VIRY.CZ

Zdravím, měl bych takový dotaz v poslední době se mi nehorázným způsobem zpomalil internet tak, že je skoro nepoužitelný . Chtěl bych se zeptat jestli by jste mi pomohly s rozluštěním logu z "Hijack this", který jsem si podle zdejšího návodu pořídil. Předem děkuji za odpověď.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:25:45, on 3.9.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\bgsvcgen.exe
F:\Program Files\GameTracker\GSInGameService.exe
F:\Program Files\ICQ6Toolbar\ICQ Service.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\CDBurnerXP\NMSAccessU.exe
F:\WINDOWS\system32\oodag.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\PnkBstrB.exe
F:\Program Files\CyberLink\Shared files\RichVideo.exe
F:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\RTHDCPL.EXE
F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\Program Files\QuickTime\qttask.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\Common Files\Java\Java Update\jusched.exe
F:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Stardock\CursorFX\CursorFX.exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\Skype\Plugin Manager\skypePM.exe
F:\Program Files\Comodo\Dragon\dragon.exe
F:\Program Files\Comodo\Dragon\dragon.exe
F:\Program Files\Comodo\Dragon\dragon.exe
F:\Program Files\Comodo\Dragon\dragon.exe
F:\Documents and Settings\Milan\Plocha\HJT\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14780&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - F:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - F:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - F:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - F:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - F:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GEST] =
O4 - HKLM\..\Run: [RemoteControl] "F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "F:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] F:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [OODefragTray] F:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avast5] F:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [MSConfig] F:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CursorFX] "F:\Program Files\Stardock\CursorFX\CursorFX.exe"
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://F:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://F:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://F:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://F:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://F:\Program Files\Desktop Sidebar\sbhelp.dll/menuhandler.html
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - F:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - F:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/stati ... 0.27.0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AFEC315E-8C21-4596-ADCF-5DB2AA97B3B0}: NameServer = 160.218.43.200 160.218.10.200
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - F:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - F:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: GS In-Game Service - ClanServers Hosting LLC - F:\Program Files\GameTracker\GSInGameService.exe
O23 - Service: Služba Google Update (gupdate1ca4fe61cdc4330) (gupdate1ca4fe61cdc4330) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - F:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NMSAccessU - Unknown owner - F:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - F:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - F:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - F:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - F:\Program Files\WinPcap\rpcapd.exe

--
End of file - 11070 bytes

Mimochodem asi před dvěma dny mi Ad-Aware nasel nějaký Win32.TrojanDownloader.Agent a tak bych měl ještě dotaz, jestli to nemá nějakou souvislost. PS: problémy přetrvávají i po přesunutí do karantény.

Zdravím, tohle fixni v HJT :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14780&l=dis
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [RemoteControl] "F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "F:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Ovládací panely >> Přidat nebo odebrat odinstaluj ICQ6Toolbar a Ask.com


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Nakonec použij Mbam z mého podpisu a dej mi sem z něj log.

Děkuji moc, CCleaner mám takže jsem použil již nainstalovaný a ten log dodám za chvíli přeci jen teď ten internet pěkně zlobí...

Tak jsem vše provedl dle návodu, ale MbAM nic nenalezl. Internet je pořád pomalý tak už vážně nevím. Jinak MbAm napsal tohle.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4538

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3.9.2010 22:49:02
mbam-log-2010-09-03 (22-49-02).txt

Typ skenu: Rychlý sken
Skenované objekty: 154800
Uplynulý čas: 3 minuta(y), 56 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Ale plný sken ohalil nějakou havěť.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4538

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3.9.2010 23:35:01
mbam-log-2010-09-03 (23-35-01).txt

Typ skenu: Úplný sken (C:\|F:\|)
Skenované objekty: 346749
Uplynulý čas: 42 minuta(y), 5 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
F:\Documents and Settings\Milan\Plocha\Programy\Kodas\ScreenShots.exe (Trojan.Agent) -> No action taken.
F:\Program Files\Common Files\eBay\eBayLauncher.exe (Trojan.Clicker) -> No action taken.

To co Mbam našel nech smazat.

Nyní použijeme větší kalibr tak že důkladně číst, protože tenhle softík netoleruje chyby.

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na F:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

Tak tady je ten log.

