VIRY.CZ

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Dobře, můžeš ještě jednou spustit ComboFix a dát mi log?

ComboFix 10-03-19.04 - PC2 19.03.2010 21:06:46.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1449 [GMT 1:00]
Spuštěný z: c:\documents and settings\PC2\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-19 do 2010-03-19 )))))))))))))))))))))))))))))))
.

2010-03-19 07:23 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-19 07:23 . 2010-03-19 07:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-19 07:23 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-19 06:01 . 2010-03-19 06:01 -------- d-----w- c:\program files\trend micro
2010-03-19 06:01 . 2010-03-19 06:01 -------- d-----w- C:\rsit
2010-03-19 05:35 . 2010-03-19 05:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-16 03:01 . 2010-03-19 08:16 -------- d-----w- c:\program files\TrojanHunter 5.3
2010-03-14 21:44 . 2010-03-09 11:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-14 21:44 . 2010-03-09 11:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-14 21:44 . 2010-03-09 11:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-14 21:44 . 2010-03-09 11:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-14 21:44 . 2010-03-09 11:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-14 21:44 . 2010-03-09 11:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-14 21:44 . 2010-03-09 11:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-14 21:44 . 2010-03-09 11:24 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-14 21:44 . 2010-03-09 11:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-14 21:44 . 2010-03-14 21:44 -------- d-----w- c:\program files\Alwil Software
2010-03-14 20:23 . 2006-06-19 12:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-03-14 20:23 . 2006-05-25 14:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-03-14 20:23 . 2005-08-26 00:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-03-14 20:23 . 2003-02-02 19:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-03-14 20:23 . 2002-03-06 00:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-03-14 20:22 . 2010-03-14 20:23 -------- d-----w- c:\program files\Trojan Remover
2010-03-14 19:36 . 2010-03-14 19:42 -------- d-----w- c:\program files\TrojanHunter 4.7
2010-03-10 18:54 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-01 13:03 . 2010-03-01 13:03 -------- d-----w- c:\program files\Xvid
2010-02-20 14:32 . 2010-02-20 14:32 -------- d-----w- c:\program files\Common Files\xing shared
2010-02-20 14:31 . 2010-02-20 14:32 -------- d-----w- c:\program files\Real
2010-02-20 14:31 . 2010-02-20 14:32 -------- d-----w- c:\program files\Common Files\Real

