VIRY.CZ

Logfile of random's system information tool 1.08 (written by random/random)
Run by pajik at 2010-09-18 10:14:52
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 43 GB (58%) free of 74 GB
Total RAM: 1023 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:15:12, on 18.9.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
C:\Program Files\strong\StrongDC.exe
D:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\totalcmd\TOTALCMD.EXE
D:\paja\RSIT.exe
C:\Program Files\trend micro\pajik.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
R3 - URLSearchHook: OLE (Teil 1 von 5) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CHelper Class - {99A7C4DD-B2E6-4CA0-BB6E-737A61364155} - (no file)
O4 - HKLM\..\Run: [TrueImageMonitor.exe] D:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [AcronisTimounterMonitor] D:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\winlogon.exe] C:\WINDOWS\system32\winlogon.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Spamihilator.lnk = C:\Program Files\Spamihilator\spamihilator.exe
O4 - Startup: Zástupce - StrongDC.lnk = C:\Program Files\strong\StrongDC.exe
O4 - Startup: Zástupce - WinVNC.lnk = D:\Program Files\TightVNC\WinVNC.exe
O4 - Global Startup: TMMonitor.lnk = D:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Add to Local Website Archive - {607BFC4C-D3C7-4ED7-B42A-2CA20F7CB4CA} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra button: Start Local Website Archive - {A9D89C37-9D42-445A-B835-FE6EF03FF5F3} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O16 - DPF: {0A6112F2-F9D1-4FBF-A6EC-B67B22915873} (PhotoUploader Control) - http://foto.ihned.cz/snadno-vlozit-foto ... oader2.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} (Gif89 Lite Class) - http://192.168.1.12/xplugLite.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4D0CC8B-D071-4EF4-9393-8CB0754F2390}: NameServer = 10.93.0.2,10.93.0.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SPAMfighter Update Service - Acronis - (no file)
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7121 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{DB840A68-7C4D-43C1-A6B8-4409DF16EDC0}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 501400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99A7C4DD-B2E6-4CA0-BB6E-737A61364155}]
CHelper Class

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"=D:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2007-02-19 1188456]
"Acronis Scheduler2 Service"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2006-10-17 87584]
"AcronisTimounterMonitor"=D:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2007-02-19 1962896]
"C:\WINDOWS\system32\winlogon.exe"=C:\WINDOWS\system32\winlogon.exe [2008-04-14 507904]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2010-03-30 917504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
TMMonitor.lnk - D:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe

C:\Documents and Settings\pajik\Nabídka Start\Programy\Po spuštění
Spamihilator.lnk - C:\Program Files\Spamihilator\spamihilator.exe
Zástupce - StrongDC.lnk - C:\Program Files\strong\StrongDC.exe
Zástupce - WinVNC.lnk - D:\Program Files\TightVNC\WinVNC.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-08-24 133120]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\strong\StrongDC.exe"="C:\Program Files\strong\StrongDC.exe:*:Enabled:StrongDC++"
"D:\Program Files\Miranda IM\miranda32.exe"="D:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"D:\TOTALCMD\TOTALCMD.EXE"="D:\TOTALCMD\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\skype\Skype.exe"="D:\Program Files\skype\Skype.exe:*:Enabled:Skype"
"D:\Program Files\ICQ6.5\ICQ.exe"="D:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"D:\Program Files\ArcSoft\TotalMedia 3\TotalMedia.exe"="D:\Program Files\ArcSoft\TotalMedia 3\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3"
