Prosím o kontrolu logu notebooku...

[daviii]

Zdravím, mám ten problém, že mi jede strašně pomalu internet při připojení přes drát ( vysokorychlostní připojení )...Při připojení WIFI se nic neseká a stránky se načítají normální rychlostí... Pokoušel jsem se přeinstalovat síťovou kartu, ale nepomohlo to ... Poradíte mi někdo?

Děkuju

tady je log:


Logfile of random's system information tool 1.07 (written by random/random)
Run by David Schenk at 2010-05-27 17:26:41
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 1 GB (8%) free of 15 GB
Total RAM: 1919 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:26:51, on 27.5.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\UMStor\Res.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\oodtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Seznam.cz\postak.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\OrCAD\license_manager\lmgrd.exe
C:\WINDOWS\system32\cisvc.exe
C:\OrCAD\license_manager\cdslmd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Comodo\Dragon\dragon.exe
C:\Program Files\Comodo\Dragon\dragon.exe
C:\Program Files\Comodo\Dragon\dragon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\David Schenk\Plocha\RSIT.exe
C:\Program Files\trend micro\David Schenk.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\David Schenk\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\David Schenk\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.2.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [USB AV] C:\Program Files\USB Virus Cleaner\USBAV.exe
O4 - HKLM\..\Run: [USBAV] C:\Program Files\USB Virus Cleaner\USBAV.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files\Seznam.cz\postak.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\David Schenk\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Cadence License Manager - GLOBEtrotter Software Inc. - C:\OrCAD\license_manager\lmgrd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8956 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Driver Fetch.job
C:\WINDOWS\tasks\expressburnSevenDaysInit.job
C:\WINDOWS\tasks\expressburnShakeIcon.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-362288127-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-362288127-839522115-1003UA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\ctbr.dll [2010-01-29 1230184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\David Schenk\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-04-12 149968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-19 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files\Seznam.cz\core.2.dll [2009-09-23 1075352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\ctbr.dll [2010-01-29 1230184]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2010-04-08 2176512]
"USB Storage Toolbox"=C:\WINDOWS\UMStor\Res.EXE [2005-09-14 65536]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-10-30 16269312]
"OODefragTray"=C:\WINDOWS\system32\oodtray.exe [2009-04-08 2553088]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"HControl"=C:\WINDOWS\ATK0100\HControl.exe [2006-10-14 110592]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"USB AV"=C:\Program Files\USB Virus Cleaner\USBAV.exe [2010-04-22 270336]
"USBAV"=C:\Program Files\USB Virus Cleaner\USBAV.exe [2010-04-22 270336]
"THGuard"=C:\Program Files\TrojanHunter 4.2\THGuard.exe [2005-02-19 1089024]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"=C:\Program Files\Seznam.cz\postak.exe [2009-09-23 434840]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2009-12-10 3037696]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2010-05-16 323392]
"Google Update"=C:\Documents and Settings\David Schenk\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-05-23 136176]