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-19 20:04 . 2009-11-11 21:17 16 ----a-w- c:\windows\system32\magicpvt.dat
2010-03-19 20:03 . 2009-09-19 09:26 17488 ----a-w- c:\windows\gdrv.sys
2010-03-19 20:03 . 2009-11-11 21:17 32 ----a-w- c:\windows\system32\driver.dat
2010-03-13 20:06 . 2009-09-19 09:36 17488 ----a-w- c:\windows\etdrv.sys
2010-03-13 20:05 . 2009-09-18 20:17 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2010-02-20 14:31 . 2006-09-28 17:53 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-20 14:31 . 2006-09-28 17:53 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-01-22 20:13 . 2009-09-18 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-21 13:55 . 2009-11-15 18:06 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 02:23 . 2010-01-13 02:23 74696 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-31 16:50 . 2009-09-18 19:06 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2009-09-18 19:06 916480 ------w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys
[-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\44c8256673ca0542cb198384f8131b68\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[-] 2003-04-16 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys
[-] 2002-08-28 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-03-19_08.45.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-19 20:03 . 2010-03-19 20:03 16384 c:\windows\Temp\Perflib_Perfdata_d4.dat
+ 2010-03-19 20:03 . 2010-03-19 20:03 16384 c:\windows\Temp\Perflib_Perfdata_768.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RayV"="c:\program files\RayV\RayV\RayV.exe" [2009-10-26 2544936]
"SpywareTerminatorUpdate"="c:\programy\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-03-19 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-04 18702336]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\programy\QuickTime\QTTask.exe" [2009-11-10 417792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GBTUpd"="c:\program files\GIGABYTE\GBTUpd\PreRun.exe" [2008-04-03 297480]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-03-09 2769336]
"SpywareTerminator"="c:\programy\Spyware Terminator\SpywareTerminatorShield.exe" [2010-03-19 2166784]
"netmon.exe"="c:\programy\netmon\netmon.exe" [2006-10-24 5279232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\PC2\Nabˇdka Start\Programy\Po spuçtŘnˇ\
GIGABYTE Gamer HUD.lnk.disabled [2009-9-19 1801]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
AutoCAD Startup Accelerator.lnk.disabled [2009-9-27 1955]
Bluetooth.lnk - c:\program files\MSI\BToes Bluetooth Software\BTTray.exe [2005-3-29 569405]
NaturalColorLoad.lnk.disabled [2009-11-11 655]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\programy\Spybot - Search & Destroy\TeaTimer.exe
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"RayV"=c:\program files\RayV\RayV\RayV.exe /background
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"EasyTuneVI"=c:\program files\GIGABYTE\ET6\ETcall.exe
"WinampAgent"=c:\programy\Winamp\winampa.exe
"QuickTime Task"="c:\programy\QuickTime\QTTask.exe" -atboottime
"MagicRotation"=c:\program files\SEC\MagicRotation\MagicPvt.exe
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"THGuard"="c:\program files\TrojanHunter 5.3\THGuard.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\uTorrent\\uTorrent.exe"=
"c:\\Hry\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Hry\\Football Manager 2010\\fm.exe"=
"c:\\Programy\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programy\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\RayV\\RayV\\RayV.exe"=
"c:\\Program Files\\RayV\\RayV\\RayV.dll"=
"c:\\Hry\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\PC2\\Data aplikací\\RayV\\Viewer\\RayV.dll"=
"c:\\Program Files\\GIGABYTE\\GBTUpd\\RunUpd.exe"=
"c:\\Programy\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [20.9.2009 19:16 160640]
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [20.9.2009 19:15 155136]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [14.3.2010 22:44 162640]
R1 magicpvt;magicpvt;c:\windows\system32\drivers\magicpvt.sys [11.11.2009 22:17 9728]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [19.3.2010 6:35 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14.3.2010 22:44 19024]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [6.9.2009 12:22 68136]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [18.9.2009 21:10 22016]
S0 a347scsi;a347scsi;c:\windows\system32\Drivers\a347scsi.svs --> c:\windows\system32\Drivers\a347scsi.svs [?]
S0 d347prt;d347prt;c:\windows\system32\Drivers\d347prt.svs --> c:\windows\system32\Drivers\d347prt.svs [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6.9.2009 12:25 1684736]
S3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [22.2.2009 23:16 7168]
S3 etdrv;etdrv;c:\windows\etdrv.sys [19.9.2009 10:36 17488]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [18.9.2009 21:17 24944]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [18.9.2009 21:10 28544]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [18.9.2009 21:10 17536]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-03-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-796845957-162531612-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]

2010-03-17 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-796845957-162531612-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.qip.ru/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\MSI\BToes Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\components\RadioWMPCore.dll
FF - plugin: c:\program files\RayV\RayV\plugins\nprayvplugin.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin7.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\programy\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programy\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\programy\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\programy\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\programy\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\programy\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\programy\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programy\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programy\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\programy\Firefox\greprefs\all.js - pref("html5.enable", false);
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\programy\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\programy\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programy\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programy\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\programy\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\programy\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\a347scsi]
"ImagePath"="System32\Drivers\a347scsi.svs"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\d347prt]
"ImagePath"="System32\Drivers\d347prt.svs"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\Andreas Haak\a*Ű]
"Language"="English"

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:aa,d1,70,2a,41,51,96,91,e5,0b,3e,ef,f7,73,af,bd,c8,2b,d9,a5,a2,84,27,
fc,86,33,16,6c,83,6a,a7,d5,7c,ef,8a,13,5b,05,17,74,05,b1,2c,1d,bc,fb,c0,68,\
"??"=hex:5b,aa,77,8f,bb,0b,14,be,60,c8,13,59,ff,d5,6c,0f