"D:\Program Files\skype\Plugin Manager\skypePM.exe"="D:\Program Files\skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Program Files\skype\Phone\Skype.exe"="D:\Program Files\skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-09-18 10:14:52 ----D---- C:\rsit
2010-09-18 10:14:52 ----D---- C:\Program Files\trend micro
2010-09-17 17:53:49 ----SHD---- C:\RECYCLER
2010-09-17 09:32:23 ----D---- C:\WINDOWS\temp
2010-09-16 15:30:10 ----D---- C:\house Zoly
2010-09-16 11:33:43 ----A---- C:\Boot.bak
2010-09-16 11:33:39 ----RASHD---- C:\cmdcons
2010-09-16 11:32:03 ----A---- C:\WINDOWS\MBR.exe
2010-09-16 11:32:02 ----A---- C:\WINDOWS\SWREG.exe
2010-09-16 11:32:02 ----A---- C:\WINDOWS\PEV.exe
2010-09-16 11:32:02 ----A---- C:\WINDOWS\NIRCMD.exe
2010-09-16 11:32:01 ----A---- C:\WINDOWS\zip.exe
2010-09-16 11:32:01 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-09-16 11:32:01 ----A---- C:\WINDOWS\SWSC.exe
2010-09-16 11:32:01 ----A---- C:\WINDOWS\sed.exe
2010-09-16 11:32:01 ----A---- C:\WINDOWS\grep.exe
2010-09-16 11:31:47 ----D---- C:\WINDOWS\ERDNT
2010-09-16 11:31:17 ----D---- C:\Qoobox
2010-09-16 09:50:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2259922$
2010-09-16 09:50:47 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2010-09-16 09:50:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2010-09-16 09:50:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2121546$
2010-09-16 09:50:33 ----HDC---- C:\WINDOWS\$NtUninstallKB982802$
2010-09-16 09:50:28 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2010-09-16 09:48:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2141007$
2010-09-15 08:30:11 ----HD---- C:\WINDOWS\$hf_mig$
2010-09-15 08:24:34 ----A---- C:\WINDOWS\system32\muweb.dll
2010-09-15 08:24:34 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-09-15 08:24:34 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-09-14 12:01:36 ----D---- C:\Program Files\Windows Live SkyDrive
2010-09-14 12:01:18 ----D---- C:\Program Files\Windows Live
2010-09-14 11:59:22 ----D---- C:\Program Files\Common Files\Windows Live
2010-09-14 11:49:04 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2010-09-14 11:11:47 ----D---- C:\Documents and Settings\pajik\Data aplikací\URSoft
2010-08-31 15:25:22 ----D---- C:\Documents and Settings\pajik\Data aplikací\Google
2010-08-31 12:44:40 ----D---- C:\Documents and Settings\pajik\Data aplikací\skypePM
2010-08-31 12:43:55 ----D---- C:\Program Files\Google
2010-08-31 12:43:48 ----D---- C:\Program Files\Common Files\Skype
2010-08-31 12:43:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2010-08-28 19:01:24 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-08-28 19:01:17 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2010-08-28 09:25:45 ----D---- C:\Documents and Settings\pajik\Data aplikací\Ventrilo
2010-08-28 09:24:37 ----D---- C:\Program Files\WinRAR
2010-08-23 16:34:21 ----D---- C:\Documents and Settings\pajik\Data aplikací\Malwarebytes
2010-08-23 16:34:04 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-08-23 16:34:03 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-08-22 16:33:29 ----D---- C:\Documents and Settings\pajik\Data aplikací\Sun
2010-08-22 10:49:43 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-08-22 10:49:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-08-22 10:36:25 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 months======

2010-09-18 10:14:57 ----D---- C:\WINDOWS\Prefetch
2010-09-18 10:14:52 ----D---- C:\Program Files
2010-09-18 10:14:09 ----A---- C:\WINDOWS\WINCMD.INI
2010-09-17 18:05:44 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-09-17 18:05:10 ----SHD---- C:\WINDOWS\Installer
2010-09-17 09:32:23 ----D---- C:\WINDOWS
2010-09-17 09:30:39 ----A---- C:\WINDOWS\system.ini
2010-09-17 09:28:26 ----D---- C:\WINDOWS\system32\drivers
2010-09-17 09:28:26 ----D---- C:\WINDOWS\system32
2010-09-17 09:28:26 ----D---- C:\WINDOWS\AppPatch
2010-09-17 09:28:23 ----D---- C:\Program Files\Common Files
2010-09-17 09:26:09 ----D---- C:\WINDOWS\system32\CatRoot2
2010-09-17 08:58:39 ----D---- C:\WINDOWS\WinSxS