C:\Documents and Settings\David Schenk\Nabídka Start\Programy\Po spuštění
Bitmeter2.lnk - C:\Program Files\Codebox\BitMeter\BitMeter2.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-07-04 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"DisableChangePassword"=0
"DisableLockWorkstation"=0
"NoDispSettingsPage"=0
"NoDispAppearancePage"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149
"NoDriveAutoRun"=4294967295
"NoDrives"=0
"NoFileUrl"=0
"NoRun"=0
"NoUpdateCheck"=0
"NoLogoff"=0
"NoClose"=0
"NoSetFolders"=0
"NoFind"=0
"NoDesktop"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\KN_StrongDC\StrongDC.exe"="C:\Program Files\KN_StrongDC\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Program Files\Comodo\Dragon\dragon.exe"="C:\Program Files\Comodo\Dragon\dragon.exe:*:Enabled:Dragon"
"C:\OrCAD\OrCAD_10.0\tools\bin\cdsNameServer.exe"="C:\OrCAD\OrCAD_10.0\tools\bin\cdsNameServer.exe:*:Enabled:cdsNameServer"
"C:\OrCAD\OrCAD_10.0\tools\bin\cdsMsgServer.exe"="C:\OrCAD\OrCAD_10.0\tools\bin\cdsMsgServer.exe:*:Enabled:cdsMsgServer"
"C:\OrCAD\OrCAD_10.0\tools\jre\bin\javaw.exe"="C:\OrCAD\OrCAD_10.0\tools\jre\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-05-27 17:24:20 ----D---- C:\rsit
2010-05-26 12:21:30 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-05-23 17:08:02 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Moto assistant
2010-05-23 17:07:59 ----D---- C:\Moto assistant
2010-05-21 00:02:29 ----D---- C:\Program Files\VirusSecureLab
2010-05-20 23:27:44 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Avira
2010-05-20 23:05:30 ----D---- C:\Program Files\TrojanHunter 4.2
2010-05-20 22:14:49 ----A---- C:\mbam-error.txt
2010-05-20 22:11:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-05-20 21:57:44 ----D---- C:\WINDOWS\USB Virus Cleaner
2010-05-20 21:57:44 ----D---- C:\Program Files\USB Virus Cleaner
2010-05-20 20:00:58 ----D---- C:\Program Files\SpeedFan
2010-05-20 19:43:09 ----D---- C:\Program Files\Avira
2010-05-20 19:43:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Avira
2010-05-18 17:53:52 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\vlc
2010-05-16 14:33:52 ----D---- C:\WINDOWS\$regcmp$
2010-05-16 14:30:00 ----D---- C:\Program Files\AIMP2
2010-05-16 13:45:47 ----HDC---- C:\WINDOWS\$NtUninstallKB923232$
2010-05-16 13:45:41 ----D---- C:\WINDOWS\ATK0100
2010-05-16 12:14:39 ----HDC---- C:\WINDOWS\$NtUninstallKB918005$
2010-05-16 11:32:05 ----D---- C:\Program Files\ASUS
2010-05-16 11:30:51 ----D---- C:\Program Files\DNA
2010-05-16 11:30:51 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\DNA
2010-05-12 07:03:41 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-05-10 23:34:11 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Blitware
2010-05-10 23:33:39 ----D---- C:\Program Files\Driver Fetch