ComboFix 10-09-03.02 - Milan 05.09.2010 0:11.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1435 [GMT 2:00]
Spuštěný z: f:\documents and settings\Milan\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
f:\documents and settings\Milan\Dokumenty\cc_20100903_211914.reg
f:\program files\Internet Explorer\Plugins\npqtplugin2.dll
f:\program files\Internet Explorer\Plugins\npqtplugin3.dll
f:\program files\Internet Explorer\Plugins\npqtplugin4.dll
f:\program files\Internet Explorer\Plugins\npqtplugin5.dll
f:\program files\Internet Explorer\Plugins\npqtplugin6.dll
f:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
f:\program files\Mozilla Firefox\Plugins\npqtplugin3.dll
f:\program files\Mozilla Firefox\Plugins\npqtplugin4.dll
f:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
f:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
f:\program files\QuickTime\Plugins\npqtplugin2.dll
f:\program files\QuickTime\Plugins\npqtplugin3.dll
f:\program files\QuickTime\Plugins\npqtplugin4.dll
f:\program files\QuickTime\Plugins\npqtplugin5.dll
f:\program files\QuickTime\Plugins\npqtplugin6.dll
f:\windows\system32\Ijl11.dll
f:\windows\system32\images
f:\windows\system32\images\toolbar\calendar.gif
f:\windows\system32\images\toolbar\crlogo.gif
f:\windows\system32\images\toolbar\export.gif
f:\windows\system32\images\toolbar\export_over.gif
f:\windows\system32\images\toolbar\exportd.gif
f:\windows\system32\images\toolbar\First.gif
f:\windows\system32\images\toolbar\first_over.gif
f:\windows\system32\images\toolbar\Firstd.gif
f:\windows\system32\images\toolbar\gotopage.gif
f:\windows\system32\images\toolbar\gotopage_over.gif
f:\windows\system32\images\toolbar\gotopaged.gif
f:\windows\system32\images\toolbar\grouptree.gif
f:\windows\system32\images\toolbar\grouptree_over.gif
f:\windows\system32\images\toolbar\grouptreed.gif
f:\windows\system32\images\toolbar\grouptreepressed.gif
f:\windows\system32\images\toolbar\Last.gif
f:\windows\system32\images\toolbar\last_over.gif
f:\windows\system32\images\toolbar\Lastd.gif
f:\windows\system32\images\toolbar\Next.gif
f:\windows\system32\images\toolbar\next_over.gif
f:\windows\system32\images\toolbar\Nextd.gif
f:\windows\system32\images\toolbar\Prev.gif
f:\windows\system32\images\toolbar\prev_over.gif
f:\windows\system32\images\toolbar\Prevd.gif
f:\windows\system32\images\toolbar\print.gif
f:\windows\system32\images\toolbar\print_over.gif
f:\windows\system32\images\toolbar\printd.gif
f:\windows\system32\images\toolbar\Refresh.gif
f:\windows\system32\images\toolbar\refresh_over.gif
f:\windows\system32\images\toolbar\refreshd.gif
f:\windows\system32\images\toolbar\Search.gif
f:\windows\system32\images\toolbar\search_over.gif
f:\windows\system32\images\toolbar\searchd.gif
f:\windows\system32\images\toolbar\up.gif
f:\windows\system32\images\toolbar\up_over.gif
f:\windows\system32\images\toolbar\upd.gif
f:\windows\system32\images\tree\begindots.gif
f:\windows\system32\images\tree\beginminus.gif
f:\windows\system32\images\tree\beginplus.gif
f:\windows\system32\images\tree\blank.gif
f:\windows\system32\images\tree\blankdots.gif
f:\windows\system32\images\tree\dots.gif
f:\windows\system32\images\tree\lastdots.gif
f:\windows\system32\images\tree\lastminus.gif
f:\windows\system32\images\tree\lastplus.gif
f:\windows\system32\images\tree\Magnify.gif
f:\windows\system32\images\tree\minus.gif
f:\windows\system32\images\tree\minusbox.gif
f:\windows\system32\images\tree\plus.gif
f:\windows\system32\images\tree\plusbox.gif
f:\windows\system32\images\tree\singleminus.gif
f:\windows\system32\images\tree\singleplus.gif
f:\windows\system32\vbpng1.dll
f:\windows\system32\vbzlib1.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-04 do 2010-09-04 )))))))))))))))))))))))))))))))
.

2010-09-03 20:14 . 2010-04-29 13:39 38224 ----a-w- f:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 20:13 . 2010-09-03 20:14 -------- d-----w- f:\program files\Malwarebytes' Anti-Malware
2010-09-03 20:13 . 2010-04-29 13:39 20952 ----a-w- f:\windows\system32\drivers\mbam.sys
2010-09-03 19:16 . 2010-09-03 19:16 -------- d-----w- f:\program files\CCleaner
2010-08-31 08:46 . 2010-08-31 08:46 -------- d-----w- f:\program files\Runic Games
2010-08-21 22:09 . 2010-08-21 22:09 -------- d-----w- f:\program files\WinPcap
2010-08-21 22:05 . 2010-08-21 22:09 -------- d-----w- f:\program files\DsNET Corp