2010-09-16 15:27:49 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-09-16 11:44:43 ----SD---- C:\WINDOWS\Tasks
2010-09-16 11:42:23 ----D---- C:\WINDOWS\system32\drivers\etc
2010-09-16 11:40:57 ----D---- C:\WINDOWS\system32\config
2010-09-16 11:33:43 ----RASH---- C:\boot.ini
2010-09-16 09:50:54 ----HD---- C:\WINDOWS\inf
2010-09-16 09:50:49 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-09-16 09:48:52 ----A---- C:\WINDOWS\system32\MRT.exe
2010-09-14 12:13:31 ----D---- C:\Documents and Settings\pajik\Data aplikací\ICQ
2010-09-14 12:01:41 ----SD---- C:\Documents and Settings\pajik\Data aplikací\Microsoft
2010-09-14 12:01:41 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-09-14 12:01:41 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-09-14 12:01:25 ----RSD---- C:\WINDOWS\Fonts
2010-09-01 21:02:51 ----D---- C:\Documents and Settings\pajik\Data aplikací\Skype
2010-08-28 09:25:23 ----D---- C:\Documents and Settings\pajik\Data aplikací\WinRAR
2010-08-23 17:50:50 ----D---- C:\WINDOWS\SoftwareDistribution
2010-08-23 12:21:17 ----D---- C:\WINDOWS\Debug
2010-08-22 11:28:08 ----A---- C:\WINDOWS\wininit.ini
2010-08-21 15:39:24 ----D---- C:\Documents and Settings
2010-08-19 18:50:22 ----A---- C:\WINDOWS\wcx_ftp.ini
2010-08-19 14:06:59 ----D---- C:\Program Files\Windows Media Player
2010-08-19 13:59:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\RFA_Backups

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 snapman;Acronis Snapshots Manager; C:\WINDOWS\system32\DRIVERS\snapman.sys [2007-04-20 114048]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\WINDOWS\system32\DRIVERS\timntr.sys [2007-04-20 395744]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2007-12-21 53768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys []
R2 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [2002-08-14 17005]
R2 BT848;WinFast TV2000 XP WDM Video Capture; C:\WINDOWS\system32\drivers\wf2kvcap.sys [2003-12-12 76373]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2007-12-21 71176]
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2007-04-20 39264]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner; C:\WINDOWS\system32\drivers\wf2ktunr.sys [2003-12-12 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar; C:\WINDOWS\system32\drivers\wf2kxbar.sys [2003-12-12 10005]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-08-14 404736]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-08-15 462684]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2003-03-04 145408]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2007-12-21 30728]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 catchme;catchme; \??\C:\DOCUME~1\pajik\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 PAC207;VideoCAM GE111; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
S3 pgfilter;pgfilter; C:\WINDOWS\system32\drivers\pgfilter.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 tap0901_2gm;VPN Anonymizer Adapter; C:\WINDOWS\system32\DRIVERS\tap0901_2gm.sys [2007-06-21 30720]
S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4; C:\WINDOWS\system32\drivers\UfasoftSnifDriver4.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WFIOCTL;WFIOCTL; C:\WINDOWS\system32\drivers\WFIOCTL.sys []
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2006-10-17 230944]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2010-03-30 495616]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2010-08-12 53248]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [2003-03-03 143360]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dobrý večer
Vidím že jste použil combofix, máte z něj log? Měl by být na disku C.

tuje combo,diky

ComboFix 10-09-17.04 - pajik 19.09.2010 11:33:41.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.601 [GMT 2:00]
Spuštěný z: d:\paja\soubory komplet\ComboFix.exe
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-08-19 do 2010-09-19 )))))))))))))))))))))))))))))))
.

