VIRY.CZ

Ahoj, nedávno jsem měl ten sam problém. Někdo, kdo mi pomáhal a pomohl na nějákou dobu (za to muPji děkuji) mi napsal, že je nejlepší aktualizovat windows. Jenže problém je v tom, že se mi service pack nestáhne. Stránky mi nenajíždějí nikdy do plna, max. do půl stránky, příspěvek se neodešle, tak to posílám z notebooku. Avast mi neustále hlásí při spuštění jakéhokoliv programu virus Kates.32. Nějákou dobu byl klid, ale je to tady opět Díky předem za pomoc

Logfile of random's system information tool 1.07 (written by random/random)
Run by Radim at 2010-05-20 20:05:41
Systém Microsoft Windows XP Professional Service Pack 1
System drive I: has 33 GB (14%) free of 229 GB
Total RAM: 1023 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:05:51, on 20.5.2010
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\System32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
I:\Program Files\Alwil Software\Avast5\AvastSvc.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\ICQ6Toolbar\ICQ Service.exe
I:\Program Files\Google\Update\GoogleUpdate.exe
I:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\ZoneLabs\vsmon.exe
I:\WINDOWS\RTHDCPL.EXE
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
I:\Program Files\Winamp\winampa.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
I:\Program Files\CursorXP\CursorXP.exe
I:\Program Files\ICQ7.0\ICQ.exe
I:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
I:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
I:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
I:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
I:\WINDOWS\explorer.exe
I:\Program Files\Mozilla Firefox\firefox.exe
I:\WINDOWS\system32\notepad.exe
I:\Documents and Settings\Radim\Plocha\RSIT.exe
I:\Program Files\trend micro\Radim.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - I:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - I:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [StartCCC] I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "I:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "I:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "I:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] I:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CursorXP] I:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ICQ] "I:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [SUPERAntiSpyware] I:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ZoneAlarm.lnk = I:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: Download Video by Free YouTuBe Utility - I:\Program Files\Free YouTuBe Utility\IEydown.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://I:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - I:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - I:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - I:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O20 - Winlogon Notify: !SASWinLogon - I:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - I:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - I:\WINDOWS\System32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - I:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - I:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - I:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - I:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8107 bytes

======Scheduled tasks folder======

I:\WINDOWS\tasks\AppleSoftwareUpdate.job
I:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
I:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - I:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll [2005-04-14 327748]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - I:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Rádio - I:\WINDOWS\System32\msdxm.ocx [2002-09-20 844828]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - I:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll [2005-04-14 327748]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - I:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"DAEMON Tools-1033"=I:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]
"NeroFilterCheck"=I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"RTHDCPL"=I:\WINDOWS\RTHDCPL.EXE [2006-11-14 16270848]
"SkyTel"=I:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"QuickTime Task"=I:\Program Files\QuickTime\qttask.exe [2007-10-19 286720]
"WinampAgent"=I:\Program Files\Winamp\winampa.exe [2008-01-16 37376]
"SunJavaUpdateSched"=I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"Adobe Reader Speed Launcher"=I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=I:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avast5"=I:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-05-06 2815192]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-11-16 139264]
"CursorXP"=I:\Program Files\CursorXP\CursorXP.exe [2005-01-19 128000]
"ICQ"=I:\Program Files\ICQ7.0\ICQ.exe [2010-03-28 133368]
"SUPERAntiSpyware"=I:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2010-05-06 2017280]

I:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.lnk - I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
ZoneAlarm.lnk - I:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

I:\Documents and Settings\Radim\Nabídka Start\Programy\Po spuštění
RocketDock.lnk - I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="winmm.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
I:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
I:\WINDOWS\system32\Ati2evxx.dll [2008-06-03 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=I:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-05-20 20:05:41 ----D---- I:\rsit
2010-05-20 20:05:41 ----D---- I:\Program Files\trend micro
2010-05-20 19:55:00 ----A---- I:\ComboFix.txt
2010-05-20 19:44:58 ----SHD---- I:\RECYCLER
2010-05-19 16:16:22 ----D---- I:\Qoobox
2010-05-19 15:27:23 ----D---- I:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2010-05-19 15:27:15 ----D---- I:\Program Files\SUPERAntiSpyware
2010-05-19 15:27:15 ----D---- I:\Documents and Settings\Radim\Data aplikací\SUPERAntiSpyware.com
2010-05-18 17:22:00 ----D---- I:\WINDOWS\temp
2010-05-16 21:16:32 ----A---- I:\WINDOWS\zip.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\SWXCACLS.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\SWSC.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\SWREG.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\sed.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\PEV.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\NIRCMD.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\MBR.exe
2010-05-16 21:16:32 ----A---- I:\WINDOWS\grep.exe
2010-05-13 23:44:51 ----A---- I:\WINDOWS\System32\Legalizator_2.exe
2010-05-09 21:09:20 ----D---- I:\PScanner Backup
2010-05-09 19:42:30 ----D---- I:\Program Files\Lark Anti-Spyware
2010-05-09 19:40:38 ----D---- I:\Documents and Settings\All Users\Data aplikací\IObit
2010-05-09 19:40:36 ----D---- I:\Program Files\IObit
2010-04-27 23:24:07 ----D---- I:\Program Files\Fake Webcam
2010-04-25 19:26:58 ----D---- I:\Documents and Settings\Radim\Data aplikací\Audacity
2010-04-25 19:26:42 ----D---- I:\Program Files\Audacity 1.3 Beta (Unicode)
2010-04-25 14:24:18 ----D---- I:\Casino

