Problémy s PC

[Thrall]

Tak..
Nekdy to zmizí ,ale po vymazání historie to zas tam je. K tomu se tam obejevili dalsi. Internet jde strasne pomalu . O2 pracovnik nic nenasel ,pri jedine zavada v modemu a že ho mam na otestovani poslat vyrobci nebo co . Neco stahuju ,jde to strasne pomalu: 50kb/s. Jak je stahovani v pulce najednou se stahovani dokonci ,ale soubor je cely . Krome toho dneska to jsem stahoval a ono se to ve cvrtce po třech hodináh dokoncilo ,ale soubor nebyl celej . Vcera jsem zkousel spustit jednu hru kterou jsem dlouho nehral, City Life ,ale neslo spustit . Nektere hry se trozku sekaj . Na i-mail mi z moji i-mailove adresy chodej spamy ,ale virem to asi nebude protoze to chodi jenom me a ne ostatnim lidem co mam v kontaktech . Kdyz spoustim PC objevi se mi "Spoustim system" a pak moznost vybrat uzivatele i kdyz v P vic nez jendoho uzivatele nemam jako kdyz spustite system po Uspornem rezimu . Kdyz testuju ComboFixem jde to strasne pomalu a u sipky mise porad blikaji presipaci hodiny i po konci a system je zatizeny na 100% a musim restartovat PC . Nekdy se PC zasekne . No je to vsechno divny . Zaclo to vsechno co jsem nainstaloval nejakou volitelnou aktualizaci ale nejak blbe . Zaclo to tim "Kdyz spoustim PC objevi se mi "Spoustim system" a pak moznost vybrat uzivatele i kdyz v P vic nez jendoho uzivatele nemam jako kdyz spustite system po Uspornem rezimu" . Na http://www.update.microsoft.com/windows ... aspx?ln=cs mi zbyva Sada Microsoft .NET Framework 3.0: x86 Language Pack (KB928416) ale nejde nainstalovat a hodi to chybu . Myslim ze to dokonce byla ta auktualizace ktera se divne nainstalovala . No celej pocitac se chova jako kdy by ho nekdo na dalku ovladal . Zaclo to po dni kdyz jsem nainstaloval Aviru a tu aktualizaci . Myslim ze to virem nebude spis nejaka chyba .

[motji]

Toho uživatele Vám tam dala asi jedna aktualizace Frameworku.
Máte možnost udělat obnovu systému?

[Thrall]

Jako by ANO ,mám ,ale s PC jsem pracoval a nechci stratit některé informace ,jinak jsem si všiml že po nainstalování Aviry nedělá ComboFix obnovy systému .

[motji]

Zkuste tu aktualizaci odinstalovat přes přidat odebrat programy.
Jinak data by jste si měl zazálohovat mimo systém, nevíte, co se může s pc stát

[Thrall]

[quote="motji"]Zkuste tu aktualizaci odinstalovat přes přidat odebrat programy.[quote]
Moc,moc se omlouvám že jsme se dlouho neozval měl jsme strašnej fofr. Zátím jsem tu odinstalaci nezkoušel ale mám další problém, v tom políčku se mi pořád mění poskytovatel hledání . Za 1. se mi pořád mění výchozí poskytovatel hledání a za 2. se mi pořád mění seznam mých možných poskytovatelů hledání od té doby co jsem všechny odebral kromě googlu a teď se postupně přidávají (né všechny najednou) . Tim víc mám pocit jako kdy by někdo PC na dálku ovládal . Dlouhou dobu asi půl rok jsem měl v PC downloader který mi pořád stahoval SpyWare ,ale ani ESET ani MBAM ho nenašly až nakonec G-Data Internet Security 2011 (ten ted v PC nemohl jsem sehnat v ČR nic jiého než trial a ten mi vypršel ) ho našel a zničil . Ale mylslím že teď v PC žádný vir nemám . Už nevím co dělat ...

[motji]

Prominte, jak to myslíte s tím poskytovatelem hledání? Myslíte jako google a pod?