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-04 07:18 . 2010-07-21 15:51 -------- d-----w- f:\program files\Common Files\eBay
2010-09-02 17:35 . 2010-04-12 16:56 -------- d-----w- f:\program files\Steam
2010-09-02 12:51 . 2009-05-22 20:15 -------- d--h--w- f:\program files\InstallShield Installation Information
2010-08-22 08:48 . 2009-11-13 08:10 664 ----a-w- f:\windows\system32\d3d9caps.dat
2010-08-14 23:01 . 2009-08-28 09:43 -------- d-----w- f:\program files\NVIDIA Corporation
2010-08-14 23:01 . 2009-05-22 21:13 -------- d-----w- f:\program files\Common Files\Wise Installation Wizard
2010-08-11 20:27 . 2001-10-25 12:00 483770 ----a-w- f:\windows\system32\perfh005.dat
2010-08-11 20:27 . 2001-10-25 12:00 100104 ----a-w- f:\windows\system32\perfc005.dat
2010-08-04 12:43 . 2010-08-04 12:43 -------- d-----w- f:\program files\ConMet
2010-08-03 21:24 . 2010-01-17 10:59 -------- d-----w- f:\program files\Common Files\Adobe AIR
2010-08-03 16:20 . 2010-08-03 16:20 -------- d-----w- f:\program files\Pando Networks
2010-08-01 18:11 . 2010-06-15 19:26 -------- d-----w- f:\program files\Warcraft III
2010-07-31 13:49 . 2010-07-31 13:48 21840 ----atw- f:\windows\system32\SIntfNT.dll
2010-07-31 13:49 . 2010-07-31 13:48 17212 ----atw- f:\windows\system32\SIntf32.dll
2010-07-31 13:49 . 2010-07-31 13:48 12067 ----atw- f:\windows\system32\SIntf16.dll
2010-07-21 15:51 . 2010-07-21 15:51 -------- d-----w- f:\program files\VDOWNLOADER
2010-07-18 18:15 . 2009-05-30 18:39 138832 ----a-w- f:\windows\system32\drivers\PnkBstrK.sys
2010-07-18 18:15 . 2009-05-30 18:39 202024 ----a-w- f:\windows\system32\PnkBstrB.exe
2010-06-30 12:33 . 2008-04-14 06:51 149504 ----a-w- f:\windows\system32\schannel.dll
2010-06-28 20:57 . 2010-06-29 13:56 38848 ----a-w- f:\windows\avastSS.scr
2010-06-28 20:57 . 2010-05-12 20:37 165032 ----a-w- f:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2010-05-12 20:38 46672 ----a-w- f:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2010-05-12 20:38 165456 ----a-w- f:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2010-05-12 20:38 23376 ----a-w- f:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2010-05-12 20:38 100176 ----a-w- f:\windows\system32\drivers\aswmon2.sys
2010-06-28 20:32 . 2010-05-12 20:38 94544 ----a-w- f:\windows\system32\drivers\aswmon.sys
2010-06-28 20:32 . 2010-05-12 20:38 17744 ----a-w- f:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 20:32 . 2010-05-12 20:38 28880 ----a-w- f:\windows\system32\drivers\aavmker4.sys
2010-06-24 12:27 . 2008-05-09 16:13 916480 ----a-w- f:\windows\system32\wininet.dll
2010-06-24 09:02 . 2008-04-14 05:45 1851904 ----a-w- f:\windows\system32\win32k.sys
2010-06-21 18:41 . 2010-06-21 18:41 25280 ----a-w- f:\windows\system32\drivers\hamachi.sys
2010-06-21 15:27 . 2008-04-13 22:45 354304 ----a-w- f:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2008-04-14 06:51 80384 ----a-w- f:\windows\system32\iccvid.dll
2010-06-15 19:32 . 2010-06-15 19:28 78794 ----a-w- f:\windows\War3Unin.dat
2010-06-15 19:31 . 2010-06-15 19:28 2829 ----a-w- f:\windows\War3Unin.pif
2010-06-15 19:31 . 2010-06-15 19:28 139264 ----a-w- f:\windows\War3Unin.exe
2010-06-14 14:31 . 2009-05-22 16:59 744448 ----a-w- f:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2008-04-14 06:51 1172480 ----a-w- f:\windows\system32\msxml3.dll
2008-06-17 09:35 . 2009-10-10 14:17 212992 ----a-r- f:\program files\MSP_Uninstall.exe
2007-04-04 07:24 . 2009-10-10 14:17 90112 ----a-r- f:\program files\axesstel.dll
2005-03-22 07:54 . 2009-05-22 20:50 1126912 ----a-w- f:\program files\DVDDecrypter.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- f:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- f:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorFX"="f:\program files\Stardock\CursorFX\CursorFX.exe" [2008-02-05 417528]
"Skype"="f:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"Ad-Watch"="f:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-12 524632]
"nwiz"="f:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"OODefragTray"="f:\windows\system32\oodtray.exe" [2009-04-07 2553088]
"avast5"="f:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boincmgr]
2008-12-09 10:08 4289280 ----a-w- f:\program files\BOINC\boincmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boinctray]
2008-12-09 10:08 58112 ----a-w- f:\program files\BOINC\boinctray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- f:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50 155648 ----a-r- f:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-08-24 10:58 1242448 ----a-w- f:\program files\Steam\steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\WINDOWS\\system32\\PnkBstrA.exe"=
"f:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Documents and Settings\\Milan\\Plocha\\Programy\\Torent\\uTorrent.exe"=
"f:\\Program Files\\ICQ6.5\\ICQ.exe"=
"f:\\Program Files\\GameSpy\\Comrade\\Comrade.exe"=
"f:\\Program Files\\Electronic Arts\\BattleForge\\Bootstrapper.exe"=
"f:\\Program Files\\Electronic Arts\\BattleForge\\BattleForge.exe"=
"f:\\WINDOWS\\system32\\dplaysvr.exe"=
"f:\\Program Files\\Interplay\\Fallout Tactics\\BOS.exe"=
"f:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Savage 2 - A Tortured Soul\\savage2.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\launcher.ui.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\MytheonClientR.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\ClientLauncherG.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\ClientLauncherR.exe"=
"c:\\Program Files\\COH Anthology\\RelicCOH.exe"=
"c:\\Program Files\\COH Anthology\\RelicDownloader\\RelicDownloader.exe"=
"f:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"f:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"f:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Medal\\MoHMPUpdater.exe"=
"c:\\Program Files\\Medal\\MoHMPGame.exe"=
"f:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"f:\\Program Files\\Steam\\steam.exe"=
"f:\\Program Files\\Steam\\steamapps\\common\\r.u.s.e. free week end\\Ruse.exe"=
"f:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\League of Legends\\Air\\LolClient.exe"=
"c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"=
"f:\\Program Files\\Steam\\steamapps\\common\\mafia ii - public demo\\launcher.exe"=
"f:\\WINDOWS\\system32\\dpvsetup.exe"=
"f:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56554:TCP"= 56554:TCP:Pando Media Booster
"56554:UDP"= 56554:UDP:Pando Media Booster
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6915:TCP"= 6915:TCP:League of Legends Launcher
"6915:UDP"= 6915:UDP:League of Legends Launcher
"6944:TCP"= 6944:TCP:League of Legends Launcher
"6944:UDP"= 6944:UDP:League of Legends Launcher
"6973:TCP"= 6973:TCP:League of Legends Launcher
"6973:UDP"= 6973:UDP:League of Legends Launcher