======List of files/folders modified in the last 1 months======

2010-05-20 20:05:41 ----RD---- I:\Program Files
2010-05-20 19:55:05 ----D---- I:\WINDOWS\System32\drivers
2010-05-20 19:54:31 ----D---- I:\Program Files\Mozilla Firefox
2010-05-20 19:52:42 ----D---- I:\WINDOWS\System32\CatRoot2
2010-05-20 19:43:39 ----D---- I:\WINDOWS
2010-05-20 19:43:39 ----A---- I:\WINDOWS\system.ini
2010-05-20 19:43:19 ----D---- I:\WINDOWS\ERDNT
2010-05-20 19:43:09 ----D---- I:\WINDOWS\Debug
2010-05-20 19:41:03 ----D---- I:\WINDOWS\system32
2010-05-20 19:38:31 ----D---- I:\WINDOWS\AppPatch
2010-05-20 19:38:30 ----D---- I:\Program Files\Common Files
2010-05-20 19:31:44 ----A---- I:\WINDOWS\SchedLgU.Txt
2010-05-19 22:07:49 ----D---- I:\WINDOWS\Prefetch
2010-05-19 21:08:05 ----D---- I:\WINDOWS\Internet Logs
2010-05-19 16:09:57 ----D---- I:\Program Files\Cheat Engine
2010-05-19 15:27:23 ----SHD---- I:\WINDOWS\Installer
2010-05-19 15:26:54 ----D---- I:\Program Files\Common Files\Wise Installation Wizard
2010-05-18 18:50:52 ----D---- I:\Documents and Settings\Radim\Data aplikací\ICQ
2010-05-18 17:24:34 ----D---- I:\Documents and Settings\Radim\Data aplikací\ZipGenius
2010-05-18 16:49:28 ----D---- I:\Program Files\Anacondas 3D Adventure Game
2010-05-18 16:48:34 ----D---- I:\WINDOWS\uninstall
2010-05-13 23:53:48 ----A---- I:\WINDOWS\NeroDigital.ini
2010-05-09 21:10:51 ----SD---- I:\WINDOWS\Downloaded Program Files
2010-05-06 22:59:36 ----A---- I:\WINDOWS\System32\aswBoot.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; I:\WINDOWS\System32\drivers\Aavmker4.sys [2010-05-06 28880]
R1 aswSP;aswSP; I:\WINDOWS\System32\drivers\aswSP.sys [2010-05-06 164048]
R1 aswTdi;avast! Network Shield Support; I:\WINDOWS\System32\drivers\aswTdi.sys [2010-05-06 46672]
R1 SASDIFSV;SASDIFSV; \??\I:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\I:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 SSHDRV52;SSHDRV52; \??\I:\WINDOWS\System32\drivers\SSHDRV52.sys []
R2 aswMon2;avast! Standard Shield Support; I:\WINDOWS\System32\drivers\aswMon2.sys [2010-05-06 100432]
R2 atksgt;atksgt; I:\WINDOWS\System32\DRIVERS\atksgt.sys [2008-03-21 278728]
R2 Ethpdrv;Ethernet Packet Driver; I:\WINDOWS\System32\DRIVERS\ethpdrv.sys [2005-09-08 9728]
R2 lirsgt;lirsgt; I:\WINDOWS\System32\DRIVERS\lirsgt.sys [2008-03-21 25416]
R2 Nadim;NAD Proto Driver; I:\WINDOWS\System32\DRIVERS\nadim.sys [2008-11-08 18688]
R2 vsdatant;vsdatant; \??\I:\WINDOWS\System32\vsdatant.sys []
R3 aswRdr;aswRdr; I:\WINDOWS\System32\drivers\aswRdr.sys [2010-05-06 23376]
R3 ati2mtag;ati2mtag; I:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2008-06-03 3100160]
R3 catchme;catchme; \??\I:\hgjhgjhhg\catchme.sys []
R3 hamachi;Hamachi Network Interface; I:\WINDOWS\System32\DRIVERS\hamachi.sys [2007-11-21 25544]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; I:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); I:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; I:\WINDOWS\System32\DRIVERS\Rtnicxp.sys [2009-03-25 130432]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; I:\WINDOWS\System32\DRIVERS\usbehci.sys [2002-08-29 19328]
R3 usbhub;Ovladač standardního rozbočovače USB; I:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; I:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; I:\WINDOWS\System32\DRIVERS\usbuhci.sys [2002-08-29 19328]
S3 CCDECODE;Closed Caption Decoder; I:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 ENTECH;ENTECH; \??\I:\WINDOWS\System32\DRIVERS\ENTECH.SYS []
S3 gdrv;gdrv; \??\I:\WINDOWS\gdrv.sys []
S3 GNDHV71;Genius VideoCAM Live V2; I:\WINDOWS\System32\DRIVERS\gndhv71.sys [2003-08-06 310084]
S3 HidUsb;Ovladač třídy standardu HID; I:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 ipw_bus;IPWireless; I:\WINDOWS\System32\DRIVERS\ipw_bus.sys [2005-09-27 58320]
S3 ipw_mdfl;Wireless Broadband Modem Filter; I:\WINDOWS\System32\DRIVERS\ipw_mdfl.sys [2005-09-27 8272]
S3 ipw_mdm;Wireless Broadband Modem (WDM); I:\WINDOWS\System32\DRIVERS\ipw_mdm.sys [2005-09-27 95440]
S3 mbr;mbr; \??\I:\DOCUME~1\Radim\LOCALS~1\Temp\mbr.sys []
S3 mouhid;Ovladač myši standardu HID; I:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; I:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; I:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; I:\WINDOWS\System32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 RTL8169;Realtek 8169 NT Driver; I:\WINDOWS\System32\DRIVERS\Rtlh86.sys [2006-12-08 67072]
S3 SLIP;BDA Slip De-Framer; I:\WINDOWS\System32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; I:\WINDOWS\System32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 tap0901_2gm;VPN Anonymizer Adapter; I:\WINDOWS\System32\DRIVERS\tap0901_2gm.sys [2007-06-21 30720]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; I:\WINDOWS\System32\DRIVERS\usbccgp.sys [2002-08-29 28160]
S3 usbprint;Třída USB Printer; I:\WINDOWS\System32\DRIVERS\usbprint.sys [2002-08-29 24960]
S3 usbscan;Ovladač skeneru USB; I:\WINDOWS\System32\DRIVERS\usbscan.sys [2002-08-29 14208]
S3 WSTCODEC;World Standard Teletext Codec; I:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; I:\WINDOWS\System32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
R2 Ati HotKey Poller;Ati HotKey Poller; I:\WINDOWS\System32\Ati2evxx.exe [2008-06-03 552960]
R2 avast! Antivirus;avast! Antivirus; I:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R2 ICQ Service;ICQ Service; I:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 MDM;Machine Debug Manager; I:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 UMWdf;Windows User Mode Driver Framework; I:\WINDOWS\System32\wdfmgr.exe [2004-08-11 38912]
R2 vsmon;TrueVector Internet Monitor; I:\WINDOWS\system32\ZoneLabs\vsmon.exe [2003-02-14 914744]
R3 avast! Mail Scanner;avast! Mail Scanner; I:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R3 avast! Web Scanner;avast! Web Scanner; I:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
S2 ATI Smart;ATI Smart; I:\WINDOWS\system32\ati2sgag.exe [2008-06-02 593920]
S2 gupdate;Google Update Service (gupdate); I:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-15 135664]
S3 aspnet_state;ASP.NET State Service; I:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; I:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; I:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 NBService;NBService; I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 ose;Office Source Engine; I:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usprserv;User Privilege Service; I:\WINDOWS\System32\svchost.exe [2001-10-25 12800]