[Thrall]

Prominte, jak to myslíte s tím poskytovatelem hledání? Myslíte jako google a pod?

Ano. A taky mi po vložení CD/DVD nejde autorun .

[motji]

Ten Vám nejde po combofixu, to opravíme potom.
Prosím vložte mi tu log ze rsitu, at vím jak je na tom počítač, věšteckou kouli nemám

[Thrall]

Ten Vám nejde po combofixu, to opravíme potom.
Prosím vložte mi tu log ze rsitu, at vím jak je na tom počítač, věšteckou kouli nemám

Logfile of random's system information tool 1.08 (written by random/random)
Run by Uživatel at 2011-02-22 20:02:39
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 40 GB (27%) free of 150 GB
Total RAM: 2047 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:02:51, on 22.2.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\EA SPORTS\FIFA MANAGER 11\Manager11.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Uživatel\Plocha\RSIT.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\trend micro\Uživatel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Služba Google Update (gupdate1c9faffc1c539a5) (gupdate1c9faffc1c539a5) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 5857 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-09-02 1241448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-09-02 1241448]
{D5D47440-0750-463D-BAEF-A47D02414806}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-02-21 2216960]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-01-10 281768]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-02-21 3318784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
C:\Program Files\lg_fwupdate\fwupdate.exe [2007-02-26 249856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NMIndexingService"=3
"IDriverT"=3
"gusvc"=2
"gupdate1c9faffc1c539a5"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-07-08 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"\\macek\storage\Instalace\!predinstalace\Nero CZ a Power DVD\CDS\Nero\Installation\SetupX.exe"="\\macek\storage\Instalace\!predinstalace\Nero CZ a Power DVD\CDS\Nero\Installation\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\Program Files\SEGA\SEGA Rally\SEGA Rally.exe"="C:\Program Files\SEGA\SEGA Rally\SEGA Rally.exe:*:Enabled:SEGA Rally"
"C:\Program Files\SEGA\SEGA Rally\SEGA Rally_SSE1.exe"="C:\Program Files\SEGA\SEGA Rally\SEGA Rally_SSE1.exe:*:Enabled:SEGA Rally"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Counter-Strike Source\hl2.exe"="C:\Program Files\Counter-Strike Source\hl2.exe:*:Disabled:hl2"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Disabled:Garena"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2011-02-21 20:33:20 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Avira
2011-02-21 20:27:31 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys
2011-02-21 20:27:28 ----D---- C:\Program Files\Avira
2011-02-21 20:21:30 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Spyware Terminator
2011-02-21 20:21:30 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-02-21 20:21:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-02-21 20:21:28 ----D---- C:\Program Files\Spyware Terminator
2011-02-19 15:28:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\EA Core
2011-02-19 15:27:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2011-02-19 15:02:46 ----D---- C:\Program Files\EA SPORTS
2011-02-19 15:01:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\Solidshield
2011-02-16 17:33:41 ----D---- C:\Program Files\Empire Interactive
2011-02-10 08:21:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2478971$
2011-02-10 08:21:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2485376$
2011-02-10 08:21:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2479628$
2011-02-10 08:21:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2483185$
2011-02-10 08:18:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2476687$
2011-02-10 08:18:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2478960$
2011-02-10 08:18:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2393802$
2011-01-28 18:21:29 ----D---- C:\Program Files\Monte Cristo
2011-01-27 22:02:11 ----SHD---- C:\RECYCLER
2011-01-27 20:46:27 ----D---- C:\WINDOWS\temp
2011-01-27 20:46:23 ----A---- C:\ComboFix.txt
2011-01-27 20:34:57 ----D---- C:\ComboFix
2011-01-23 17:57:32 ----D---- C:\rsit
2011-01-22 10:50:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Avira