======List of files/folders modified in the last 1 months======

2010-05-27 17:26:43 ----D---- C:\Program Files\trend micro
2010-05-27 16:51:46 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\foobar2000
2010-05-27 15:08:19 ----D---- C:\WINDOWS\Prefetch
2010-05-27 14:02:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-05-27 14:01:00 ----D---- C:\WINDOWS\temp
2010-05-27 13:51:25 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-27 13:47:31 ----D---- C:\WINDOWS
2010-05-27 13:05:44 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-27 12:56:17 ----A---- C:\WINDOWS\CRC.INI
2010-05-27 09:49:39 ----D---- C:\WINDOWS\system32
2010-05-26 14:17:45 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\dvdcss
2010-05-26 12:21:38 ----HD---- C:\WINDOWS\inf
2010-05-25 19:10:01 ----D---- C:\WINDOWS\system32\oodag
2010-05-24 08:55:23 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Skype
2010-05-24 08:54:54 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\skypePM
2010-05-23 10:48:43 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Power Sound Editor Free
2010-05-23 10:39:33 ----D---- C:\temp
2010-05-23 08:19:30 ----SD---- C:\WINDOWS\Tasks
2010-05-22 00:06:17 ----D---- C:\Program Files\Mozilla Firefox
2010-05-21 22:49:01 ----D---- C:\Program Files\Crawler
2010-05-21 21:30:02 ----AC---- C:\WINDOWS\NeroDigital.ini
2010-05-21 17:17:36 ----D---- C:\WINDOWS\system32\NtmsData
2010-05-21 17:05:29 ----D---- C:\WINDOWS\Registration
2010-05-21 14:45:52 ----SHD---- C:\System Volume Information
2010-05-21 03:19:38 ----D---- C:\WINDOWS\security
2010-05-21 00:02:29 ----D---- C:\Program Files
2010-05-20 23:05:40 ----R---- C:\WINDOWS\streamhlp.dll
2010-05-20 22:14:44 ----D---- C:\WINDOWS\system32\drivers
2010-05-20 21:19:01 ----D---- C:\Documents and Settings\David Schenk\Data aplikací\Spyware Terminator
2010-05-20 17:29:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-19 21:17:03 ----D---- C:\WINDOWS\system32\CatRoot_bak
2010-05-19 21:17:03 ----D---- C:\WINDOWS\system32\CatRoot
2010-05-19 18:39:07 ----D---- C:\WINDOWS\repair
2010-05-19 18:13:22 ----SHD---- C:\WINDOWS\Installer
2010-05-19 18:13:21 ----D---- C:\Config.Msi
2010-05-19 18:13:02 ----D---- C:\WINDOWS\WinSxS
2010-05-16 14:38:15 ----D---- C:\WINDOWS\system32\config
2010-05-16 14:01:39 ----D---- C:\Documents and Settings
2010-05-16 14:00:50 ----ASH---- C:\boot.ini
2010-05-16 13:52:33 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-05-16 13:47:13 ----A---- C:\WINDOWS\imsins.BAK
2010-05-16 13:44:58 ----HD---- C:\Program Files\InstallShield Installation Information
2010-05-12 07:03:45 ----D---- C:\Program Files\Outlook Express
2010-05-12 06:58:10 ----HD---- C:\WINDOWS\$hf_mig$
2010-05-10 23:09:10 ----D---- C:\Program Files\The KMPlayer
2010-04-30 20:51:06 ----AC---- C:\WINDOWS\system32\MRT.exe
2010-04-30 10:46:01 ----D---- C:\WINDOWS\system32\Restore
2010-04-30 01:46:34 ----D---- C:\Program Files\IrfanView
2010-04-28 09:08:35 ----AC---- C:\WINDOWS\capture.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys []
R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2006-12-05 529344]
R3 ASNDIS5;ASNDIS5 Protocol Driver; \??\C:\WINDOWS\ATK0100\ASNDIS5.SYS []
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-07-04 2304000]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2006-03-02 14080]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2006-03-02 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-03 4394496]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2004-04-01 10368]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-12-14 85120]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2006-03-02 67584]
R3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys [2006-08-07 980608]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-04-19 30080]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-03-02 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2006-04-19 17152]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-03-02 26496]
S2 MLPTDR_Q;MLPTDR_Q; \??\C:\WINDOWS\system32\MLPTDR_Q.sys []
S3 aoq6yoo3;aoq6yoo3; C:\WINDOWS\system32\drivers\aoq6yoo3.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-22 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-22 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-06-22 21744]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2006-03-02 10880]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2006-03-02 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2007-05-14 445696]
S3 sffdisk;Ovladač třídy úložiště SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2006-03-02 11136]
S3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2006-03-02 10240]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2006-03-02 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2006-03-02 15360]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2006-03-02 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-03 78464]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 Aswape;Aswape; C:\WINDOWS\system32\drivers\Aswape.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\DAVIDS~1\LOCALS~1\Temp\mc26.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-07-04 483328]
R2 Cadence License Manager;Cadence License Manager; C:\OrCAD\license_manager\lmgrd.exe [2002-08-09 608768]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-19 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-03-19 335872]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2009-04-08 1377536]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-04-08 488960]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2006-12-28 123248]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-03-02 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[daviii]