-----------------EOF-----------------

zdravím
na Vašem logu se pracuje

díky

I:\WINDOWS\System32\Legalizator_2.exe jste si jistý, že je toto opravdu správný soubor?

jelikož nemáte legální windows, nemáte šanci stáhnout sp2 ani sp3

vidím, že jste dnes aplikoval Combofix, ráda bych viděla log

upřímně, nevím kde se tam ten legalizator vzal, možná jsem to s něčím dávno stáhl, netuším... myslím že mi to dokonce u tohoto souboru hlásilo vir, ale myslím že jsem to přesunul do truhly.

ComboFix 10-05-20.02 - Radim 20.05.2010 19:32:03.9.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.420.1029.18.1023.656 [GMT 2:00]
Spuštěný z: i:\documents and settings\Radim\Plocha\hgjhgjhhg.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie i:\windows\system32\qmgr.dll byla nalezena a vyléčena.
Obnovena kopie z - i:\windows\ERDNT\cache\qmgr.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-20 do 2010-05-20 )))))))))))))))))))))))))))))))
.

2010-05-19 13:27 . 2010-05-19 13:27 -------- d-----w- i:\program files\SUPERAntiSpyware
2010-05-13 21:44 . 2008-04-28 19:40 673792 ----a-w- i:\windows\system32\Legalizator_2.exe
2010-05-09 19:09 . 2010-05-09 19:10 -------- d-----w- I:\PScanner Backup
2010-05-09 17:42 . 2010-05-09 17:43 -------- d-----w- i:\program files\Lark Anti-Spyware
2010-05-09 17:40 . 2010-05-09 17:40 -------- d-----w- i:\program files\IObit
2010-04-27 21:24 . 2010-04-27 21:24 -------- d-----w- i:\program files\Fake Webcam
2010-04-26 10:53 . 2010-05-18 15:15 70424 ----a-w- i:\windows\system32\GDIPFONTCACHEV1.DAT
2010-04-25 17:26 . 2010-04-25 17:26 -------- d-----w- i:\program files\Audacity 1.3 Beta (Unicode)
2010-04-25 12:24 . 2010-04-25 12:24 -------- d-----w- I:\Casino

