VIRY.CZ

prosím o kontrolu, nejde nic instalovat. Děkuji


Logfile of random's system information tool 1.08 (written by random/random)
Run by Uživ at 2010-07-20 16:26:21
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (34%) free of 57 GB
Total RAM: 255 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:26:47, on 20.7.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Uživ\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Uživ.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
F3 - REG:win.ini: run=C:\WINDOWS\system32\portmap.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\wvuvttr.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [portmap.exe] C:\WINDOWS\system32\portmap.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AVP] "G:\Libor\Nová složka\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows Microsoft Services] gppenvp.exe
O4 - HKCU\..\Run: [XP HOT Rebild] Win15763.exe
O4 - HKCU\..\Run: [ICQUpdater] "C:\DOCUME~1\UIV~1\LOCALS~1\Temp\IcqUpdater.exe" -upgrade 3620 "C:\DOCUME~1\UIV~1\LOCALS~1\Temp\E8FC7D~1 /silent" "C:\PROGRA~1\ICQ6.5\ICQ.exe loginmode=2 sname=206625762 pwdHashed=ykWuqDH6YdyA5C3W02XcHcpFrqgx+mHcgOQt1tNl3B0= status=1 visibility=4 " /autorun /autorun
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKLM\..\Policies\Explorer\Run: [1] C:\WINDOWS\system32\portmap.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [XP HOT Rebild] Win15763.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [XP HOT Rebild] Win15763.exe (User 'Default user')
O4 - Startup: Quick Office.lnk = C:\WINDOWS\system32\portmap.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: wvuvttr - wvuvttr.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avp - Unknown owner - G:\Libor\Nová složka\avp.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Mouse Driver\KMWDSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8741 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733E9132-53CA-4C97-9AC9-145C4502FA20}]
C:\WINDOWS\system32\wvuvttr.dll [2010-07-20 44054]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
UrlHelper Class - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll [2008-09-02 398776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-06-12 958712]
{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - BearShare MediaBar - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll [2008-09-02 529848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-01-08 52256]
"KMCONFIG"=C:\Program Files\Mouse Driver\StartAutorun.exe [2008-05-30 212992]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"portmap.exe"=C:\WINDOWS\system32\portmap.exe [2010-07-20 5632]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-02-15 417792]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-04-13 1135912]
"AVP"=G:\Libor\Nová složka\avp.exe []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"1"=C:\WINDOWS\system32\portmap.exe [2010-07-20 5632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Windows Microsoft Services"=gppenvp.exe []
"XP HOT Rebild"=Win15763.exe []
"ICQUpdater"=C:\DOCUME~1\UIV~1\LOCALS~1\Temp\IcqUpdater.exe -upgrade 3620 C:\DOCUME~1\UIV~1\LOCALS~1\Temp\E8FC7D~1 /silent C:\PROGRA~1\ICQ6.5\ICQ.exe loginmode=2 sname=206625762 pwdHashed=ykWuqDH6YdyA5C3W02XcHcpFrqgx+mHcgOQt1tNl3B0= status=1 visibility=4 /autorun /autorun []
"Advanced SystemCare 3"=C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe [2010-05-26 2346192]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Uživ\Nabídka Start\Programy\Po spuštění
Quick Office.lnk - C:\WINDOWS\system32\portmap.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-02-25 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuvttr]
C:\WINDOWS\system32\wvuvttr.dll [2010-07-20 44054]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{733E9132-53CA-4C97-9AC9-145C4502FA20}"=C:\WINDOWS\system32\wvuvttr.dll [2010-07-20 44054]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"DisableLocalUserRun"=1
"DisableLocalUserRunOnce"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"DisableLocalMachineRun"=1
"DisableLocalMachineRunOnce"=1
"DisableLocalUserRun"=1
"DisableLocalUserRunOnce"=1
"HonorAutoRunSetting"=1
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\BearShare applications\BearShare\BearShare.exe"="C:\Program Files\BearShare applications\BearShare\BearShare.exe:*:Enabled:BearShare"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\WINDOWS\system32\Manager.exe"="C:\WINDOWS\system32\Manager.exe:*:Disabled:mIRC"
"C:\WINDOWS\system32\burwjbr.exe"="C:\WINDOWS\system32\burwjbr.exe:*:Enabled:burwjbr"
"C:\WINDOWS\system32\gppenvp.exe"="C:\WINDOWS\system32\gppenvp.exe:*:Disabled:gppenvp"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Disabled:Run a DLL as an App"
"C:\WINDOWS\system32\Win15763.exe"="C:\WINDOWS\system32\Win15763.exe:*:Disabled:Win15763"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-07-20 16:26:33 ----D---- C:\Program Files\trend micro
2010-07-20 16:26:21 ----D---- C:\rsit
2010-07-20 16:17:05 ----D---- C:\WINDOWS\LastGood
2010-07-20 14:01:51 ----A---- C:\WINDOWS\eins4346.dll
2010-07-20 13:53:38 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\IObit
2010-07-20 09:53:13 ----D---- C:\Program Files\ESET
2010-07-20 08:49:02 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2010-07-20 08:49:01 ----D---- C:\Documents and Settings\Uživ\Data aplikací\Spyware Terminator
2010-07-20 08:49:01 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
2010-07-20 08:48:56 ----D---- C:\Program Files\Spyware Terminator
2010-07-20 08:42:54 ----A---- C:\WINDOWS\system32\drivers\klif.sys
2010-07-20 08:42:53 ----A---- C:\WINDOWS\system32\drivers\kl1.sys
2010-07-20 08:10:15 ----A---- C:\WINDOWS\system32\WS2_321.DLL
2010-07-20 07:40:47 ----A---- C:\WINDOWS\system32\portmap.exe
2010-07-20 07:10:05 ----D---- C:\Program Files\IObit
2010-07-20 07:10:05 ----D---- C:\Documents and Settings\Uživ\Data aplikací\IObit
2010-07-20 06:52:59 ----D---- C:\Program Files\CCleaner
2010-07-20 05:47:38 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Windows Genuine Advantage
2010-07-19 11:49:02 ----N---- C:\WINDOWS\system32\wvuvttr.dll
2010-07-19 11:48:38 ----A---- C:\WINDOWS\retadpu1000520.exe
2010-07-19 11:48:00 ----A---- C:\WINDOWS\system32\wgatray.exe.old
2010-07-19 11:48:00 ----A---- C:\WINDOWS\system32\WgaTray.exe
2010-07-19 11:48:00 ----A---- C:\WINDOWS\system32\wgalogon.dll.old
2010-07-19 11:48:00 ----A---- C:\WINDOWS\system32\WgaLogon.dll
2010-07-19 11:48:00 ----A---- C:\WINDOWS\system32\LegitCheckControl.dll
2010-06-23 14:03:43 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\2B6D
2010-06-22 18:16:03 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\3AB