2010-09-18 15:27 . 2010-09-18 15:27 -------- d-----r- C:\MSOCache
2010-09-18 08:14 . 2010-09-18 08:15 -------- d-----w- C:\rsit
2010-09-18 08:14 . 2010-09-18 08:15 -------- d-----w- c:\program files\trend micro
2010-09-16 13:30 . 2010-09-16 13:30 -------- d-----w- C:\house Zoly
2010-09-15 06:30 . 2010-09-16 07:50 -------- d--h--w- c:\windows\$hf_mig$
2010-09-15 06:24 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-09-15 06:24 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-09-14 10:01 . 2010-09-14 10:01 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-09-14 10:01 . 2010-09-14 10:01 -------- d-----w- c:\program files\Windows Live
2010-09-14 09:59 . 2010-09-14 09:59 -------- d-----w- c:\program files\Common Files\Windows Live
2010-08-31 10:44 . 2010-08-31 10:44 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-08-31 10:43 . 2010-09-14 09:49 -------- d-----w- c:\program files\Google
2010-08-31 10:43 . 2010-08-31 10:43 -------- d-----w- c:\program files\Common Files\Skype
2010-08-28 17:01 . 2008-04-14 03:21 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-08-28 17:01 . 2008-04-14 03:21 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-08-28 17:01 . 2008-04-14 02:29 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-08-28 17:01 . 2008-04-14 02:29 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-08-28 07:40 . 2010-08-28 07:40 -------- d-sh--w- c:\documents and settings\pajik\UserData
2010-08-23 14:34 . 2010-09-14 09:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-22 14:28 . 2010-08-22 14:28 -------- d-sh--w- c:\documents and settings\pajik\PrivacIE
2010-08-22 14:28 . 2010-08-22 14:28 -------- d-sh--w- c:\documents and settings\pajik\IECompatCache
2010-08-22 08:49 . 2010-08-22 08:51 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-22 08:36 . 2010-08-22 08:36 -------- d-----w- c:\program files\CCleaner
2010-08-21 15:42 . 2010-08-21 15:42 -------- d-sh--w- c:\documents and settings\pajik\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 13:17 . 2004-08-17 13:49 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-14 09:43 . 2010-08-14 09:43 -------- d-----w- c:\program files\XXCLONE
2010-08-12 13:36 . 2006-11-13 12:10 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2010-08-12 08:25 . 2001-10-25 14:00 82372 ----a-w- c:\windows\system32\perfc005.dat
2010-08-12 08:25 . 2001-10-25 14:00 437558 ----a-w- c:\windows\system32\perfh005.dat
2010-08-10 10:17 . 2006-11-11 16:29 1243680 ----a-w- c:\windows\system32\AutoPartNt.exe
2010-08-04 12:27 . 2009-07-10 08:47 -------- d-----w- c:\program files\ESET
2010-07-22 15:46 . 2004-08-17 13:49 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:33 . 2004-08-17 13:49 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 08:00 . 2010-06-30 09:14 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-06-24 12:27 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-17 13:44 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-03 21:14 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2006-05-03 10:06 . 2008-02-12 11:21 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2008-02-12 11:21 31232 --sh--r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-02-12 11:22 27648 --sh--w- c:\windows\system32\Smab0.dll
2008-02-04 19:26 . 2008-02-12 11:22 151040 --sh--w- c:\windows\system32\VistaUltm.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-16_09.42.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 1999-11-25 00:40 . 1999-11-25 00:40 40960 c:\windows\system32\VBAME.DLL
- 1999-11-25 01:40 . 1999-11-25 01:40 40960 c:\windows\system32\VBAME.DLL
+ 2006-11-14 14:17 . 2003-06-18 23:31 18944 c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
- 2006-11-14 14:17 . 2003-06-19 00:31 18944 c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
+ 2006-11-14 14:17 . 2003-06-18 23:31 35328 c:\windows\system32\spool\drivers\w32x86\mdiui.dll
- 2006-11-14 14:17 . 2003-06-19 00:31 35328 c:\windows\system32\spool\drivers\w32x86\mdiui.dll