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:09 . 2009-03-02 15:30 -------- d-----w- i:\program files\Cheat Engine
2010-05-19 13:26 . 2007-11-05 08:41 -------- d-----w- i:\program files\Common Files\Wise Installation Wizard
2010-05-18 14:49 . 2008-06-06 17:34 -------- d-----w- i:\program files\Anacondas 3D Adventure Game
2010-05-09 23:09 . 2010-05-10 04:30 4925952 ----a-w- i:\windows\Internet Logs\xDB9.tmp
2010-05-09 21:52 . 2010-05-10 04:30 20992 ----a-w- i:\windows\Internet Logs\xDBC.tmp
2010-05-09 17:44 . 2010-05-09 19:08 345088 ----a-w- i:\windows\Internet Logs\xDBA.tmp
2010-05-09 17:44 . 2010-05-09 19:07 4939264 ----a-w- i:\windows\Internet Logs\xDB8.tmp
2010-05-06 20:59 . 2007-11-07 20:04 38848 ----a-w- i:\windows\system32\avastSS.scr
2010-05-06 20:59 . 2007-11-07 20:04 165032 ----a-w- i:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2007-11-07 20:04 46672 ----a-w- i:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2009-09-18 18:21 164048 ----a-w- i:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2007-11-07 20:04 23376 ----a-w- i:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2007-11-07 20:04 100432 ----a-w- i:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2007-11-07 20:04 94800 ----a-w- i:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2007-11-07 20:04 28880 ----a-w- i:\windows\system32\drivers\aavmker4.sys
2010-04-12 12:20 . 2010-04-12 12:34 4546048 ----a-w- i:\windows\Internet Logs\xDB6.tmp
2010-04-12 12:15 . 2010-04-12 12:35 54272 ----a-w- i:\windows\Internet Logs\xDB7.tmp
2010-04-07 04:45 . 2010-04-07 04:48 4477440 ----a-w- i:\windows\Internet Logs\xDB4.tmp
2010-04-07 04:45 . 2010-04-07 04:48 109568 ----a-w- i:\windows\Internet Logs\xDB5.tmp
2010-04-02 12:24 . 2010-02-15 17:28 -------- d-----w- i:\program files\ICQ7.0
2010-03-28 11:56 . 2001-10-25 12:00 70106 ----a-w- i:\windows\system32\perfc005.dat
2010-03-28 11:56 . 2001-10-25 12:00 393192 ----a-w- i:\windows\system32\perfh005.dat
2010-03-24 21:23 . 2010-03-24 21:33 4345344 ----a-w- i:\windows\Internet Logs\xDB2.tmp
2010-03-24 21:21 . 2010-03-24 21:33 40448 ----a-w- i:\windows\Internet Logs\xDB3.tmp
2010-03-23 20:15 . 2010-03-23 20:15 -------- d-----w- i:\program files\Malwarebytes' Anti-Malware
2010-03-22 18:47 . 2010-01-13 16:39 -------- d-----w- i:\program files\ParadisePoker
2010-02-27 16:41 . 2010-02-27 17:36 129536 ----a-w- i:\windows\system32\xmlprov.dll
2009-01-24 15:03 . 2008-06-06 20:21 7168 --sha-w- i:\program files\Thumbs.db
2008-04-05 20:07 . 2008-04-05 20:07 208896 ----a-w- i:\program files\aaa.avi
.

------- Sigcheck -------

[-] 2002-09-20 . 9850DAF9FAF1488492A56ECC07576C12 . 155648 . . [5.4.3630.1106] . . i:\windows\system32\wuauclt.exe
[-] 2002-09-20 . 9850DAF9FAF1488492A56ECC07576C12 . 155648 . . [5.4.3630.1106] . . i:\windows\system32\dllcache\wuauclt.exe

[-] 2002-09-20 . 27A34CD2CCC7D805B168312200529C33 . 3274752 . . [6.00.2800.1106] . . i:\windows\system32\mshtml.dll
[-] 2002-09-20 . 27A34CD2CCC7D805B168312200529C33 . 3274752 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\mshtml.dll

[-] 2002-09-20 . B7A0710155878ACC22502A47F6C7866B . 634368 . . [6.00.2800.1106] . . i:\windows\system32\wininet.dll
[-] 2002-09-20 . B7A0710155878ACC22502A47F6C7866B . 634368 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\wininet.dll

[-] 2002-09-20 . 12CF330CBD51A756D560C7C8289B2553 . 946688 . . [6.00.2800.1106] . . i:\windows\explorer.exe
[-] 2002-09-20 . 12CF330CBD51A756D560C7C8289B2553 . 946688 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\explorer.exe


[-] 2010-02-27 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . i:\windows\system32\xmlprov.dll

i:\windows\System32\wscntfy.exe ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="i:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"CursorXP"="i:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ICQ"="i:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]
"SUPERAntiSpyware"="i:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-05-06 2017280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="i:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"DAEMON Tools-1033"="i:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"NeroFilterCheck"="i:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"QuickTime Task"="i:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"WinampAgent"="i:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"SunJavaUpdateSched"="i:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="i:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="i:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\System32\CTFMON.EXE" [2002-09-20 13312]

i:\documents and settings\Radim\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - i:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

i:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - i:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-5 113664]
ZoneAlarm.lnk - i:\program files\Zone Labs\ZoneAlarm\zonealarm.exe [2007-11-5 623936]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "i:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="i:\windows\System32\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- i:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

R0 d347bus;d347bus;i:\windows\system32\drivers\d347bus.sys [2.11.2007 14:11 155136]
R1 aswSP;aswSP;i:\windows\system32\drivers\aswSP.sys [18.9.2009 20:21 164048]
R1 SASDIFSV;SASDIFSV;i:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 11:25 12872]
R1 SASKUTIL;SASKUTIL;i:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6.5.2010 17:10 68168]
R1 SSHDRV52;SSHDRV52;i:\windows\system32\drivers\SSHDRV52.sys [3.12.2007 0:45 29184]
R2 Ethpdrv;Ethernet Packet Driver;i:\windows\system32\drivers\ethpdrv.sys [12.11.2007 15:57 9728]
R2 ICQ Service;ICQ Service;i:\program files\ICQ6Toolbar\ICQ Service.exe [15.2.2010 19:30 246520]
R2 Nadim;NAD Proto Driver;i:\windows\system32\drivers\nadim.sys [3.5.2009 21:04 18688]
S2 gupdate;Google Update Service (gupdate);i:\program files\Google\Update\GoogleUpdate.exe [15.1.2010 16:53 135664]
S3 GNDHV71;Genius VideoCAM Live V2;i:\windows\system32\drivers\gndhv71.sys [27.1.2008 13:57 310084]
S3 ipw_bus;IPWireless;i:\windows\system32\drivers\ipw_bus.sys [12.11.2007 15:56 58320]
S3 ipw_mdfl;Wireless Broadband Modem Filter;i:\windows\system32\drivers\ipw_mdfl.sys [12.11.2007 15:57 8272]
S3 ipw_mdm;Wireless Broadband Modem (WDM);i:\windows\system32\drivers\ipw_mdm.sys [12.11.2007 15:57 95440]
S3 tap0901_2gm;VPN Anonymizer Adapter;i:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-15 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2010-05-20 i:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 14:53]