ComboFix 10-05-28.01 - David Schenk 28.05.2010 20:31:55.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1919.1501 [GMT 2:00]
Spuštěný z: c:\documents and settings\David Schenk\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\VB40032.DLL
c:\windows\system32\win32.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-28 do 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-27 15:24 . 2010-05-27 15:29 -------- d-----w- C:\rsit
2010-05-23 15:07 . 2010-05-23 15:08 -------- d-----w- C:\Moto assistant
2010-05-20 22:02 . 2010-05-20 22:02 -------- d-----w- c:\program files\VirusSecureLab
2010-05-20 21:05 . 2010-05-20 21:48 -------- d-----w- c:\program files\TrojanHunter 4.2
2010-05-20 20:11 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-20 20:11 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-20 20:11 . 2010-05-20 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-20 19:57 . 2010-05-20 19:58 -------- d-----w- c:\program files\USB Virus Cleaner
2010-05-20 19:57 . 2010-05-20 19:57 -------- d-----w- c:\windows\USB Virus Cleaner
2010-05-20 18:00 . 2010-05-27 14:48 -------- d-----w- c:\program files\SpeedFan
2010-05-20 17:43 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-20 17:43 . 2010-02-16 12:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-20 17:43 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-20 17:43 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-20 17:43 . 2010-05-20 17:43 -------- d-----w- c:\program files\Avira
2010-05-16 12:48 . 2010-05-16 12:48 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-05-16 12:33 . 2010-05-16 12:38 -------- d-----w- c:\windows\$regcmp$
2010-05-16 12:30 . 2010-05-16 12:30 -------- d-----w- c:\program files\AIMP2
2010-05-16 11:45 . 2010-05-16 11:52 -------- d-----w- c:\windows\ATK0100
2010-05-16 11:42 . 2006-08-03 14:02 81664 -c----w- c:\windows\system32\dllcache\videoprt.sys
2010-05-16 10:13 . 2006-04-19 11:50 17152 -c----w- c:\windows\system32\dllcache\usbohci.sys
2010-05-16 10:13 . 2006-04-19 11:50 20608 -c----w- c:\windows\system32\dllcache\usbuhci.sys
2010-05-16 10:13 . 2006-04-19 11:50 30080 -c----w- c:\windows\system32\dllcache\usbehci.sys
2010-05-16 10:13 . 2006-04-19 11:50 143360 -c----w- c:\windows\system32\dllcache\usbport.sys
2010-05-16 09:32 . 2010-05-16 12:13 -------- d-----w- c:\program files\ASUS
2010-05-16 09:30 . 2010-05-27 11:47 -------- d-----w- c:\program files\DNA
2010-05-10 21:33 . 2010-05-10 21:38 -------- d-----w- c:\program files\Driver Fetch
2010-05-01 10:18 . 2010-05-01 10:18 -------- d-----w- c:\documents and settings\David Schenk\.cdsdoc

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 15:26 . 2009-10-14 20:30 -------- d-----w- c:\program files\trend micro
2010-05-23 14:38 . 2009-05-19 07:53 14 -c--a-w- c:\windows\mm.sys
2010-05-21 20:49 . 2010-03-13 00:34 -------- d-----w- c:\program files\Crawler
2010-05-20 12:58 . 2009-10-14 06:09 8722 -c--a-w- c:\windows\hh.dat
2010-05-16 11:44 . 2009-04-30 17:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-10 21:09 . 2010-03-11 17:59 -------- d-----w- c:\program files\The KMPlayer
2010-05-03 14:27 . 2010-03-27 08:03 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-29 23:46 . 2009-04-30 18:35 -------- d-----w- c:\program files\IrfanView
2010-04-27 21:38 . 2009-12-03 08:27 -------- d-----w- c:\program files\Spyware Terminator
2010-04-27 06:48 . 2009-04-30 20:02 -------- d-----w- c:\program files\QIP
2010-04-27 06:47 . 2010-04-27 06:13 -------- d-----w- c:\program files\QIP 2010
2010-04-26 17:30 . 2010-03-16 10:48 -------- d-----w- c:\program files\Comodo
2010-04-20 15:57 . 2009-11-26 17:01 -------- d-----w- c:\program files\WinClamAVShield
2010-04-19 17:32 . 2010-04-19 17:32 411368 -c--a-w- c:\windows\system32\deployJava1.dll
2010-04-19 17:31 . 2010-04-19 17:31 -------- d-----w- c:\program files\Java
2010-04-19 17:30 . 2006-03-02 12:00 82840 ----a-w- c:\windows\system32\perfc005.dat
2010-04-19 17:30 . 2006-03-02 12:00 437574 ----a-w- c:\windows\system32\perfh005.dat
2010-04-14 06:13 . 2009-04-30 18:40 -------- d-----r- c:\program files\Skype
2010-03-30 17:59 . 2010-03-28 07:47 -------- d-----w- c:\program files\Any Audio Converter
2010-03-20 16:31 . 2010-03-20 16:31 7240 ----a-w- C:\LICENSE.DAT
2010-03-20 08:42 . 2009-11-12 18:55 691696 -c--a-w- c:\windows\system32\drivers\sptd.sys
2010-03-10 06:17 . 2006-03-02 12:00 420352 -c--a-w- c:\windows\system32\vbscript.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 15:50 1197448 -c--a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"="c:\program files\Seznam.cz\postak.exe" [2009-09-23 434840]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2009-12-09 3037696]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2010-05-16 323392]
"Google Update"="c:\documents and settings\David Schenk\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-05-23 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-04-08 2176512]
"USB Storage Toolbox"="c:\windows\UMStor\Res.EXE" [2005-09-14 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2009-04-08 2553088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"USB AV"="c:\program files\USB Virus Cleaner\USBAV.exe" [2010-04-22 270336]
"USBAV"="c:\program files\USB Virus Cleaner\USBAV.exe" [2010-04-22 270336]
"THGuard"="c:\program files\TrojanHunter 4.2\THGuard.exe" [2005-02-19 1089024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]

