EventWnd - tohle by mělo souviset s Zone alarmem, zkuste ho vypnout, nebo odinstalovat, jestli se to bude znovu objevovat. Je možné, že že Vašemu systému prostě ZA nesedl. ACS.exe je od Atheros Wireless LAN, pokud používáte, myslím že můžete povolit ALU.exe - asus live update - můžete povolit .
Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Přikládám log z ComboFixuKód: Vybrat vše
ComboFix 10-04-15.02 - Lukáš 16.04.2010 11:50:48.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3067.2449 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-16 do 2010-04-16 )))))))))))))))))))))))))))))))
.
2010-04-16 09:18 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 16:23 . 2008-04-13 22:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-15 16:23 . 2008-04-13 22:10 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-14 21:48 . 2010-04-14 21:48 -------- d-----w- c:\program files\Total Uninstall 5
2010-04-13 15:54 . 2008-04-13 22:11 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-03-30 21:04 . 2010-03-30 21:04 -------- d-----w- c:\program files\Common Files\Java
2010-03-30 18:17 . 2007-04-01 07:00 2842624 ----a-w- c:\temp\btwicons.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 09:55 . 2010-02-11 14:57 802304 ----a-w- c:\windows\system32\drivers\ttmvmbdi.sys
2010-04-16 09:18 . 2009-04-14 23:48 -------- d-----w- c:\program files\Java
2010-04-16 09:17 . 2001-10-25 12:00 95892 ----a-w- c:\windows\system32\perfc005.dat
2010-04-16 09:17 . 2001-10-25 12:00 475970 ----a-w- c:\windows\system32\perfh005.dat
2010-04-14 21:50 . 2009-04-14 18:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 21:43 . 2009-04-14 17:56 -------- d-----w- c:\program files\Windows Media Connect 2
2010-04-14 19:20 . 2009-04-14 22:41 -------- d-----w- c:\program files\PowerArchiver
2010-03-23 22:09 . 2009-04-15 08:28 -------- d-----w- c:\program files\Translator 2005
2010-03-10 06:17 . 2008-04-14 06:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-08 22:08 . 2010-03-08 22:03 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft Device Emulator
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft SQL Server 2005 Mobile Edition
2010-03-08 21:57 . 2010-03-08 21:49 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-08 21:57 . 2010-03-08 21:51 -------- d-----w- c:\program files\HTML Help Workshop
2010-03-08 21:55 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Merge Modules
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Business Objects
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\CE Remote Tools
2010-02-25 06:18 . 2008-05-08 07:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-13 22:47 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 20:15 . 2010-02-17 20:15 -------- d-----w- c:\program files\Audacity 1.3. 9 Beta (Unicode)
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Common Files\Digidesign
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Audiffex
2010-02-17 14:34 . 2009-09-12 21:30 -------- d-----w- c:\program files\Vstplugins
2010-02-16 19:08 . 2008-04-14 08:06 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 19:08 . 2008-04-14 06:06 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-12 04:35 . 2008-04-14 06:51 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-13 22:30 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.
------- Sigcheck -------
[-] 2008-05-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-04-16_01.51.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-16 09:46 . 2010-04-16 09:46 16384 c:\windows\Temp\Perflib_Perfdata_6e8.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 85288 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 85288 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 479398 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 479398 c:\windows\system32\perfh009.dat
+ 2010-04-16 09:18 . 2010-04-12 15:29 153376 c:\windows\system32\javaws.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 153376 c:\windows\system32\javaws.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\javaw.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\javaw.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\java.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\java.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Bezpečnost" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-12 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\F:\0autocheck autochk *
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-17 16:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-10 16:20 689488 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2008-06-09 22:36 870920 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2010-02-22 09:40 207504 ----a-w- c:\menší programy\pdf24\pdf24.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-04-17 17:14 98304 ----a-w- c:\přehrávače\QuickTimePlayer\qttask.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Bezpečnost,síť\\QIP\\qip.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Vietcong\\vietcong_1.6_NO_CD_crack.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1234:UDP"= 1234:UDP:ab
"9875:UDP"= 9875:UDP:ac
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.4.2009 20:07 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 10:04 735960]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [14.4.2009 21:24 51160]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [14.4.2009 21:24 43736]
S0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.4.2009 20:07 160640]
S2 gupdate1ca03409edf825e;Služba Google Update (gupdate1ca03409edf825e);c:\program files\Google\Update\GoogleUpdate.exe [13.7.2009 0:32 133104]
S3 DfuUsb;DfuUsb;c:\windows\system32\drivers\dfuusb.sys [8.11.2007 22:51 10880]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasusb.sys [27.12.2009 13:08 18432]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 8:01 2799808]
--- Ostatní služby/ovladače v paměti ---
*Deregistered* - ttmvmbdi
.
Obsah adresáře 'Naplánované úlohy'
2010-04-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 22:28]
2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]
2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator 2005\WEBIE.DLL
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\eh7m0i36.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("html5.enable", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory:
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\ttmvmbdi]
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1614895754-1085031214-842925246-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a6,26,de,95,4a,9b,6f,9f,f2,de,b2,98,e1,fa,62,ca,c4,e3,98,e6,67,9b,2d,
69,1b,00,36,51,94,73,89,07,39,ce,5d,a1,46,57,c7,93,b4,71,05,f3,4d,ac,f7,90,\
"??"=hex:29,09,d2,a8,43,0c,17,31,e4,b9,9b,46,02,82,18,87
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1496)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(16712)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Celkový čas: 2010-04-16 11:57:14
ComboFix-quarantined-files.txt 2010-04-16 09:57
ComboFix2.txt 2010-04-16 01:57
Před spuštěním: Volných bajtů: 22 522 753 024
Po spuštění: Volných bajtů: 22 489 739 264
Current=7 Default=7 Failed=6 LastKnownGood=8 Sets=1,2,4,5,6,7,8
- - End Of File - - F3991BE37F7AB5179B57071D8CA2F978
davidrohusch píše:Asi sem lama ale co je ten ROOTKIT
http://www.rootkit.cz/go.phpJednoduše řečeno, Rootkit je program, který se snaží zamaskovat vlastní přítomnost v PC (přítomnost souborů, změn v registru Windows...), popř. přítomnost jiných aplikací v PC.
viz SPECIALNI ODKAZ v mem podpisudavidrohusch píše:Asi sem lama ale co je ten ROOTKIT