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:a6,c8,3b,c0,1c,6d,c9,4b,29,0f,5a,a3,e0,2a,14,d2,d9,5b,fc,ab,25,
1e,2d,86,10,4a,9f,74,37,bf,c1,45,93,cf,27,5a,d4,25,16,b5,6f,fc,e9,d0,60,84,\
"rkeysecu"=hex:23,d0,4d,fc,6e,cb,09,fe,ff,91,8c,34,66,81,8d,02
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(956)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1664)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-03-19 21:09:34
ComboFix-quarantined-files.txt 2010-03-19 20:09
ComboFix2.txt 2010-03-19 08:48

Před spuštěním: Volných bajtů: 39 325 503 488
Po spuštění: Volných bajtů: 39 277 330 432

- - End Of File - - A4AF16A314A73ED35C25BAE9FBF3C03E

Otevři Poznámkový blok (Notepad) a zkopíruj celý zelený text z "CFscriptu".
Soubor ulož na plochu jako CFscript.txt a jeho ikonu přetáhni myší nad ikonu ComboFixu - tam pusť.

ComboFix se spustí - počkej na log a vlož ho sem.

CFscript

ComboFix 10-03-19.04 - PC2 19.03.2010 22:03:38.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1482 [GMT 1:00]
Spuštěný z: c:\documents and settings\PC2\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\PC2\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\Tasks\AppleSoftwareUpdate.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-796845957-162531612-839522115-1003.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-796845957-162531612-839522115-1003.job"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programy\Spybot - Search & Destroy
c:\programy\Spybot - Search & Destroy\advcheck.dll
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-796845957-162531612-839522115-1003.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-796845957-162531612-839522115-1003.job

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_A347SCSI
-------\Legacy_SPTD
-------\Service_a347scsi
-------\Service_d347prt
-------\Service_sptd


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-19 do 2010-03-19 )))))))))))))))))))))))))))))))
.

2010-03-19 07:23 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-19 07:23 . 2010-03-19 07:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-19 07:23 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-19 06:01 . 2010-03-19 06:01 -------- d-----w- c:\program files\trend micro
2010-03-19 06:01 . 2010-03-19 06:01 -------- d-----w- C:\rsit
2010-03-19 05:35 . 2010-03-19 05:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-16 03:01 . 2010-03-19 08:16 -------- d-----w- c:\program files\TrojanHunter 5.3
2010-03-14 21:44 . 2010-03-09 11:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-14 21:44 . 2010-03-09 11:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-14 21:44 . 2010-03-09 11:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-14 21:44 . 2010-03-09 11:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-14 21:44 . 2010-03-09 11:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-14 21:44 . 2010-03-09 11:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-14 21:44 . 2010-03-09 11:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-14 21:44 . 2010-03-09 11:24 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-14 21:44 . 2010-03-09 11:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-14 21:44 . 2010-03-14 21:44 -------- d-----w- c:\program files\Alwil Software
2010-03-14 20:23 . 2006-06-19 12:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-03-14 20:23 . 2006-05-25 14:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-03-14 20:23 . 2005-08-26 00:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-03-14 20:23 . 2003-02-02 19:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-03-14 20:23 . 2002-03-06 00:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-03-14 20:22 . 2010-03-14 20:23 -------- d-----w- c:\program files\Trojan Remover
2010-03-14 19:36 . 2010-03-14 19:42 -------- d-----w- c:\program files\TrojanHunter 4.7
2010-03-10 18:54 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-01 13:03 . 2010-03-01 13:03 -------- d-----w- c:\program files\Xvid
2010-02-20 14:32 . 2010-02-20 14:32 -------- d-----w- c:\program files\Common Files\xing shared
2010-02-20 14:31 . 2010-02-20 14:32 -------- d-----w- c:\program files\Real
2010-02-20 14:31 . 2010-02-20 14:32 -------- d-----w- c:\program files\Common Files\Real