c:\documents and settings\David Schenk\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bitmeter2.lnk - c:\program files\Codebox\BitMeter\BitMeter2.exe [2005-9-15 970752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0OODBS\0crcnat.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\KN_StrongDC\\StrongDC.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Comodo\\Dragon\\dragon.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\bin\\cdsNameServer.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\bin\\cdsMsgServer.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [22.11.2009 23:36 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [20.5.2010 19:43 135336]
R2 Cadence License Manager;Cadence License Manager;c:\orcad\license_manager\lmgrd.exe [20.3.2010 18:32 608768]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.11.2009 20:55 691696]
S2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [22.7.2003 3:44 18848]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2.8.2005 23:10 32512]
S4 Aswape;Aswape; [x]
.
Obsah adresáře 'Naplánované úlohy'

2010-05-28 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 15:50]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Zobrazit originál
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

ShellIconOverlayIdentifiers-{02696AD5-FF96-454b-9E00-81DA8B79B678} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 20:37
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-776561741-362288127-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="C6B6A767223CB62FF9F3D854BF0BC4AC3333599712615D0217AD022BB4E0C0EFCD285399D484757B8661B0D73EF549E38B4F2C5C7FB1E06FEFA8619314775FFA3E42DCA5A017956DC5BE9C7A49FBC3686B0812280817EED4931CC5979F9343B816A8798D995881E049FBE9F6D35E0ADA133B928A1F54E5B913F30FB7EE93F133D6F400EA16650C05A3FD8899171755AD47BB57A5805C08F5050F418C5D87FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6171C11EC38DE3D8EDD5E5BE2F6E6676FDC1B06F94E105265169FF4FE5BD95BE63A3FD38D15CB314D97087B766885405DC800FB403420269BB484E2BCFA15612D7145DC3A64C25D4C66489E398D7841CB4485A4B8A91297A453043B0EEEAC409F84195FD55E5DB67FE02AE867CC88A74B3C868963C8B8539C40CA944CC7123F01C8D81E32A74EC47282DC6CED7F4A5852EEE529E7C129B9FEA28CF9F6A7FCDFF9E628D3C8F70C42161B92AC5D13156BB87007758ED4BA60B0F1FD6AB0C567CF165E2C29359BD09BBE4C05236B8706AABDA9D1D5475A0C0F767BD7D9406F0FF6C47F91C0B6741E75258D6FBCEF74FC170154B3A1A2BA7E42FBDFD9AE1101F56DD7F0052DB0F436A6E4A9105B68019D6489039EA8D6F3362B4F134344B16FE28187ACBA77AC259FB8FE3FACD2756BD0F74017842CBD9A1CAC61DEDB68D4C15EB46FFEE89AD5232669D8410BEDDC84C1EF7149616355545EE10B606CE0D29339BC100CC987FB1D592C38F578E687B1611A50A5AE773F59ED940587C1E0A41303034A479B2113D80AA8CBF7C271806D637BF08A6E0641F97FC76E992E966985142467FB23C0B3AED237A337BF32F943C04A4D2EA521C5970D2E492E099FE5BF84F292C7A4B1980A8C67B2754540C9D434F1C216DCCF5B29D2B1FB33A80F7EAE33F45B1CEBB4A16C577CD34A2FAAE6583F92921F9F8B32B752ECD069ED6C4050C3E1B3BD477C54E7156CC19F5E72EF16268063F880C121E25133F7E537B2D8B99A29F4C8093256A76EE01D35B58A256CEFC13C2812D5A25DD7860190ED509A90E16BD92909F1F465CDB9699C9CDD6A4B69938B03EE9CD26B33A063A7F8287E1109FE0121A14A21F1628790BD7FC84A3922E2A3B5B160F5E775EDFA3946921E0AC1ECEDC63041EC331F14DED1CC9D71CE6F55B840FCDFEFC2730E042CC859385F81720903194E8F20BB5604E9799FAFB9E7C26576F4CC4C7CC557A13975BC308802011D9541DBE7C4B37F15E6FB08FAB969B42580414CB72D4AD05BEC45EE8C8EC3BEDA0E94CB734245708980D1046B27136C5B598E7905FC22371B2737167813060553D281F0574CF340BE41F7363E68495DCBD010E1292AB17CAD9ECBCEC2C8D1E1FE9E"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-05-28 20:39:42
ComboFix-quarantined-files.txt 2010-05-28 18:39