R0 Lbd;Lbd;f:\windows\system32\drivers\Lbd.sys [22.5.2009 23:24 64160]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);f:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R1 aswSP;aswSP;f:\windows\system32\drivers\aswSP.sys [12.5.2010 22:38 165456]
R2 aswFsBlk;aswFsBlk;f:\windows\system32\drivers\aswFsBlk.sys [12.5.2010 22:38 17744]
R2 GS In-Game Service;GS In-Game Service;f:\program files\GameTracker\GSInGameService.exe [21.6.2010 21:17 1648480]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;f:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 1029456]
R2 npf;NetGroup Packet Filter Driver;f:\windows\system32\drivers\npf.sys [16.11.2009 18:33 50704]
R3 Axtmvflt;Axesstel USB Filter Service;f:\windows\system32\drivers\axtmvflt.sys [10.10.2009 16:17 3456]
R3 Axtmvmdm;Axesstel USB Modem;f:\windows\system32\drivers\axtmvmdm.sys [10.10.2009 16:17 40064]
R3 Axtmvprt;Axesstel Diagnostic Port;f:\windows\system32\drivers\axtmvprt.sys [10.10.2009 16:17 38784]
S2 gupdate1ca4fe61cdc4330;Služba Google Update (gupdate1ca4fe61cdc4330);f:\program files\Google\Update\GoogleUpdate.exe [18.10.2009 13:28 133104]
S3 Ambfilt;Ambfilt;f:\windows\system32\drivers\Ambfilt.sys [22.5.2009 22:17 1684736]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 MaplomL;MaplomL; [x]
S4 sptd;sptd;f:\windows\system32\drivers\sptd.sys [27.1.2010 20:25 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-04 f:\windows\Tasks\1-Click Maintenance.job
- f:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2009-07-02 07:09]

2010-09-03 f:\windows\Tasks\Ad-Aware Update (Weekly).job
- f:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 22:26]

2010-09-04 f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- f:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 11:28]

2010-09-04 f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- f:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 11:28]
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
IE: Stáhnout Free Download Managerem - file://f:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://f:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://f:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://f:\program files\Free Download Manager\dlall.htm
IE: Subscribe in Desktop Sidebar - f:\program files\Desktop Sidebar\sbhelp.dll/menuhandler.html
TCP: {AFEC315E-8C21-4596-ADCF-5DB2AA97B3B0} = 160.218.43.200 160.218.10.200
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - f:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/update ... 0.27.0.cab
FF - ProfilePath - f:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\lr3t90h7.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://eu.ask.com?o=14780&l=dis
FF - prefs.js: keyword.URL -
FF - component: f:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\lr3t90h7.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - component: f:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: f:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: f:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: f:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: f:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: f:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - f:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
f:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-NirSoft VideoCacheView - g:\prográmky\VideoCacheView\uninst.exe
AddRemove-Soldat_is1 - g:\soldat\unins000.exe
AddRemove-uTorrent - f:\documents and settings\Milan\Plocha\Torent\uTorrent.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-05 00:14
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-220523388-2147122891-1801674531-1003\Software\SecuROM\License information*]
"datasecu"=hex:94,3e,3c,5d,4b,5a,1f,52,0d,0c,b4,55,77,18,a5,91,0e,47,8f,09,cf,
6c,36,ca,fe,54,d4,54,07,0c,35,d0,e6,5a,17,b0,4f,9d,c2,de,41,e9,5e,c5,3f,f0,\
"rkeysecu"=hex:5c,fa,4e,78,7c,19,b3,46,5e,d0,b7,f8,43,6a,4f,49