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-19 21:07 . 2009-11-11 21:17 16 ----a-w- c:\windows\system32\magicpvt.dat
2010-03-19 21:06 . 2009-09-19 09:26 17488 ----a-w- c:\windows\gdrv.sys
2010-03-19 21:05 . 2009-11-11 21:17 32 ----a-w- c:\windows\system32\driver.dat
2010-03-13 20:06 . 2009-09-19 09:36 17488 ----a-w- c:\windows\etdrv.sys
2010-03-13 20:05 . 2009-09-18 20:17 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2010-02-20 14:31 . 2006-09-28 17:53 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-20 14:31 . 2006-09-28 17:53 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-01-22 20:13 . 2009-09-18 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-21 13:55 . 2009-11-15 18:06 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 02:23 . 2010-01-13 02:23 74696 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-31 16:50 . 2009-09-18 19:06 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2009-09-18 19:06 916480 ------w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys
[-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\44c8256673ca0542cb198384f8131b68\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[-] 2003-04-16 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys
[-] 2002-08-28 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-03-19_08.45.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-19 21:06 . 2010-03-19 21:06 16384 c:\windows\temp\Perflib_Perfdata_7d8.dat
+ 2010-03-19 21:06 . 2010-03-19 21:06 16384 c:\windows\temp\Perflib_Perfdata_7c4.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RayV"="c:\program files\RayV\RayV\RayV.exe" [2009-10-26 2544936]
"SpywareTerminatorUpdate"="c:\programy\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-03-19 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-04 18702336]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"GBTUpd"="c:\program files\GIGABYTE\GBTUpd\PreRun.exe" [2008-04-03 297480]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-03-09 2769336]
"SpywareTerminator"="c:\programy\Spyware Terminator\SpywareTerminatorShield.exe" [2010-03-19 2166784]
"netmon.exe"="c:\programy\netmon\netmon.exe" [2006-10-24 5279232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\PC2\Nabˇdka Start\Programy\Po spuçtŘnˇ\
GIGABYTE Gamer HUD.lnk.disabled [2009-9-19 1801]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
AutoCAD Startup Accelerator.lnk.disabled [2009-9-27 1955]
Bluetooth.lnk - c:\program files\MSI\BToes Bluetooth Software\BTTray.exe [2005-3-29 569405]
NaturalColorLoad.lnk.disabled [2009-11-11 655]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"RayV"=c:\program files\RayV\RayV\RayV.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"EasyTuneVI"=c:\program files\GIGABYTE\ET6\ETcall.exe
"MagicRotation"=c:\program files\SEC\MagicRotation\MagicPvt.exe
"THGuard"="c:\program files\TrojanHunter 5.3\THGuard.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\uTorrent\\uTorrent.exe"=
"c:\\Hry\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Hry\\Football Manager 2010\\fm.exe"=
"c:\\Programy\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programy\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\RayV\\RayV\\RayV.exe"=
"c:\\Program Files\\RayV\\RayV\\RayV.dll"=
"c:\\Hry\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Hry\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\PC2\\Data aplikací\\RayV\\Viewer\\RayV.dll"=
"c:\\Program Files\\GIGABYTE\\GBTUpd\\RunUpd.exe"=
"c:\\Programy\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [20.9.2009 19:16 160640]
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [20.9.2009 19:15 155136]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [14.3.2010 22:44 162640]
R1 magicpvt;magicpvt;c:\windows\system32\drivers\magicpvt.sys [11.11.2009 22:17 9728]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [19.3.2010 6:35 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14.3.2010 22:44 19024]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [6.9.2009 12:22 68136]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [18.9.2009 21:10 22016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6.9.2009 12:25 1684736]
S3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [22.2.2009 23:16 7168]
S3 etdrv;etdrv;c:\windows\etdrv.sys [19.9.2009 10:36 17488]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [18.9.2009 21:17 24944]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [18.9.2009 21:10 28544]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [18.9.2009 21:10 17536]
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\MSI\BToes Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\PC2\Data aplikací\Mozilla\Firefox\Profiles\268gi755.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\components\RadioWMPCore.dll
FF - plugin: c:\program files\RayV\RayV\plugins\nprayvplugin.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: c:\programy\QuickTime\Plugins\npqtplugin7.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\programy\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programy\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\programy\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\programy\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\programy\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\programy\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\programy\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programy\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programy\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\programy\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\programy\Firefox\greprefs\all.js - pref("html5.enable", false);
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\programy\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\programy\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\programy\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programy\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programy\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\programy\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\programy\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\programy\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-19 22:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A4E2548]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f31cb8
\Driver\atapi -> 0x8a4e2548
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek PCIe GBE Family Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9dcfbb0
PacketIndicateHandler -> NDIS.sys @ 0xb9ddca21
SendHandler -> NDIS.sys @ 0xb9dba87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\Andreas Haak\a*Ű]
"Language"="English"