Před spuštěním: 1 028 624 384
Po spuštění: 1 202 454 528

- - End Of File - - BC4729454E2492E3EDDA945D2B1ABC44

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[daviii]

ComboFix 10-05-28.01 - David Schenk 28.05.2010 23:08:20.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1919.1503 [GMT 2:00]
Spuštěný z: c:\documents and settings\David Schenk\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\David Schenk\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-28 do 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-27 15:24 . 2010-05-27 15:29 -------- d-----w- C:\rsit
2010-05-23 15:07 . 2010-05-23 15:08 -------- d-----w- C:\Moto assistant
2010-05-20 22:02 . 2010-05-20 22:02 -------- d-----w- c:\program files\VirusSecureLab
2010-05-20 21:05 . 2010-05-20 21:48 -------- d-----w- c:\program files\TrojanHunter 4.2
2010-05-20 20:11 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-20 20:11 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-20 20:11 . 2010-05-20 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-20 19:57 . 2010-05-20 19:58 -------- d-----w- c:\program files\USB Virus Cleaner
2010-05-20 19:57 . 2010-05-20 19:57 -------- d-----w- c:\windows\USB Virus Cleaner
2010-05-20 18:00 . 2010-05-28 19:00 -------- d-----w- c:\program files\SpeedFan
2010-05-20 17:43 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-20 17:43 . 2010-02-16 12:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-20 17:43 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-20 17:43 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-20 17:43 . 2010-05-20 17:43 -------- d-----w- c:\program files\Avira
2010-05-16 12:48 . 2010-05-16 12:48 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-05-16 12:33 . 2010-05-16 12:38 -------- d-----w- c:\windows\$regcmp$
2010-05-16 12:30 . 2010-05-16 12:30 -------- d-----w- c:\program files\AIMP2
2010-05-16 11:45 . 2010-05-16 11:52 -------- d-----w- c:\windows\ATK0100
2010-05-16 11:42 . 2006-08-03 14:02 81664 -c----w- c:\windows\system32\dllcache\videoprt.sys
2010-05-16 10:13 . 2006-04-19 11:50 17152 -c----w- c:\windows\system32\dllcache\usbohci.sys
2010-05-16 10:13 . 2006-04-19 11:50 20608 -c----w- c:\windows\system32\dllcache\usbuhci.sys
2010-05-16 10:13 . 2006-04-19 11:50 30080 -c----w- c:\windows\system32\dllcache\usbehci.sys
2010-05-16 10:13 . 2006-04-19 11:50 143360 -c----w- c:\windows\system32\dllcache\usbport.sys
2010-05-16 09:32 . 2010-05-16 12:13 -------- d-----w- c:\program files\ASUS
2010-05-16 09:30 . 2010-05-28 21:01 -------- d-----w- c:\program files\DNA
2010-05-10 21:33 . 2010-05-10 21:38 -------- d-----w- c:\program files\Driver Fetch
2010-05-01 10:18 . 2010-05-01 10:18 -------- d-----w- c:\documents and settings\David Schenk\.cdsdoc