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="D08CB9D135AF21826374AE61E21124439BE8CB1E6BD286E864FDE3E14114877388725830EE7F4A0A71FC36D2B6E29B9C31212B090C4F8E22E223C148D34DE25855F7F287FA1C3D9F0658071E5D892EDB6D5449B5F14E10F0210483C35A842A43B8BBD09BAEAA2BD30F5E3D8B2732F0E2CCB0B88B0C262328C6C552FC00DB9A98287DD1F48FB396BC70090DA298704B18BD081F34FB94369FEFB66B5D2457473F0C2265E0DA27D970FDF339B1EA3B7C642453391E95B78B312D461C9558DE9724C1B191EDFDD21E0F036420488A6B1334562CD5FB6413383B02084B1863BF46359ADAEFF09E6F65B6BDFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808FEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933DCE0DAD9CC3D90EA485D03DA51AD6963DA3D9A21E337C43CA051A983A2838DED7E015791DB3F0489659077E19109CD6EA5C5A83A8AC326DD3EDC8303F5280CD1D140590C9DB18DAB189E82A128529B31F34AB9EEE97F725AFE6A12B3CA8B8F6842F96DC8B6C537D9E59910F7A27F8AA183AE3C98974734B3FAD5628BDE8D92E4E0A0617B30050B93F5A8D0F271DC58A9B56F5F430E4BF660EA8DC733D766936760B6C908F44719C7160338D76B89C52611199930AC90CC4D2F96580A3A1E940B99547D8A563D755CB7767F9CC97B956ABECE2453B56FCC57CA866D9FF3139DD9082716D008E837296EE5216DA978913C8D457C56CE1510D2E309A5BA5276B8D44B6DF35DA3207BFCF4C35FA88D9C87D5EFC961140403330746DC62D48ACF7470A8FD3B67A490DF17269BBDE358D8C56479B7DA9D410CD9ADDFD64B1BB2F6E293063F505AEA3608AE84098365556FA38B6583B0375ADA28F6435DC96E471B1C9A71ADE152BCE49DEAB43F3DA9B078F6DF13316FDA85EB4885296C8B65273D3A5698DA5CA3C0434BE8FE023B5EFD619E6B815DEAB3DD0F66706B90824916335B8AD06973D304CCC03BD02B126830E77A2D593534226069B64288F0E5973BA723ED11121F9E774E30653A2798DFA2206E96E27AA83C71746D7A24C2AF82A196B6AEF6A199F16E6D54E071F86C0E11F2648D8C04E1C8D47C448C84D01DEDB8D2C16BC079E36FA19E661A4E346DF41E9AC8ECE6BDC3C43721795E157CB1745482F3B7530A3EED2EAD26F3CD03BEC64F298B812A2272E126D94DCC64B63263AC9F7D1DB5DFB27993B9D84191A2C86B0C7FA20E2F47D583136D872425872ABC5BF616169495894FB7B3444D5DE4B97E24D784C773D09CC156F870AA300BE635602A79943F5AD46160E4B5521B2E7E4FC7BC305A19FA3869A96DD5947D707AB62030657AA9F365D73D66FA04D8F64EE10D8EA56266925C7CAA0F888EAC79BA5FE0D11CA1EBB9538C5B27E9"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(992)
f:\windows\system32\vorbis.dll
f:\windows\system32\ogg.dll

- - - - - - - > 'lsass.exe'(1048)
f:\windows\system32\vorbis.dll
f:\windows\system32\ogg.dll
.
Celkový čas: 2010-09-05 00:15:57
ComboFix-quarantined-files.txt 2010-09-04 22:15

Před spuštěním: Volných bajtů: 35 996 340 224
Po spuštění: Volných bajtů: 36 103 876 608

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 457384DCF1DDDC5866B3646F25AE4CF0

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:
ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

Tak tady to je. A internet je už o něco lepší.

ComboFix 10-09-03.02 - Milan 06.09.2010 13:58:52.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1495 [GMT 2:00]
Spuštěný z: f:\documents and settings\Milan\Plocha\ComboFix.exe
Použité ovládací přepínače :: f:\documents and settings\Milan\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

f:\program files\Common Files\eBay

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-06 do 2010-09-06 )))))))))))))))))))))))))))))))
.