======List of files/folders modified in the last 1 months======

2010-07-20 16:26:33 ----D---- C:\Program Files
2010-07-20 16:21:27 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-20 16:17:58 ----D---- C:\WINDOWS
2010-07-20 16:17:57 ----SHD---- C:\WINDOWS\Installer
2010-07-20 16:17:57 ----HD---- C:\Config.Msi
2010-07-20 16:17:57 ----D---- C:\WINDOWS\Temp
2010-07-20 16:17:46 ----HD---- C:\WINDOWS\inf
2010-07-20 16:17:37 ----D---- C:\WINDOWS\system32\drivers
2010-07-20 16:16:15 ----D---- C:\WINDOWS\Prefetch
2010-07-20 16:13:57 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-20 16:12:48 ----A---- C:\WINDOWS\wincmd.ini
2010-07-20 15:56:35 ----D---- C:\WINDOWS\system32
2010-07-20 15:14:25 ----A---- C:\WINDOWS\ntbtlog.txt
2010-07-20 14:48:31 ----D---- C:\Program Files\Ghanimx
2010-07-20 14:36:56 ----RD---- C:\My Downloads
2010-07-20 09:20:25 ----A---- C:\WINDOWS\system.ini
2010-07-20 08:47:28 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-07-20 06:26:42 ----D---- C:\WINDOWS\network diagnostic
2010-07-20 05:47:53 ----SD---- C:\WINDOWS\Tasks
2010-07-20 05:47:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-01 20:00:59 ----D---- C:\Documents and Settings\Uživ\Data aplikací\ICQ
2010-07-01 19:58:15 ----D---- C:\Program Files\PokerStars