2010-05-20 i:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 14:53]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
mStart Page = hxxp://www.yahoo.com
IE: Download Video by Free YouTuBe Utility - i:\program files\Free YouTuBe Utility\IEydown.htm
IE: E&xportovat do aplikace Microsoft Office Excel - i:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - i:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: DirectAnimation Java Classes - file://i:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://i:\windows\Java\classes\xmldso.cab
FF - ProfilePath - i:\documents and settings\Radim\Data aplikací\Mozilla\Firefox\Profiles\qj6i4j9l.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=

---- NASTAVENÍ FIREFOXU ----
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
i:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-20 19:43
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86D95D10]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7642aac
\Driver\ACPI -> ACPI.sys @ 0xf7581740
\Driver\atapi -> 0x86d95d10
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x80567e94
ParseProcedure -> ntoskrnl.exe @ 0x80566f60
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x80567e94
ParseProcedure -> ntoskrnl.exe @ 0x80566f60
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\atapi]
"ImagePath"="System32\Drivers\atapi.svs"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1454471165-1085031214-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"???n"=hex:17,51,d5,6b,0f,74,fd,97,ee,27,63,8c,99,7f,53,60,e2,e5,c9,53,f3,7a,
24,ec,af,68,d2,33,c3,ff,2e,a3,3f,54,e2,3f,62,2b,e6,06,f1,0c,a7,79,20,5f,0a,\
"?????"=hex:da,0c,85,5b,cc,8f,33,ef,70,bc,9f,13,0e,0e,67,bc
"???n"=hex:1c,21,78,c2,bf,06,60,c7,4d,46,a3,59,f7,7b,b4,8b,d7,95,46,45,aa,66,
81,50,1f,b1,0a,1e,08,60,7e,96,cb,26,2d,6e,46,c4,fc,ee,10,08,7e,07,5a,4d,fd,\
"??"=hex:ce,81,ff,79,54,6b,8c,6b,5e,47,70,c8,3c,12,64,7d,81,0c,77,fc,46,0a,97,
65,da,3e,9c,64,6b,e2,6a,c9,23,80,93,2d,26,b0,fe,76,23,11,9c,a5,62,65,a9,f7,\
"??"=hex:6d,29,2d,ef,ee,13,6e,6c,f1,d4,05,50,87,90,9d,6c

[HKEY_USERS\S-1-5-21-1454471165-1085031214-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:79,32,aa,7f,83,a8,ee,df,50,99,76,d3,03,d1,b9,15,69,28,59,75,b3,
90,c1,09,12,2a,84,f6,c4,ad,e4,5c,7f,1d,c4,74,9c,06,2d,65,21,1a,d0,4e,9b,89,\
"rkeysecu"=hex:62,39,c2,2d,4c,7c,31,70,09,eb,2f,d6,fa,f7,b8,78
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(796)
i:\windows\system32\wininet.dll
i:\windows\System32\MSGINA.dll
i:\windows\System32\ODBC32.dll
i:\program files\SUPERAntiSpyware\SASWINLO.dll
i:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(856)
i:\windows\system32\wininet.dll
i:\windows\system32\MSVCRT40.dll
i:\windows\system32\MSVCIRT.dll
i:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(2972)
i:\windows\system32\MSASN1.dll
i:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
i:\windows\System32\ntshrui.dll
i:\windows\System32\ATL.DLL
i:\windows\System32\MLANG.dll
i:\program files\CursorXP\CurXP0.dll
i:\windows\System32\printui.dll
i:\program files\SUPERAntiSpyware\SASSEH.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
i:\windows\System32\Ati2evxx.exe
i:\windows\system32\Ati2evxx.exe
i:\program files\Lavasoft\Ad-Aware\aawservice.exe
i:\program files\Alwil Software\Avast5\AvastSvc.exe
i:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
i:\windows\System32\wdfmgr.exe
i:\windows\system32\ZoneLabs\vsmon.exe
i:\windows\RTHDCPL.EXE
i:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
i:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
i:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
i:\program files\Java\jre1.6.0_07\bin\jucheck.exe
i:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Celkový čas: 2010-05-20 19:54:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-20 17:54
ComboFix2.txt 2010-05-19 20:41
ComboFix3.txt 2010-05-19 14:56
ComboFix4.txt 2010-05-18 15:21

Před spuštěním: Volných bajtů: 34 308 870 144
Po spuštění: Volných bajtů: 34 277 040 128

- - End Of File - - A08F19A902C33B1660666227A14FC235

teď koukám že je to z 13. 5., nevím o tom že bych to stahoval ani že bych to aplikoval

předem vás musím upozornit, že máte naprosto rozhozený celý systém a není jisté, že se to podaří
bude to spíš sebevražda

stáhněte si tento soubor http://riffman.ic.cz/files/Sys/wscntfy.exe a uložte na disk I tak, aby cesta k souboru byla I:\wscntfy.exe
(vzhledem k tomu, že je to extrahované z xp sp3, nezaručuji zdárný výsledek)

až to budete mít uložené, pokračujte následujícím postupem

riffman píše:stahnete TDSSKiller , rozbalte do slozky I:\WINDOWS\system32\drivers a spustte

zobrazi se nasledujici okno:



probehne sken, na jehoz konci se v pripade infekce zobrazi nasledujici okno:



Pokud uvidite na poslednim radku hlasku "Close all programs and choose Y to restart or N to continue", zmacknete klavesu Y a vas stroj bude restartovan

po restartu si otevrete Poznamkovy blok

do nej zkopirujte skript z nasledujiciho okna:

Kód: Vybrat vše

FMove::
I:\wscntfy.exe | I:\WINDOWS\system32\wscntfy.exe

ulozte vami vytvoreny textovy soubor jako CFScript.txt na disk C:

po ulozeni otevrete pruzkumnika Windows a najdete disk I s Combofixem a skriptem; uchopte vami vytvoreny skript levym tlacitkem mysi a presunte jej nad ikonu Combofixu, nad niz skript upustte:



po aplikaci by na vas mel vybafnout dalsi log, vlozte jej sem

Upozorneni: je mozne, ze po aplikaci skriptu a restartu nenabehnou Windows, v takovem pripade znovu restartujte, po restartu mackejte F8 a zvolte Posledni znamou fukncni konfiguraci

Dobře, jdu na to. Předem děkuji i kdyby výsledek nebyl pozitivní, každopádně jsem si to určitě zavinil sám a v případě nezdaru zkrátka přeinstaluju windows. Hlavní soubory už mám zálohované, předpokládal jsem že může něco takového přijít

kdyby došlo k přeinstalování, ihned potom doinstalujte všechny aktualizace a hlavně sp3 a až pak začněte instalovat ostatní věci (jako např. bricoPack atd.)

good luck

Každopádně vše jsem udělal podle návodu, TDSSKiller mi nenašel nic, CFScript jsem vytvořil a spustil v ComboFixu a teď čekám na Combofix. Opět to skenuje, což nevím jestli je správně ale nechám to tak

to, že to skenuje, je správně

ok, zrovna mi tam vyjelo že byl objeven rootkit, takže se to restartovalo a uvidíme co dál jak se zobrazí log, hodím ho hned sem

ComboFix 10-05-20.04 - Radim 20.05.2010 22:06:35.10.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.420.1029.18.1023.627 [GMT 2:00]
Spuštěný z: i:\documents and settings\Radim\Plocha\ComboFix.exe
Použité ovládací přepínače :: i:\documents and settings\Radim\Plocha\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie i:\windows\system32\qmgr.dll byla nalezena a vyléčena.
Obnovena kopie z - i:\windows\ERDNT\cache\qmgr.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-20 do 2010-05-20 )))))))))))))))))))))))))))))))
.

2010-05-20 19:53 . 2010-05-12 16:12 979792 ----a-w- i:\windows\system32\drivers\TDSSKiller.exe
2010-05-20 19:51 . 2010-05-20 19:51 13824 ----a-w- I:\wscntfy.exe
2010-05-20 18:05 . 2010-05-20 18:05 -------- d-----w- I:\rsit
2010-05-20 18:05 . 2010-05-20 18:05 -------- d-----w- i:\program files\trend micro
2010-05-19 13:27 . 2010-05-19 13:27 -------- d-----w- i:\program files\SUPERAntiSpyware
2010-05-13 21:44 . 2008-04-28 19:40 673792 ----a-w- i:\windows\system32\Legalizator_2.exe
2010-05-09 19:09 . 2010-05-09 19:10 -------- d-----w- I:\PScanner Backup
2010-05-09 17:42 . 2010-05-09 17:43 -------- d-----w- i:\program files\Lark Anti-Spyware
2010-05-09 17:40 . 2010-05-09 17:40 -------- d-----w- i:\program files\IObit
2010-04-27 21:24 . 2010-04-27 21:24 -------- d-----w- i:\program files\Fake Webcam
2010-04-26 10:53 . 2010-05-18 15:15 70424 ----a-w- i:\windows\system32\GDIPFONTCACHEV1.DAT
2010-04-25 17:26 . 2010-04-25 17:26 -------- d-----w- i:\program files\Audacity 1.3 Beta (Unicode)
2010-04-25 12:24 . 2010-04-25 12:24 -------- d-----w- I:\Casino