2010-09-03 20:14 . 2010-04-29 13:39 38224 ----a-w- f:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 20:13 . 2010-09-03 20:14 -------- d-----w- f:\program files\Malwarebytes' Anti-Malware
2010-09-03 20:13 . 2010-04-29 13:39 20952 ----a-w- f:\windows\system32\drivers\mbam.sys
2010-09-03 19:16 . 2010-09-03 19:16 -------- d-----w- f:\program files\CCleaner
2010-08-31 08:46 . 2010-08-31 08:46 -------- d-----w- f:\program files\Runic Games
2010-08-21 22:09 . 2010-08-21 22:09 -------- d-----w- f:\program files\WinPcap
2010-08-21 22:05 . 2010-08-21 22:09 -------- d-----w- f:\program files\DsNET Corp

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-02 17:35 . 2010-04-12 16:56 -------- d-----w- f:\program files\Steam
2010-09-02 12:51 . 2009-05-22 20:15 -------- d--h--w- f:\program files\InstallShield Installation Information
2010-08-22 08:48 . 2009-11-13 08:10 664 ----a-w- f:\windows\system32\d3d9caps.dat
2010-08-14 23:01 . 2009-08-28 09:43 -------- d-----w- f:\program files\NVIDIA Corporation
2010-08-14 23:01 . 2009-05-22 21:13 -------- d-----w- f:\program files\Common Files\Wise Installation Wizard
2010-08-11 20:27 . 2001-10-25 12:00 483770 ----a-w- f:\windows\system32\perfh005.dat
2010-08-11 20:27 . 2001-10-25 12:00 100104 ----a-w- f:\windows\system32\perfc005.dat
2010-08-04 12:43 . 2010-08-04 12:43 -------- d-----w- f:\program files\ConMet
2010-08-03 21:24 . 2010-01-17 10:59 -------- d-----w- f:\program files\Common Files\Adobe AIR
2010-08-03 16:20 . 2010-08-03 16:20 -------- d-----w- f:\program files\Pando Networks
2010-08-01 18:11 . 2010-06-15 19:26 -------- d-----w- f:\program files\Warcraft III
2010-07-31 13:49 . 2010-07-31 13:48 21840 ----atw- f:\windows\system32\SIntfNT.dll
2010-07-31 13:49 . 2010-07-31 13:48 17212 ----atw- f:\windows\system32\SIntf32.dll
2010-07-31 13:49 . 2010-07-31 13:48 12067 ----atw- f:\windows\system32\SIntf16.dll
2010-07-21 15:51 . 2010-07-21 15:51 -------- d-----w- f:\program files\VDOWNLOADER
2010-07-18 18:15 . 2009-05-30 18:39 138832 ----a-w- f:\windows\system32\drivers\PnkBstrK.sys
2010-07-18 18:15 . 2009-05-30 18:39 202024 ----a-w- f:\windows\system32\PnkBstrB.exe
2010-06-30 12:33 . 2008-04-14 06:51 149504 ----a-w- f:\windows\system32\schannel.dll
2010-06-28 20:57 . 2010-06-29 13:56 38848 ----a-w- f:\windows\avastSS.scr
2010-06-28 20:57 . 2010-05-12 20:37 165032 ----a-w- f:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2010-05-12 20:38 46672 ----a-w- f:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2010-05-12 20:38 165456 ----a-w- f:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2010-05-12 20:38 23376 ----a-w- f:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2010-05-12 20:38 100176 ----a-w- f:\windows\system32\drivers\aswmon2.sys
2010-06-28 20:32 . 2010-05-12 20:38 94544 ----a-w- f:\windows\system32\drivers\aswmon.sys
2010-06-28 20:32 . 2010-05-12 20:38 17744 ----a-w- f:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 20:32 . 2010-05-12 20:38 28880 ----a-w- f:\windows\system32\drivers\aavmker4.sys
2010-06-24 12:27 . 2008-05-09 16:13 916480 ----a-w- f:\windows\system32\wininet.dll
2010-06-24 09:02 . 2008-04-14 05:45 1851904 ----a-w- f:\windows\system32\win32k.sys
2010-06-21 18:41 . 2010-06-21 18:41 25280 ----a-w- f:\windows\system32\drivers\hamachi.sys
2010-06-21 15:27 . 2008-04-13 22:45 354304 ----a-w- f:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2008-04-14 06:51 80384 ----a-w- f:\windows\system32\iccvid.dll
2010-06-15 19:32 . 2010-06-15 19:28 78794 ----a-w- f:\windows\War3Unin.dat
2010-06-15 19:31 . 2010-06-15 19:28 2829 ----a-w- f:\windows\War3Unin.pif
2010-06-15 19:31 . 2010-06-15 19:28 139264 ----a-w- f:\windows\War3Unin.exe
2010-06-14 14:31 . 2009-05-22 16:59 744448 ----a-w- f:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2008-04-14 06:51 1172480 ----a-w- f:\windows\system32\msxml3.dll
2008-06-17 09:35 . 2009-10-10 14:17 212992 ----a-r- f:\program files\MSP_Uninstall.exe
2007-04-04 07:24 . 2009-10-10 14:17 90112 ----a-r- f:\program files\axesstel.dll
2005-03-22 07:54 . 2009-05-22 20:50 1126912 ----a-w- f:\program files\DVDDecrypter.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- f:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- f:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-04_22.14.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-06 11:51 . 2010-09-06 11:51 16384 f:\windows\Temp\Perflib_Perfdata_2f0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorFX"="f:\program files\Stardock\CursorFX\CursorFX.exe" [2008-02-05 417528]
"Skype"="f:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"Ad-Watch"="f:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-12 524632]
"nwiz"="f:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"OODefragTray"="f:\windows\system32\oodtray.exe" [2009-04-07 2553088]
"avast5"="f:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boincmgr]
2008-12-09 10:08 4289280 ----a-w- f:\program files\BOINC\boincmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boinctray]
2008-12-09 10:08 58112 ----a-w- f:\program files\BOINC\boinctray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- f:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50 155648 ----a-r- f:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-08-24 10:58 1242448 ----a-w- f:\program files\Steam\steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\WINDOWS\\system32\\PnkBstrA.exe"=
"f:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Documents and Settings\\Milan\\Plocha\\Programy\\Torent\\uTorrent.exe"=
"f:\\Program Files\\ICQ6.5\\ICQ.exe"=
"f:\\Program Files\\GameSpy\\Comrade\\Comrade.exe"=
"f:\\Program Files\\Electronic Arts\\BattleForge\\Bootstrapper.exe"=
"f:\\Program Files\\Electronic Arts\\BattleForge\\BattleForge.exe"=
"f:\\WINDOWS\\system32\\dplaysvr.exe"=
"f:\\Program Files\\Interplay\\Fallout Tactics\\BOS.exe"=
"f:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Savage 2 - A Tortured Soul\\savage2.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\launcher.ui.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\MytheonClientR.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\ClientLauncherG.exe"=
"c:\\Program Files\\TrueGames\\Mytheon\\ClientLauncherR.exe"=
"c:\\Program Files\\COH Anthology\\RelicCOH.exe"=
"c:\\Program Files\\COH Anthology\\RelicDownloader\\RelicDownloader.exe"=
"f:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"f:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"f:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Medal\\MoHMPUpdater.exe"=
"c:\\Program Files\\Medal\\MoHMPGame.exe"=
"f:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"f:\\Program Files\\Steam\\steam.exe"=
"f:\\Program Files\\Steam\\steamapps\\common\\r.u.s.e. free week end\\Ruse.exe"=
"f:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\League of Legends\\Air\\LolClient.exe"=
"c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"=
"f:\\Program Files\\Steam\\steamapps\\common\\mafia ii - public demo\\launcher.exe"=
"f:\\WINDOWS\\system32\\dpvsetup.exe"=
"f:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56554:TCP"= 56554:TCP:Pando Media Booster
"56554:UDP"= 56554:UDP:Pando Media Booster
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6915:TCP"= 6915:TCP:League of Legends Launcher
"6915:UDP"= 6915:UDP:League of Legends Launcher
"6944:TCP"= 6944:TCP:League of Legends Launcher
"6944:UDP"= 6944:UDP:League of Legends Launcher
"6973:TCP"= 6973:TCP:League of Legends Launcher
"6973:UDP"= 6973:UDP:League of Legends Launcher