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2009-03-26 12952]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-14 41600]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys []
R1 kl1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2007-04-28 110360]
R1 KLIF;KLIF; C:\WINDOWS\system32\DRIVERS\klif.sys [2007-05-18 185616]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-02-26 3565568]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2004-04-23 818496]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-09-13 12160]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-02-25 602112]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe []
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Program Files\Mouse Driver\KMWDSrv.exe [2008-05-30 208896]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-07-20 570880]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-02-25 593920]
S2 avp;avp; G:\Libor\Nová složka\avp.exe -r []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-16 135664]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-09-17 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]

-----------------EOF-----------------

Zdravim a pekne odpoledne preji

To se Vam tam podarilo dostat tolik haveti sam nebo Vam nekdo pomahal

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte

ComboFix 10-07-19.05 - Uživ 20.07.2010 17:36:04.2.1 - x86
Spuštěný z: c:\documents and settings\Uživ\Plocha\ComboFix.exe
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
C:\adware.exe
c:\akon\BYONC\desKtOp.InI
c:\documents and settings\Uživ\inanaged.exe
c:\ghannnem\Alducery\DesKTop.ini
c:\ghannnem\Alducery\X0R.exe
c:\program files\myglobalsearch\bar\History\search
c:\sin\S-2-3-12-ABCDEF7890-01234567890-1688963592-500\Desktop.ini
c:\windows\retadpu1000520.exe
c:\windows\system32\alisy.sys
c:\windows\system32\cult.exe
c:\windows\system32\hd.exe
c:\windows\system32\ksat.bat
c:\windows\system32\mirc.ini
c:\windows\system32\mur.sys
c:\windows\system32\murd3r
c:\windows\system32\nassor
c:\windows\system32\orrl.exe
c:\windows\system32\portmap.exe
c:\windows\system32\ps2m.exe
c:\windows\system32\remote.ini
c:\windows\system32\repcale.exe
c:\windows\system32\w.e
c:\windows\system32\wvuvttr.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-20 do 2010-07-20 )))))))))))))))))))))))))))))))
.

2010-07-20 14:26 . 2010-07-20 14:26 -------- d-----w- c:\program files\trend micro
2010-07-20 14:26 . 2010-07-20 14:28 -------- d-----w- C:\rsit
2010-07-20 07:53 . 2010-07-20 07:53 -------- d-----w- c:\program files\ESET
2010-07-20 07:20 . 2010-07-20 15:48 297504 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-07-20 07:20 . 2010-07-20 15:47 21280 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-07-20 06:49 . 2010-07-20 06:49 141312 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-20 06:48 . 2010-07-20 06:49 -------- d-----w- c:\program files\Spyware Terminator
2010-07-20 06:42 . 2007-04-28 14:51 110360 ----a-w- c:\windows\system32\drivers\kl1.sys
2010-07-20 06:10 . 1999-05-05 20:22 73728 ----a-w- c:\windows\system32\WS2_321.DLL
2010-07-20 05:10 . 2010-07-20 05:10 -------- d-----w- c:\program files\IObit
2010-07-20 05:02 . 2010-07-20 05:02 -------- d-sh--w- c:\documents and settings\Administrator.ROHEL1.000\IETldCache
2010-07-20 04:52 . 2010-07-20 04:52 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-20 15:08 . 2010-07-20 07:20 5192 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-07-20 15:08 . 2010-07-20 07:20 2636 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-07-01 17:58 . 2009-04-12 08:25 -------- d-----w- c:\program files\PokerStars
2010-07-01 15:27 . 2009-06-21 08:09 127146 ----a-w- c:\windows\hpoins11.dat
2010-06-16 15:38 . 2009-03-31 08:18 -------- d-----w- c:\program files\ICQ6.5
2010-05-01 15:01 . 2010-05-01 14:55 10615 ----a-w- C:\nah.com
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2008-09-02 14:05 398776 ----a-w- c:\program files\BearShare applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-05-26 2346192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"KMCONFIG"="c:\program files\Mouse Driver\StartAutorun.exe" [2008-05-29 212992]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-02-15 417792]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\BearShare applications\\BearShare\\BearShare.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\QIP\\qip.exe"=

R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [13.7.2008 20:53 222456]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Mouse Driver\KMWDSrv.exe [30.5.2008 1:22 208896]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys --> c:\windows\system32\DRIVERS\ehdrv.sys [?]
S2 ekrn;ESET Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16.5.2010 18:26 135664]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 16:26]