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:09 . 2009-03-02 15:30 -------- d-----w- i:\program files\Cheat Engine
2010-05-19 13:26 . 2007-11-05 08:41 -------- d-----w- i:\program files\Common Files\Wise Installation Wizard
2010-05-18 14:49 . 2008-06-06 17:34 -------- d-----w- i:\program files\Anacondas 3D Adventure Game
2010-05-09 23:09 . 2010-05-10 04:30 4925952 ----a-w- i:\windows\Internet Logs\xDB9.tmp
2010-05-09 21:52 . 2010-05-10 04:30 20992 ----a-w- i:\windows\Internet Logs\xDBC.tmp
2010-05-09 17:44 . 2010-05-09 19:08 345088 ----a-w- i:\windows\Internet Logs\xDBA.tmp
2010-05-09 17:44 . 2010-05-09 19:07 4939264 ----a-w- i:\windows\Internet Logs\xDB8.tmp
2010-05-06 20:59 . 2007-11-07 20:04 38848 ----a-w- i:\windows\system32\avastSS.scr
2010-05-06 20:59 . 2007-11-07 20:04 165032 ----a-w- i:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2007-11-07 20:04 46672 ----a-w- i:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2009-09-18 18:21 164048 ----a-w- i:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2007-11-07 20:04 23376 ----a-w- i:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2007-11-07 20:04 100432 ----a-w- i:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2007-11-07 20:04 94800 ----a-w- i:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2007-11-07 20:04 28880 ----a-w- i:\windows\system32\drivers\aavmker4.sys
2010-04-12 12:20 . 2010-04-12 12:34 4546048 ----a-w- i:\windows\Internet Logs\xDB6.tmp
2010-04-12 12:15 . 2010-04-12 12:35 54272 ----a-w- i:\windows\Internet Logs\xDB7.tmp
2010-04-07 04:45 . 2010-04-07 04:48 4477440 ----a-w- i:\windows\Internet Logs\xDB4.tmp
2010-04-07 04:45 . 2010-04-07 04:48 109568 ----a-w- i:\windows\Internet Logs\xDB5.tmp
2010-04-02 12:24 . 2010-02-15 17:28 -------- d-----w- i:\program files\ICQ7.0
2010-03-28 11:56 . 2001-10-25 12:00 70106 ----a-w- i:\windows\system32\perfc005.dat
2010-03-28 11:56 . 2001-10-25 12:00 393192 ----a-w- i:\windows\system32\perfh005.dat
2010-03-24 21:23 . 2010-03-24 21:33 4345344 ----a-w- i:\windows\Internet Logs\xDB2.tmp
2010-03-24 21:21 . 2010-03-24 21:33 40448 ----a-w- i:\windows\Internet Logs\xDB3.tmp
2010-03-23 20:15 . 2010-03-23 20:15 -------- d-----w- i:\program files\Malwarebytes' Anti-Malware
2010-03-22 18:47 . 2010-01-13 16:39 -------- d-----w- i:\program files\ParadisePoker
2010-02-27 16:41 . 2010-02-27 17:36 129536 ----a-w- i:\windows\system32\xmlprov.dll
2009-01-24 15:03 . 2008-06-06 20:21 7168 --sha-w- i:\program files\Thumbs.db
2008-04-05 20:07 . 2008-04-05 20:07 208896 ----a-w- i:\program files\aaa.avi
.

------- Sigcheck -------

[-] 2002-09-20 . 9850DAF9FAF1488492A56ECC07576C12 . 155648 . . [5.4.3630.1106] . . i:\windows\system32\wuauclt.exe
[-] 2002-09-20 . 9850DAF9FAF1488492A56ECC07576C12 . 155648 . . [5.4.3630.1106] . . i:\windows\system32\dllcache\wuauclt.exe

[-] 2002-09-20 . 27A34CD2CCC7D805B168312200529C33 . 3274752 . . [6.00.2800.1106] . . i:\windows\system32\mshtml.dll
[-] 2002-09-20 . 27A34CD2CCC7D805B168312200529C33 . 3274752 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\mshtml.dll

[-] 2002-09-20 . B7A0710155878ACC22502A47F6C7866B . 634368 . . [6.00.2800.1106] . . i:\windows\system32\wininet.dll
[-] 2002-09-20 . B7A0710155878ACC22502A47F6C7866B . 634368 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\wininet.dll

[-] 2002-09-20 . 12CF330CBD51A756D560C7C8289B2553 . 946688 . . [6.00.2800.1106] . . i:\windows\explorer.exe
[-] 2002-09-20 . 12CF330CBD51A756D560C7C8289B2553 . 946688 . . [6.00.2800.1106] . . i:\windows\system32\dllcache\explorer.exe


[-] 2010-02-27 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . i:\windows\system32\xmlprov.dll

i:\windows\System32\wscntfy.exe ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="i:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"CursorXP"="i:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ICQ"="i:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]
"SUPERAntiSpyware"="i:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-05-06 2017280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="i:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"DAEMON Tools-1033"="i:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"NeroFilterCheck"="i:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"QuickTime Task"="i:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"WinampAgent"="i:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"SunJavaUpdateSched"="i:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="i:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="i:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="i:\windows\System32\CTFMON.EXE" [2002-09-20 13312]

i:\documents and settings\Radim\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - i:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

i:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - i:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-5 113664]
ZoneAlarm.lnk - i:\program files\Zone Labs\ZoneAlarm\zonealarm.exe [2007-11-5 623936]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "i:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="i:\windows\System32\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- i:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

R0 d347bus;d347bus;i:\windows\system32\drivers\d347bus.sys [2.11.2007 14:11 155136]
R1 aswSP;aswSP;i:\windows\system32\drivers\aswSP.sys [18.9.2009 20:21 164048]
R1 SASDIFSV;SASDIFSV;i:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 11:25 12872]
R1 SASKUTIL;SASKUTIL;i:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6.5.2010 17:10 68168]
R1 SSHDRV52;SSHDRV52;i:\windows\system32\drivers\SSHDRV52.sys [3.12.2007 0:45 29184]
R2 Ethpdrv;Ethernet Packet Driver;i:\windows\system32\drivers\ethpdrv.sys [12.11.2007 15:57 9728]
R2 ICQ Service;ICQ Service;i:\program files\ICQ6Toolbar\ICQ Service.exe [15.2.2010 19:30 246520]
R2 Nadim;NAD Proto Driver;i:\windows\system32\drivers\nadim.sys [3.5.2009 21:04 18688]
S2 gupdate;Google Update Service (gupdate);i:\program files\Google\Update\GoogleUpdate.exe [15.1.2010 16:53 135664]
S3 GNDHV71;Genius VideoCAM Live V2;i:\windows\system32\drivers\gndhv71.sys [27.1.2008 13:57 310084]
S3 ipw_bus;IPWireless;i:\windows\system32\drivers\ipw_bus.sys [12.11.2007 15:56 58320]
S3 ipw_mdfl;Wireless Broadband Modem Filter;i:\windows\system32\drivers\ipw_mdfl.sys [12.11.2007 15:57 8272]
S3 ipw_mdm;Wireless Broadband Modem (WDM);i:\windows\system32\drivers\ipw_mdm.sys [12.11.2007 15:57 95440]
S3 tap0901_2gm;VPN Anonymizer Adapter;i:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-15 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2010-05-20 i:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 14:53]