R0 Lbd;Lbd;f:\windows\system32\drivers\Lbd.sys [22.5.2009 23:24 64160]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);f:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R1 aswSP;aswSP;f:\windows\system32\drivers\aswSP.sys [12.5.2010 22:38 165456]
R2 aswFsBlk;aswFsBlk;f:\windows\system32\drivers\aswFsBlk.sys [12.5.2010 22:38 17744]
R2 GS In-Game Service;GS In-Game Service;f:\program files\GameTracker\GSInGameService.exe [21.6.2010 21:17 1648480]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;f:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 1029456]
R2 npf;NetGroup Packet Filter Driver;f:\windows\system32\drivers\npf.sys [16.11.2009 18:33 50704]
R3 Axtmvflt;Axesstel USB Filter Service;f:\windows\system32\drivers\axtmvflt.sys [10.10.2009 16:17 3456]
R3 Axtmvmdm;Axesstel USB Modem;f:\windows\system32\drivers\axtmvmdm.sys [10.10.2009 16:17 40064]
R3 Axtmvprt;Axesstel Diagnostic Port;f:\windows\system32\drivers\axtmvprt.sys [10.10.2009 16:17 38784]
S2 gupdate1ca4fe61cdc4330;Služba Google Update (gupdate1ca4fe61cdc4330);f:\program files\Google\Update\GoogleUpdate.exe [18.10.2009 13:28 133104]
S3 Ambfilt;Ambfilt;f:\windows\system32\drivers\Ambfilt.sys [22.5.2009 22:17 1684736]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 MaplomL;MaplomL; [x]
S4 sptd;sptd;f:\windows\system32\drivers\sptd.sys [27.1.2010 20:25 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-06 f:\windows\Tasks\1-Click Maintenance.job
- f:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2009-07-02 07:09]

2010-09-03 f:\windows\Tasks\Ad-Aware Update (Weekly).job
- f:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 22:26]

2010-09-06 f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- f:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 11:28]