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 15:26 . 2009-10-14 20:30 -------- d-----w- c:\program files\trend micro
2010-05-23 14:38 . 2009-05-19 07:53 14 -c--a-w- c:\windows\mm.sys
2010-05-21 20:49 . 2010-03-13 00:34 -------- d-----w- c:\program files\Crawler
2010-05-20 12:58 . 2009-10-14 06:09 8722 -c--a-w- c:\windows\hh.dat
2010-05-16 11:44 . 2009-04-30 17:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-10 21:09 . 2010-03-11 17:59 -------- d-----w- c:\program files\The KMPlayer
2010-05-03 14:27 . 2010-03-27 08:03 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-29 23:46 . 2009-04-30 18:35 -------- d-----w- c:\program files\IrfanView
2010-04-27 21:38 . 2009-12-03 08:27 -------- d-----w- c:\program files\Spyware Terminator
2010-04-27 06:48 . 2009-04-30 20:02 -------- d-----w- c:\program files\QIP
2010-04-27 06:47 . 2010-04-27 06:13 -------- d-----w- c:\program files\QIP 2010
2010-04-26 17:30 . 2010-03-16 10:48 -------- d-----w- c:\program files\Comodo
2010-04-20 15:57 . 2009-11-26 17:01 -------- d-----w- c:\program files\WinClamAVShield
2010-04-19 17:32 . 2010-04-19 17:32 411368 -c--a-w- c:\windows\system32\deployJava1.dll
2010-04-19 17:31 . 2010-04-19 17:31 -------- d-----w- c:\program files\Java
2010-04-19 17:30 . 2006-03-02 12:00 82840 ----a-w- c:\windows\system32\perfc005.dat
2010-04-19 17:30 . 2006-03-02 12:00 437574 ----a-w- c:\windows\system32\perfh005.dat
2010-04-14 06:13 . 2009-04-30 18:40 -------- d-----r- c:\program files\Skype
2010-03-30 17:59 . 2010-03-28 07:47 -------- d-----w- c:\program files\Any Audio Converter
2010-03-20 16:31 . 2010-03-20 16:31 7240 ----a-w- C:\LICENSE.DAT
2010-03-20 08:42 . 2009-11-12 18:55 691696 -c--a-w- c:\windows\system32\drivers\sptd.sys
2010-03-10 06:17 . 2006-03-02 12:00 420352 -c--a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-28_18.37.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-28 21:06 . 2010-05-28 21:06 16384 c:\windows\temp\Perflib_Perfdata_5b4.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"="c:\program files\Seznam.cz\postak.exe" [2009-09-23 434840]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2009-12-09 3037696]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2010-05-16 323392]
"Google Update"="c:\documents and settings\David Schenk\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-05-23 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-04-08 2176512]
"USB Storage Toolbox"="c:\windows\UMStor\Res.EXE" [2005-09-14 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2009-04-08 2553088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"USB AV"="c:\program files\USB Virus Cleaner\USBAV.exe" [2010-04-22 270336]
"USBAV"="c:\program files\USB Virus Cleaner\USBAV.exe" [2010-04-22 270336]
"THGuard"="c:\program files\TrojanHunter 4.2\THGuard.exe" [2005-02-19 1089024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]

