsem dělal špatně?Děkuji.

[vyosek]

Nejak jste opomenul odpoved na to, ci je ESET legalni Takze jak to s nim je

Ja doporucuji pro bezne uzivatele Avast, je zdarma a velmi kavlitni. Jako doplnek SuperAntiSpyware misto Spyware Terminatora (ten ma rezidentni stit a muze se s antivirem prat). Ale ani nejlepsi antivir neochrani uzivatele pokud se s prominutim chova jako ho*adko = klika na kdejakou skakajici a blikajici blbinu, navstevuje porno stranky ci si stahuje cracky.

Postup bych volil tez takovy - RKILL (pripadne nejakou jeho alternativu) + ComboFix, ale ja vim co CFko umi, kam co uklada a jak co napravit, takze kdyby PC spadlo, tak vim jak jej ozivit - Vy nikoliv, takze byste reinstaloval