2011-01-19 18:23:42 ----A---- C:\WINDOWS\zip.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWSC.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWREG.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\sed.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\PEV.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\NIRCMD.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\MBR.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\grep.exe
2011-01-19 18:23:26 ----D---- C:\Qoobox
2011-01-19 13:41:28 ----HDC---- C:\WINDOWS\ie8
2011-01-18 17:08:50 ----D---- C:\Program Files\Unlocker
2011-01-12 18:30:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2010-12-30 20:03:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\DivX
2010-12-25 10:45:59 ----HDC---- C:\WINDOWS\$NtUninstallKB963093$
2010-12-25 10:45:34 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2010-12-25 10:45:15 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2010-12-25 10:42:41 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2010-12-24 22:16:23 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Windows Search
2010-12-24 22:12:16 ----D---- C:\WINDOWS\system32\WindowsPowerShell
2010-12-24 22:12:15 ----D---- C:\WINDOWS\system32\winrm
2010-12-24 22:12:11 ----HDC---- C:\WINDOWS\$968930Uinstall_KB968930$
2010-12-24 22:12:09 ----D---- C:\WINDOWS\$NtUninstallKB968930$
2010-12-24 22:11:51 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2010-12-24 22:11:42 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2010-12-24 22:11:25 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Windows Desktop Search
2010-12-24 22:10:35 ----D---- C:\Program Files\Windows Desktop Search
2010-12-24 22:10:34 ----D---- C:\WINDOWS\system32\GroupPolicy
2010-12-24 22:10:22 ----HDC---- C:\WINDOWS\$NtUninstallKB940157$
2010-12-24 22:10:11 ----HDC---- C:\WINDOWS\$NtUninstallKB915800-v4$
2010-12-24 22:09:37 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-12-24 22:09:36 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2010-12-24 22:09:11 ----D---- C:\Program Files\Windows Media Connect 2
2010-12-24 22:09:03 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2010-12-24 22:08:04 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-12-24 22:07:27 ----D---- C:\WINDOWS\system32\LogFiles
2010-12-24 22:07:27 ----D---- C:\WINDOWS\system32\drivers\UMDF
2010-12-24 22:07:24 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-12-24 22:04:46 ----D---- C:\WINDOWS\system32\URTTEMP
2010-12-24 21:36:01 ----D---- C:\Program Files\Microsoft.NET
2010-12-24 21:27:13 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Apple Computer
2010-12-24 21:10:47 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Opera
2010-12-24 21:10:38 ----D---- C:\Program Files\Opera
2010-12-23 12:27:25 ----A---- C:\WINDOWS\system32\drivers\GRD.sys
2010-12-23 12:14:43 ----A---- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys
2010-12-23 12:14:43 ----A---- C:\WINDOWS\system32\drivers\GDNdisIc.sys
2010-12-23 12:14:41 ----A---- C:\WINDOWS\system32\drivers\MiniIcpt.sys
2010-12-23 12:14:41 ----A---- C:\WINDOWS\system32\drivers\GDBehave.sys
2010-12-23 12:14:13 ----D---- C:\Program Files\G Data
2010-12-23 12:14:13 ----D---- C:\Program Files\Common Files\G Data
2010-12-23 12:14:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\G DATA
2010-12-23 12:13:55 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2010-12-23 11:33:45 ----D---- C:\WINDOWS\ERDNT
2010-12-15 18:07:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2296199$
2010-12-15 18:07:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2010-12-15 18:06:54 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2010-12-15 18:06:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2443685$
2010-12-15 18:06:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2436673$
2010-12-15 18:06:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2010-12-15 18:04:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$
2010-12-07 01:20:15 ----D---- C:\Program Files\ScreenShots
2010-11-25 16:59:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment
2010-11-24 07:30:02 ----D---- C:\Program Files\World of Warcraft
2010-11-23 18:14:52 ----N---- C:\WINDOWS\system32\spmsg2.dll
2010-11-23 18:14:50 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2010-11-23 17:25:13 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\ESET
2010-11-23 14:00:59 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 3 months======