c:\documents and settings\David Schenk\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bitmeter2.lnk - c:\program files\Codebox\BitMeter\BitMeter2.exe [2005-9-15 970752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0OODBS\0crcnat.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\KN_StrongDC\\StrongDC.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Comodo\\Dragon\\dragon.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\bin\\cdsNameServer.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\bin\\cdsMsgServer.exe"=
"c:\\OrCAD\\OrCAD_10.0\\tools\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [22.11.2009 23:36 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [20.5.2010 19:43 135336]
R2 Cadence License Manager;Cadence License Manager;c:\orcad\license_manager\lmgrd.exe [20.3.2010 18:32 608768]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.11.2009 20:55 691696]
S2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [22.7.2003 3:44 18848]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2.8.2005 23:10 32512]
S4 Aswape;Aswape; [x]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Zobrazit originál
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 23:13
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-776561741-362288127-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="C6B6A767223CB62FF9F3D854BF0BC4AC3333599712615D0217AD022BB4E0C0EFCD285399D484757B8661B0D73EF549E38B4F2C5C7FB1E06FEFA8619314775FFA3E42DCA5A017956DC5BE9C7A49FBC3686B0812280817EED4931CC5979F9343B816A8798D995881E049FBE9F6D35E0ADA133B928A1F54E5B913F30FB7EE93F133D6F400EA16650C05A3FD8899171755AD47BB57A5805C08F5050F418C5D87FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6171C11EC38DE3D8EDD5E5BE2F6E6676FDC1B06F94E105265169FF4FE5BD95BE63A3FD38D15CB314D97087B766885405DC800FB403420269BB484E2BCFA15612D7145DC3A64C25D4C66489E398D7841CB4485A4B8A91297A453043B0EEEAC409F84195FD55E5DB67FE02AE867CC88A74B3C868963C8B8539C40CA944CC7123F01C8D81E32A74EC47282DC6CED7F4A5852EEE529E7C129B9FEA28CF9F6A7FCDFF9E628D3C8F70C42161B92AC5D13156BB87007758ED4BA60B0F1FD6AB0C567CF165E2C29359BD09BBE4C05236B8706AABDA9D1D5475A0C0F767BD7D9406F0FF6C47F91C0B6741E75258D6FBCEF74FC170154B3A1A2BA7E42FBDFD9AE1101F56DD7F0052DB0F436A6E4A9105B68019D6489039EA8D6F3362B4F134344B16FE28187ACBA77AC259FB8FE3FACD2756BD0F74017842CBD9A1CAC61DEDB68D4C15EB46FFEE89AD5232669D8410BEDDC84C1EF7149616355545EE10B606CE0D29339BC100CC987FB1D592C38F578E687B1611A50A5AE773F59ED940587C1E0A41303034A479B2113D80AA8CBF7C271806D637BF08A6E0641F97FC76E992E966985142467FB23C0B3AED237A337BF32F943C04A4D2EA521C5970D2E492E099FE5BF84F292C7A4B1980A8C67B2754540C9D434F1C216DCCF5B29D2B1FB33A80F7EAE33F45B1CEBB4A16C577CD34A2FAAE6583F92921F9F8B32B752ECD069ED6C4050C3E1B3BD477C54E7156CC19F5E72EF16268063F880C121E25133F7E537B2D8B99A29F4C8093256A76EE01D35B58A256CEFC13C2812D5A25DD7860190ED509A90E16BD92909F1F465CDB9699C9CDD6A4B69938B03EE9CD26B33A063A7F8287E1109FE0121A14A21F1628790BD7FC84A3922E2A3B5B160F5E775EDFA3946921E0AC1ECEDC63041EC331F14DED1CC9D71CE6F55B840FCDFEFC2730E042CC859385F81720903194E8F20BB5604E9799FAFB9E7C26576F4CC4C7CC557A13975BC308802011D9541DBE7C4B37F15E6FB08FAB969B42580414CB72D4AD05BEC45EE8C8EC3BEDA0E94CB734245708980D1046B27136C5B598E7905FC22371B2737167813060553D281F0574CF340BE41F7363E68495DCBD010E1292AB17CAD9ECBCEC2C8D1E1FE9E"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-05-28 23:15:33
ComboFix-quarantined-files.txt 2010-05-28 21:15
ComboFix2.txt 2010-05-28 18:39

Před spuštěním: 1 215 643 648
Po spuštění: 1 159 229 440

- - End Of File - - 885BE55D4FA766CC434DAD4B1AE61291

[Rudy]

Log již vypadá čistý.

[daviii]

Ahoj, tak jsem to zkoušel přes kabel..je to super,jede to jak divéé díík moc musím ted ten Rsit a kobofix něják odinstalovat?

[Rudy]

RSIT by měl jít normálně odinstalovat přes přidat/ubrat programy a combofix Start>spustit>(napsat) combofix /uninstall>OK. Nemáte zač!