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:aa,d1,70,2a,41,51,96,91,e5,0b,3e,ef,f7,73,af,bd,c8,2b,d9,a5,a2,84,27,
fc,86,33,16,6c,83,6a,a7,d5,7c,ef,8a,13,5b,05,17,74,05,b1,2c,1d,bc,fb,c0,68,\
"??"=hex:5b,aa,77,8f,bb,0b,14,be,60,c8,13,59,ff,d5,6c,0f

[HKEY_USERS\S-1-5-21-796845957-162531612-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:a6,c8,3b,c0,1c,6d,c9,4b,29,0f,5a,a3,e0,2a,14,d2,d9,5b,fc,ab,25,
1e,2d,86,10,4a,9f,74,37,bf,c1,45,93,cf,27,5a,d4,25,16,b5,6f,fc,e9,d0,60,84,\
"rkeysecu"=hex:23,d0,4d,fc,6e,cb,09,fe,ff,91,8c,34,66,81,8d,02
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2072)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\MSI\BToes Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\programy\Spyware Terminator\sp_rsser.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\progra~1\MSI\BToes Bluetooth Software\BtStackServer.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\GIGABYTE\GBTUpd\GBTUpd.exe
.
**************************************************************************
.
Celkový čas: 2010-03-19 22:09:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-19 21:09
ComboFix2.txt 2010-03-19 20:09
ComboFix3.txt 2010-03-19 08:48

Před spuštěním: Volných bajtů: 39 299 895 296
Po spuštění: Volných bajtů: 39 247 867 904

- - End Of File - - 7832AF0A74C367788D47AE35F3FDE551

cernohous13 píše: 2 - Odinstaluj Spybot - http://www.james008.net/james_sdkill.exe
již je dlouho nevyvíjen a zastaralý - máš Terminátora

3 -

Stahni dle ze stranek SPTD http://www.duplexsecure.com/en/downloads verzi dle sveho operacniho systemu. SPTD for Windows (32 bit) nebo (64b) na plochu
- spust
- zvol moznost Uninstall
- restart PC

zdá se mi, že jsi neprovedl body 2 a 3

proto

Stahni dle ze stranek SPTD http://www.duplexsecure.com/en/downloads verzi dle sveho operacniho systemu. SPTD for Windows (32 bit) nebo (64b) na plochu
- spust
- zvol moznost Uninstall
- restart PC

potom Stáhni http://www2.gmer.net/mbr/mbr.exe ulož ho na plochu
Start -> Spustit... -> zkopíruj celý příkaz z modrého řádku
"%userprofile%\plocha\mbr" -t [enter]
výsledný log bude na ploše - dej sem

Rozbal z přílohy soubor "atapi.zip" do C:\atapi.sys

Stahni Avenger zde:
http://swandog46.geekstogo.com/avenger.exe
Spusť a všude souhlas „Yes“
Hlavní okno

dole dej fajfku do obou čtverečků

Do pole „Input script here“ zkopíruj zelený text scriptu > „Execute“ > „Yes“
Bude restart a je potřeba vyčkat na otevření Notepadu a jeho obsah sem vložit.