2011-02-22 20:02:43 ----D---- C:\Program Files\trend micro
2011-02-22 18:01:49 ----D---- C:\WINDOWS
2011-02-22 16:54:07 ----D---- C:\WINDOWS\system32\CatRoot2
2011-02-22 10:14:42 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-02-21 20:27:31 ----D---- C:\WINDOWS\system32\drivers
2011-02-21 20:27:28 ----RD---- C:\Program Files
2011-02-21 20:15:02 ----HD---- C:\WINDOWS\inf
2011-02-21 20:14:40 ----D---- C:\WINDOWS\Prefetch
2011-02-19 15:28:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Electronic Arts
2011-02-19 15:27:05 ----D---- C:\WINDOWS\system32\DirectX
2011-02-19 15:27:05 ----D---- C:\WINDOWS\system32
2011-02-18 16:11:07 ----D---- C:\Program Files\Mozilla Firefox
2011-02-16 17:36:15 ----HD---- C:\Program Files\InstallShield Installation Information
2011-02-16 17:35:56 ----SHD---- C:\WINDOWS\Installer
2011-02-10 15:13:16 ----D---- C:\WINDOWS\Debug
2011-02-10 15:08:15 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Skype
2011-02-10 13:27:45 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\skypePM
2011-02-10 08:21:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-02-10 08:19:20 ----A---- C:\WINDOWS\system32\MRT.exe
2011-02-10 08:19:11 ----D---- C:\Program Files\Internet Explorer
2011-02-10 08:19:06 ----D---- C:\WINDOWS\ie8updates
2011-02-10 08:19:02 ----HD---- C:\WINDOWS\$hf_mig$
2011-02-08 06:40:00 ----SD---- C:\WINDOWS\Tasks
2011-02-01 09:16:10 ----D---- C:\WINDOWS\Network Diagnostic
2011-01-29 21:13:12 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Media Player Classic
2011-01-28 18:52:22 ----D---- C:\Program Files\Warcraft III
2011-01-27 20:43:55 ----A---- C:\WINDOWS\system.ini
2011-01-27 20:40:33 ----D---- C:\WINDOWS\AppPatch
2011-01-27 20:40:31 ----D---- C:\Program Files\Common Files
2011-01-22 10:46:35 ----D---- C:\Program Files\World of Warcraft Model Viewer
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shimgvw.dll
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shell32.dll
2011-01-19 18:23:41 ----SHD---- C:\System Volume Information
2011-01-19 18:23:41 ----D---- C:\WINDOWS\system32\Restore
2011-01-19 13:53:13 ----D---- C:\WINDOWS\system32\CatRoot
2011-01-19 13:49:13 ----D---- C:\WINDOWS\system32\cs-cz
2011-01-19 13:49:13 ----D---- C:\WINDOWS\Help
2011-01-19 13:42:08 ----D---- C:\WINDOWS\WBEM
2011-01-19 13:41:53 ----D---- C:\WINDOWS\Media
2011-01-07 15:09:02 ----A---- C:\WINDOWS\system32\atmfd.dll
2011-01-01 22:46:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-01-01 22:27:36 ----D---- C:\WINDOWS\system32\drivers\etc
2011-01-01 18:45:55 ----D---- C:\Program Files\ICQ6.5
2010-12-29 18:20:52 ----A---- C:\WINDOWS\NeroDigital.ini
2010-12-25 10:44:29 ----D---- C:\WINDOWS\Registration
2010-12-25 10:44:10 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-12-25 09:06:16 ----RSD---- C:\WINDOWS\assembly
2010-12-25 09:06:16 ----D---- C:\WINDOWS\Microsoft.NET
2010-12-24 22:19:12 ----D---- C:\WINDOWS\system32\config
2010-12-24 22:19:05 ----D---- C:\WINDOWS\system
2010-12-24 22:19:05 ----D---- C:\Program Files\Google
2010-12-24 22:12:15 ----D---- C:\WINDOWS\system32\wbem
2010-12-24 22:11:48 ----D---- C:\WINDOWS\security
2010-12-24 22:11:40 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-12-24 22:10:54 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-12-24 22:09:22 ----A---- C:\WINDOWS\win.ini
2010-12-24 22:09:11 ----D---- C:\Program Files\Windows Media Player
2010-12-24 21:36:57 ----D---- C:\WINDOWS\WinSxS
2010-12-23 21:01:10 ----D---- C:\WINDOWS\repair
2010-12-22 13:34:22 ----A---- C:\WINDOWS\system32\kerberos.dll
2010-12-21 00:52:37 ----A---- C:\WINDOWS\system32\wininet.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\occache.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\mstime.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\mshtmled.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\licmgr10.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\jsproxy.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\iepeers.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\urlmon.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\mshtml.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\msfeeds.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\iertutil.dll
2010-12-21 00:52:35 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2010-12-20 18:25:50 ----A---- C:\WINDOWS\system32\lsasrv.dll
2010-12-20 13:55:37 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2010-12-20 11:52:38 ----A---- C:\WINDOWS\system32\ieframe.dll
2010-12-20 09:16:15 ----D---- C:\WINDOWS\Minidump
2010-12-15 18:04:15 ----D---- C:\Program Files\Outlook Express
2010-12-09 16:15:19 ----A---- C:\WINDOWS\system32\ntdll.dll
2010-12-09 16:14:08 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2010-12-09 16:14:04 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2010-12-09 15:30:13 ----A---- C:\WINDOWS\system32\csrsrv.dll
2010-11-24 09:47:00 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-11-24 07:29:59 ----D---- C:\ProgramData
2010-11-23 18:14:29 ----D---- C:\WINDOWS\system32\XPSViewer
2010-11-23 18:13:48 ----D---- C:\WINDOWS\system32\mui
2010-11-23 13:45:52 ----D---- C:\WINDOWS\Internet Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R0 viamraid;viamraid; C:\WINDOWS\system32\drivers\viamraid.sys [2009-06-25 104064]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2009-06-25 9216]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2011-01-10 135096]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2011-01-10 61960]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-07-08 3257344]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-20 93696]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2005-12-15 1368000]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\UIVATE~1\LOCALS~1\Temp\catchme.sys []
S3 ctljystk;Game port pro zařízení Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-01-10 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-01-10 135336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-07-08 573440]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-02-21 496128]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-02 133104]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-09-17 800040]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]