2010-05-20 i:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 14:53]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
mStart Page = hxxp://www.yahoo.com
IE: Download Video by Free YouTuBe Utility - i:\program files\Free YouTuBe Utility\IEydown.htm
IE: E&xportovat do aplikace Microsoft Office Excel - i:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - i:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: DirectAnimation Java Classes - file://i:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://i:\windows\Java\classes\xmldso.cab
FF - ProfilePath - i:\documents and settings\Radim\Data aplikací\Mozilla\Firefox\Profiles\qj6i4j9l.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - plugin: i:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: i:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: i:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: i:\program files\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: i:\program files\Mozilla Firefox\plugins\npmozax.dll

---- NASTAVENÍ FIREFOXU ----
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
i:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
i:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-20 22:20
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86C78B38]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7642aac
\Driver\ACPI -> ACPI.sys @ 0xf7581740
\Driver\atapi -> 0x86c78b38
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x80567e94
ParseProcedure -> ntoskrnl.exe @ 0x80566f60
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x80567e94
ParseProcedure -> ntoskrnl.exe @ 0x80566f60
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\atapi]
"ImagePath"="System32\Drivers\atapi.svs"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1454471165-1085031214-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"???n"=hex:17,51,d5,6b,0f,74,fd,97,ee,27,63,8c,99,7f,53,60,e2,e5,c9,53,f3,7a,
24,ec,af,68,d2,33,c3,ff,2e,a3,3f,54,e2,3f,62,2b,e6,06,f1,0c,a7,79,20,5f,0a,\
"?????"=hex:da,0c,85,5b,cc,8f,33,ef,70,bc,9f,13,0e,0e,67,bc
"???n"=hex:1c,21,78,c2,bf,06,60,c7,4d,46,a3,59,f7,7b,b4,8b,d7,95,46,45,aa,66,
81,50,1f,b1,0a,1e,08,60,7e,96,cb,26,2d,6e,46,c4,fc,ee,10,08,7e,07,5a,4d,fd,\
"??"=hex:ce,81,ff,79,54,6b,8c,6b,5e,47,70,c8,3c,12,64,7d,81,0c,77,fc,46,0a,97,
65,da,3e,9c,64,6b,e2,6a,c9,23,80,93,2d,26,b0,fe,76,23,11,9c,a5,62,65,a9,f7,\
"??"=hex:6d,29,2d,ef,ee,13,6e,6c,f1,d4,05,50,87,90,9d,6c

[HKEY_USERS\S-1-5-21-1454471165-1085031214-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:79,32,aa,7f,83,a8,ee,df,50,99,76,d3,03,d1,b9,15,69,28,59,75,b3,
90,c1,09,12,2a,84,f6,c4,ad,e4,5c,7f,1d,c4,74,9c,06,2d,65,21,1a,d0,4e,9b,89,\
"rkeysecu"=hex:62,39,c2,2d,4c,7c,31,70,09,eb,2f,d6,fa,f7,b8,78
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(800)
i:\windows\System32\MSGINA.dll
i:\windows\System32\ODBC32.dll
i:\windows\system32\wininet.dll
i:\program files\SUPERAntiSpyware\SASWINLO.dll
i:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(856)
i:\windows\system32\MSVCRT40.dll
i:\windows\system32\MSVCIRT.dll
i:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(3204)
i:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
i:\windows\System32\ntshrui.dll
i:\windows\System32\ATL.DLL
i:\program files\CursorXP\CurXP0.dll
i:\windows\System32\msi.dll
i:\windows\system32\MSASN1.dll
i:\windows\System32\printui.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
i:\windows\System32\Ati2evxx.exe
i:\program files\Lavasoft\Ad-Aware\aawservice.exe
i:\windows\system32\Ati2evxx.exe
i:\program files\Alwil Software\Avast5\AvastSvc.exe
i:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
i:\windows\System32\wdfmgr.exe
i:\windows\system32\ZoneLabs\vsmon.exe
i:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
i:\windows\RTHDCPL.EXE
i:\program files\Java\jre1.6.0_07\bin\jucheck.exe
i:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2010-05-20 22:39:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-20 20:39
ComboFix2.txt 2010-05-20 17:55
ComboFix3.txt 2010-05-19 20:41
ComboFix4.txt 2010-05-19 14:56
ComboFix5.txt 2010-05-20 19:59

Před spuštěním: Volných bajtů: 34 199 441 408
Po spuštění: Volných bajtů: 34 158 432 256

- - End Of File - - D2066EA5ACA0B97F63896F18D58A1878

zmetek se tam objevuje stále, je to bohužel díky chybějícím záplatám...bez sp3 se nehneme z místa

zkusíme ještě toto

stáhněte GMER , rozbalte a spusťte

proběhne sken; po jeho ukončení se zobrazí výsledky

pak klikněte na Save a uložíte tak log; jeho obsah sem vložte

potom dle tohoto návodu absolvujte druhý sken a opět obsah logu sem

nj :/ je nějáký jiný způsob, jak sp3 stáhnout? třeba že bych ho stáhnul na ntb a přes flashku to hodil do PC? Na ntb se mi aktualizuje windows sám, ani se mě neptá. Na PC to tak není no, není tam ani žádná aplikace která tohle dělá. Pouze Windows Update, který stejně nasměruje na stránku Microsoftu. Jinak udělal jsem malý scan a v zápětí po uložení toho malého scanu jsem chtěl udělat velký scan a od té doby program neodpovídá. Nefunguje ani správce úloh. Mám restartovat?