Script

u toho mbr,kam ten příkaz zkopírovat?
spustím mbr a ten po chvilce dojede a vytvořil mi log.

Start -> Spustit... -> zkopíruj celý příkaz z modrého řádku
"%userprofile%\plocha\mbr" -t [enter]

vlevo dole na hlavním panelu (spodní lišta) je tlačítko Start -> klik
vyskočí roletka a tam je Spustit... -> klik
a do řádku, kde bliká kurzor zkopíruj uvedený příkaz
-> OK

jo omlouvám se,moje neznalost.
Tady je ten log z mbr:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A4E2548]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a4e2548
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

jdu dál

Máš odinstalované virtuálky? (Alcohol nebo Deamon)

Stahni dle ze stranek SPTD http://www.duplexsecure.com/en/downloads verzi dle sveho operacniho systemu. SPTD for Windows (32 bit) nebo (64b) na plochu
- spust
- zvol moznost Uninstall
- restart PC

jinak ti hned hákují nově nainstalovaný atapi.sys

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\atapi.sys|c:\windows\system32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

jo něco sem četl na fórech,tak ještě před vytvořením dotazu jsem odinstaloval.

marosoles píše:jo něco sem četl na fórech,tak ještě před vytvořením dotazu jsem odinstaloval.

Tak si vygoogli k čemu patří drivery d347bus.sys a a347bus.sys v posledním ComboFix.txt

Takže další CFscript (postup už znáš) Potom zopakujeme

stáhneš speciální verzi G-Mer
Special
ulož na plochu a spusť -> proběhne krátký scan
když dostaneš hlášku rootkit activity and asks if you want to run scan>>klikneš NO<<
a nastavíš to takto


>> klikneš scan,<<
na konci scanu >>SAVE<< název dej Gspeclog.txt>>ulož na plochu a obsah logu zkopíruj sem

Zdravím,
u toho G-MER žádná hláška nevyskočí,jen se po krátkém skenu zastaví tak dám sken./nic jsem nenastavoval,nechal skenovat tak jak to bylo zafajfknutý/
Po skončení skenu se PC restartovalo.Log tedy nemám.
Dělám to dobře

Tak snad je to ono.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-20 15:19:10
Windows 5.1.2600 Service Pack 3
Running: 7x0ddwcr.exe; Driver: C:\DOCUME~1\PC2\LOCALS~1\Temp\uxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAC998C56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAC998B12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xAC9990C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAC998FF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAC9986E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAC998BEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAC998628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAC99868C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAC998D0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xAC999194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAC998CCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAC998E4C]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xAC9A54FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xAC9A5322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xAC9A545C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2CE0 8050457C 4 Bytes CALL 16FCDF07
PAGE ntkrnlpa.exe!ZwLoadDriver 8058413A 7 Bytes JMP AC9A5460 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!NtCreateSection 805AB3AC 7 Bytes JMP AC9A5326 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC520 5 Bytes JMP AC9A14BA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805C2FA4 5 Bytes JMP AC9A2972 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1144 7 Bytes JMP AC9A5502 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9923000, 0x230C27, 0xE8000020]
init C:\WINDOWS\system32\drivers\magicpvt.sys entry point in "init" section [0xBA555700]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xA9985300, 0x3AF78, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xBA3F8300, 0x1BCE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Programy\Firefox\firefox.exe[2516] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Programy\Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[936] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT C:\WINDOWS\system32\services.exe[936] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272c8fb02
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272c8fb02 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programy\Daemon\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7F 0x12 0xC8 0x85 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x35 0x46 0x7A 0x9D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x07 0x29 0x74 0x27 ...

---- EOF - GMER 1.0.15 ----