-----------------EOF-----------------

[motji]

Pořád se Vám mění ten vyhledávač? google a pod?

[Thrall]

Pořád se Vám mění ten vyhledávač? google a pod?

Jo ... a už mě to začina štvat .. Ta historie nezmizi ,na to sem si zvykl ,to se asi na ten pevny disk vypalilo a asi jedine preinstalace systemu ji vymaze

[motji]

Na co se Vám to přepisuje?

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[Thrall]

Dobrý den potreboval bych ted pomoct s novým problémem . Dnes jsem nerad navstivil stranku ktera byla plna reklam a bylo jasne ze byla zavirovana tak jsem spurtil COmbofix a mel jsme pravdu, naslo mi toto:
ComboFix 11-02-25.01 - Uživatel 26.02.2011 15:19:17.37.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1582 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Ijl11.dll
c:\windows\system32\vbpng1.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2011-01-26 do 2011-02-26 )))))))))))))))))))))))))))))))
.

2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- C:\Shoty
2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- c:\program files\ScreenShots
2011-02-21 19:33 . 2011-02-21 19:33 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Avira
2011-02-21 19:27 . 2011-01-10 13:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-02-21 19:27 . 2011-01-10 13:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-21 19:27 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-02-21 19:27 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-02-21 19:27 . 2011-02-21 19:27 -------- d-----w- c:\program files\Avira
2011-02-21 19:21 . 2011-02-25 16:04 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-21 19:21 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-02-21 19:21 . 2011-02-25 10:32 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-24 20:20 -------- d-----w- c:\program files\Spyware Terminator
2011-02-19 14:28 . 2011-02-19 14:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\EA Core
2011-02-19 14:27 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-02-19 14:02 . 2011-02-19 14:02 -------- d-----w- c:\program files\EA SPORTS
2011-02-19 14:01 . 2011-02-19 14:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Solidshield
2011-02-16 16:33 . 2011-02-16 16:33 -------- d-----w- c:\program files\Empire Interactive
2011-01-28 17:21 . 2011-01-28 17:39 -------- d-----w- c:\program files\Monte Cristo