2010-09-05 f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- f:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 11:28]
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
IE: Stáhnout Free Download Managerem - file://f:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://f:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://f:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://f:\program files\Free Download Manager\dlall.htm
IE: Subscribe in Desktop Sidebar - f:\program files\Desktop Sidebar\sbhelp.dll/menuhandler.html
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - f:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/update ... 0.27.0.cab
FF - ProfilePath - f:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\lr3t90h7.default\
FF - prefs.js: keyword.URL -
FF - component: f:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\lr3t90h7.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - component: f:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - f:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
f:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-06 14:03
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-220523388-2147122891-1801674531-1003\Software\SecuROM\License information*]
"datasecu"=hex:94,3e,3c,5d,4b,5a,1f,52,0d,0c,b4,55,77,18,a5,91,0e,47,8f,09,cf,
6c,36,ca,fe,54,d4,54,07,0c,35,d0,e6,5a,17,b0,4f,9d,c2,de,41,e9,5e,c5,3f,f0,\
"rkeysecu"=hex:5c,fa,4e,78,7c,19,b3,46,5e,d0,b7,f8,43,6a,4f,49

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="D08CB9D135AF21826374AE61E21124439BE8CB1E6BD286E864FDE3E14114877388725830EE7F4A0A71FC36D2B6E29B9C31212B090C4F8E22E223C148D34DE25855F7F287FA1C3D9F0658071E5D892EDB6D5449B5F14E10F0210483C35A842A43B8BBD09BAEAA2BD30F5E3D8B2732F0E2CCB0B88B0C262328C6C552FC00DB9A98287DD1F48FB396BC70090DA298704B18BD081F34FB94369FEFB66B5D2457473F0C2265E0DA27D970FDF339B1EA3B7C642453391E95B78B312D461C9558DE9724C1B191EDFDD21E0F036420488A6B1334562CD5FB6413383B02084B1863BF46359ADAEFF09E6F65B6BDFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808FEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933DCE0DAD9CC3D90EA485D03DA51AD6963DA3D9A21E337C43CA051A983A2838DED7E015791DB3F0489659077E19109CD6EA5C5A83A8AC326DD3EDC8303F5280CD1D140590C9DB18DAB189E82A128529B31F34AB9EEE97F725AFE6A12B3CA8B8F6842F96DC8B6C537D9E59910F7A27F8AA183AE3C98974734B3FAD5628BDE8D92E4E0A0617B30050B93F5A8D0F271DC58A9B56F5F430E4BF660EA8DC733D766936760B6C908F44719C7160338D76B89C52611199930AC90CC4D2F96580A3A1E940B99547D8A563D755CB7767F9CC97B956ABECE2453B56FCC57CA866D9FF3139DD9082716D008E837296EE5216DA978913C8D457C56CE1510D2E309A5BA5276B8D44B6DF35DA3207BFCF4C35FA88D9C87D5EFC961140403330746DC62D48ACF7470A8FD3B67A490DF17269BBDE358D8C56479B7DA9D410CD9ADDFD64B1BB2F6E293063F505AEA3608AE84098365556FA38B6583B0375ADA28F6435DC96E471B1C9A71ADE152BCE49DEAB43F3DA9B078F6DF13316FDA85EB4885296C8B65273D3A5698DA5CA3C0434BE8FE023B5EFD619E6B815DEAB3DD0F66706B90824916335B8AD06973D304CCC03BD02B126830E77A2D593534226069B64288F0E5973BA723ED11121F9E774E30653A2798DFA2206E96E27AA83C71746D7A24C2AF82A196B6AEF6A199F16E6D54E071F86C0E11F2648D8C04E1C8D47C448C84D01DEDB8D2C16BC079E36FA19E661A4E346DF41E9AC8ECE6BDC3C43721795E157CB1745482F3B7530A3EED2EAD26F3CD03BEC64F298B812A2272E126D94DCC64B63263AC9F7D1DB5DFB27993B9D84191A2C86B0C7FA20E2F47D583136D872425872ABC5BF616169495894FB7B3444D5DE4B97E24D784C773D09CC156F870AA300BE635602A79943F5AD46160E4B5521B2E7E4FC7BC305A19FA3869A96DD5947D707AB62030657AA9F365D73D66FA04D8F64EE10D8EA56266925C7CAA0F888EAC79BA5FE0D11CA1EBB9538C5B27E9"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(992)
f:\windows\system32\vorbis.dll
f:\windows\system32\ogg.dll

- - - - - - - > 'lsass.exe'(1048)
f:\windows\system32\vorbis.dll
f:\windows\system32\ogg.dll

- - - - - - - > 'explorer.exe'(2256)
f:\windows\system32\vorbis.dll
f:\windows\system32\ogg.dll
f:\progra~1\WINDOW~2\wmpband.dll
f:\program files\Stardock\CursorFX\CurXP0.dll
f:\windows\system32\webcheck.dll
f:\windows\system32\WPDShServiceObj.dll
f:\windows\system32\PortableDeviceTypes.dll
f:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-09-06 14:04:22
ComboFix-quarantined-files.txt 2010-09-06 12:04
ComboFix2.txt 2010-09-04 22:15

Před spuštěním: Volných bajtů: 36 024 012 800
Po spuštění: Volných bajtů: 36 044 607 488

- - End Of File - - 7D075E2CE5DE6C50155294C3329B98F5

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Pak dej vědět jestli je ještě nějaký problém.

S internetem už je to lepší. Moc děkuji za pomoc, kterou jste mi poskytli a opravdu to pomohlo. Díky

Není zač.