2010-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 16:26]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Windows Microsoft Services - gppenvp.exe
HKCU-Run-XP HOT Rebild - Win15763.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKU-Default-Run-XP HOT Rebild - Win15763.exe
HKU-Default-RunOnce-XP HOT Rebild - Win15763.exe
ActiveSetup-{67KLN5J0-4OPM-65WE-KKX5-227QWE24444} - c:\ghannnem\Alducery\\X0R.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-20 17:47
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1020)
g:\libor\Nová složka\scrchpg.dll
c:\windows\system32\webcheck.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
Celkový čas: 2010-07-20 17:56:46
ComboFix-quarantined-files.txt 2010-07-20 15:56

Před spuštěním: Volných bajtů: 20 459 991 040
Po spuštění: Volných bajtů: 20 418 764 800

- - End Of File - - A7F5F6F6611505E3BECFD01AF2D5FA01

Tam toho bylo a jeste asi nejsme u konce

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

• C:\WINDOWS\system32\wvuvttr.dll
  c:\windows\system32\WS2_321.DLL
  C:\WINDOWS\eins4346.dll
  C:\WINDOWS\system32\portmap.exe
  C:\nah.com
• Kliknete na Prochazet
• Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
• Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
• Kliknete na Otestovat soubor
• Vysledek analyzy sem vlozte (jako odkaz)

Soubor WS2_321.DLL přijatý 2010.07.20 16:32:35 (UTC)
Současný stav: Dokončeno
Výsledek: 0/36 (0%)
ostatní: wvuvttr.dll, portmap.dll, eins4346.dll nelze najít.

Soubor nehledejte, jen vlozte cestu do okenka ktere nas Vas vyskoci, kdyz date Prochazet

Pripadne je zkuste najit, ale asi budou skryte, proto: Start-Ovladaci panely-Moznosti slozky-Zobrazeni-Zobrazovat skryte soubory a slozky

Snažil jsem, tyto soubory jsem jenom zadal ale stejně mi to napsalo "soubor nenalezen".

OK, jak se chova PC, stale jsou problemy

Podle mě je tam ještě plno nesmyslů které dcera nebude potřebovat. Ale jinak to celkem jde.

Jen takovy dotaz, jde Vam spustit Spravce uloh (ctrl+alt+delete)

Už ano.

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4331

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20.7.2010 20:11:45
mbam-log-2010-07-20 (20-11-45).txt

Typ skenu: Rychlý sken
Skenované objekty: 205449
Uplynulý čas: 30 minuta(y), 52 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 8
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 3
Infikované soubory: 9

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-77ef1d187563} (Backdoor.Bifrose) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{13pop6m8-1mad-24ad-jim1-73op5g2223335} (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{63mad6m8-1mad-81ad-jim6-26op5g6789085} (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-65we-kkx5-227qwe24444} (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-77ef1d187463} (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{23mad6m8-1mad-77ad-jim1-73op5g7769085} (Worm.AutoRun) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{13pop6m8-1mad-24ad-jim1-73op5g2223335} (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{23mad6m8-1mad-77ad-jim1-73op5g7769085} (Worm.AutoRun) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
C:\Program Files\VVSN (Adware.WhenU) -> No action taken.
C:\DREAM\PIANO (Backdoor.Bot) -> No action taken.
C:\JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111 (Trojan.Agent) -> No action taken.

Infikované soubory:
C:\Win5bh.exe (Backdoor.IRCbot) -> No action taken.
C:\Documents and Settings\Já\Local Settings\Temp\lwpwer.exe (Trojan.FakeAlert) -> No action taken.
C:\DREAM\PIANO\DeSKtOp.InI (Backdoor.Bot) -> No action taken.
C:\JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Já\Data aplikací\wiaserva.log (Malware.Trace) -> No action taken.
C:\Documents and Settings\All Users\Nabídka Start\Online Security Guide.url (Rogue.Link) -> No action taken.
C:\Documents and Settings\All Users\Nabídka Start\Security Troubleshooting.url (Rogue.Link) -> No action taken.
C:\Documents and Settings\Uživ\Nabídka Start\Programy\Po spuštění\Quick Office.lnk (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Já\Local Settings\Temp\s1408.php (Trojan.FakeAlert) -> No action taken.

Vse co nasel MBAM smazte - pekna sbirka A udelejte KOMPLETNI (UPLNY) sken - log opet pred mazanim sem

Prosim Vas to byl nekde vyprodej haveti a Vy jste stal v prvni rade, ze ji tam tolik mate