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2008-04-14 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2008-04-14 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-23 11:27 . 2010-12-23 11:27 69400 ----a-w- c:\windows\system32\drivers\GRD.sys
2010-12-23 11:14 . 2010-12-23 11:14 51832 ----a-w- c:\windows\system32\drivers\GDTdiIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 29640 ----a-w- c:\windows\system32\drivers\GDNdisIc.sys
2010-12-23 11:14 . 2010-12-23 11:14 62584 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 33912 ----a-w- c:\windows\system32\drivers\GDBehave.sys
2010-12-22 12:34 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2008-04-14 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 17:09 . 2010-08-27 12:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-08-27 12:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 12:55 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-04-14 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2008-04-14 12:00 2194944 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 15:14 . 2008-04-14 08:06 2071552 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 14:30 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 13:43 . 2010-12-02 13:42 4902596 ----a-w- c:\windows\REGBK00.ZIP
2009-01-15 17:43 . 2009-01-15 17:43 1821008 ----a-w- c:\program files\instmsiw.exe
2009-01-15 17:43 . 2009-01-15 17:43 1707856 ----a-w- c:\program files\instmsia.exe
2009-01-15 17:43 . 2009-01-15 17:43 9296384 ----a-w- c:\program files\openofficeorg30.msi
.

((((((((((((((((((((((((((((( SnapShot_2011-02-23_17.27.11 )))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-02-21 3318784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-02-21 2216960]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2007-02-26 08:40 249856 ----a-w- c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-01-24 10:32 2289664 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 10:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NMIndexingService"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=2 (0x2)
"gupdate1c9faffc1c539a5"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"\\\\macek\\storage\\Instalace\\!predinstalace\\Nero CZ a Power DVD\\CDS\\Nero\\Installation\\SetupX.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally_SSE1.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.2.2011 20:21 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [21.2.2011 20:27 135336]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5);c:\program files\Google\Update\GoogleUpdate.exe [2.7.2009 11:27 133104]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14.4.2008 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://centrum.cz
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/index.php?toolbar=centrum-1.0.0&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-26 15:23
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(620)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2011-02-26 15:25:10
ComboFix-quarantined-files.txt 2011-02-26 14:25
ComboFix2.txt 2011-02-23 17:29
ComboFix3.txt 2011-01-27 19:46
ComboFix4.txt 2011-01-23 16:23
ComboFix5.txt 2011-02-26 14:17

Před spuštěním: Volných bajtů: 40 723 509 248
Po spuštění: Volných bajtů: 40 732 459 008

- - End Of File - - 633B56D755AD4B09898893FC72EF6ACC

Ale pak jsem si spomnel ze jsem mel v PC jednou downloader ktery mi porad dokola stahoval spyware. Ten spyware vzdycky dokazal vymazal combofix ,ale downloader ne. Ani eset a mbam downloader nenasel . Teprve az G DATA ,tak jsem se koukal na me stare prispevky a zjistil jsem ze se jedna o stejny pripad . G DATA uz nemam a nevim co delat. Prectete si toto tema bay jste byl v obraze http://viry.cz/forum/viewtopic.php?f=28&t=107787 .

[motji]

To co Vám našel G DATA, to je vir v obnově systému. Tu Vám smaže i T-cleaner po odinstalaci combofixu, nebo se dá vypnout ručně.

Mě spíš zaráží, že combofix Vám neustále maže ty samé soubory. Poproísm Vás, zabalte
složku c:\combofix/qarantine do raru a upněte na www.leteckaposta.cz. Link mi vložte do sz.

Ted to s počítačem vypadá jak? Na jaký vyhledáváč se Vám to přesměrovává?

[Thrall]

Na ty ktere jsem predtim mel v seznamu poskytovatelu vyhledavani ale pak jsem je vymazal .

PS: Nevadi kdyz zmenim nazev tematu? Vite kdyz date do googlu "Nejde vymazat historie" hned to hodi tohle tema a ja nejak nemusim aby si lidi mimo forum cetli co tady pisu .