- 2006-11-14 14:17 . 2003-06-19 00:31 35328 c:\windows\system32\spool\drivers\w32x86\3\mdiui.dll
+ 2006-11-14 14:17 . 2003-06-18 23:31 35328 c:\windows\system32\spool\drivers\w32x86\3\mdiui.dll
+ 1998-03-25 03:54 . 1998-03-25 03:54 15872 c:\windows\system32\SCP32.DLL
- 1998-03-25 04:54 . 1998-03-25 04:54 15872 c:\windows\system32\SCP32.DLL
- 1998-08-09 18:07 . 1998-08-09 18:07 94208 c:\windows\system32\MSSTKPRP.DLL
+ 1998-08-09 17:07 . 1998-08-09 17:07 94208 c:\windows\system32\MSSTKPRP.DLL
- 2006-11-14 14:17 . 2003-06-19 00:31 17920 c:\windows\system32\mdimon.dll
+ 2006-11-14 14:17 . 2003-06-18 23:31 17920 c:\windows\system32\mdimon.dll
- 2003-07-15 05:57 . 2003-07-15 05:57 32584 c:\windows\system32\FM20ENU.DLL
+ 2003-07-15 04:57 . 2003-07-15 04:57 32584 c:\windows\system32\FM20ENU.DLL
+ 2010-09-18 15:29 . 2010-09-18 15:29 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 1999-05-19 13:58 . 1999-05-19 13:58 7680 c:\windows\system32\MSPRPCS.DLL
- 1999-05-19 14:58 . 1999-05-19 14:58 7680 c:\windows\system32\MSPRPCS.DLL
+ 2010-09-18 15:29 . 2010-09-18 15:29 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-07-11 22:02 . 2009-07-11 22:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
- 2002-08-21 04:13 . 2002-08-21 04:13 189952 c:\windows\system32\WISPTIS.EXE
+ 2002-08-21 03:13 . 2002-08-21 03:13 189952 c:\windows\system32\WISPTIS.EXE
+ 2006-11-14 14:17 . 2003-06-18 23:31 758784 c:\windows\system32\spool\drivers\w32x86\mdigraph.dll
- 2006-11-14 14:17 . 2003-06-19 00:31 758784 c:\windows\system32\spool\drivers\w32x86\mdigraph.dll
+ 2006-11-14 14:17 . 2003-06-18 23:31 758784 c:\windows\system32\spool\drivers\w32x86\3\mdigraph.dll
- 2006-11-14 14:17 . 2003-06-19 00:31 758784 c:\windows\system32\spool\drivers\w32x86\3\mdigraph.dll
+ 2002-08-21 03:10 . 2002-08-21 03:10 204800 c:\windows\system32\INKED.DLL
- 2002-08-21 04:10 . 2002-08-21 04:10 204800 c:\windows\system32\INKED.DLL
+ 2006-11-09 09:46 . 2010-09-19 09:26 121336 c:\windows\system32\FNTCACHE.DAT
- 2006-11-09 09:46 . 2010-09-15 06:23 121336 c:\windows\system32\FNTCACHE.DAT
+ 2003-07-26 01:14 . 2003-07-26 01:14 799288 c:\windows\ServicePackFiles\i386\FPWEC.DLL
+ 2010-09-17 06:58 . 2010-09-17 06:58 195584 c:\windows\Installer\1d10b.msi
+ 2010-09-18 15:29 . 2010-09-18 15:29 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2010-09-18 15:29 . 2010-09-18 15:29 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2003-08-03 17:56 . 2003-08-03 17:56 1146184 c:\windows\system32\FM20.DLL
+ 2003-08-03 16:56 . 2003-08-03 16:56 1146184 c:\windows\system32\FM20.DLL
+ 2003-07-26 01:00 . 2003-07-26 01:00 1157696 c:\windows\ServicePackFiles\i386\FPSRVUTL.DLL
+ 2010-09-18 15:29 . 2010-09-18 15:29 5788160 c:\windows\Installer\1908ce6.msi
+ 2005-09-29 07:53 . 2005-09-29 07:53 81304064 c:\windows\Installer\15022c.msp
+ 2007-07-27 06:43 . 2007-07-27 06:43 109673984 c:\windows\Installer\950e3.msp
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-19 1188456]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-17 87584]
"AcronisTimounterMonitor"="d:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-19 1962896]
"c:\windows\system32\winlogon.exe"="c:\windows\system32\winlogon.exe" [2008-04-14 507904]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-03-30 917504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TMMonitor.lnk - d:\program files\ArcSoft\TotalMedia 3\TMMonitor.exe [2010-7-4 245760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk autopartntautopartnt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\strong\\StrongDC.exe"=
"d:\\Program Files\\Miranda IM\\miranda32.exe"=
"d:\\TOTALCMD\\TOTALCMD.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\skype\\Skype.exe"=
"d:\\Program Files\\ICQ6.5\\ICQ.exe"=
"d:\\Program Files\\skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"27598:TCP"= 27598:TCP:BitComet 27598 TCP
"27598:UDP"= 27598:UDP:BitComet 27598 UDP
"8635:TCP"= 8635:TCP:BitComet 8635 TCP
"8635:UDP"= 8635:UDP:BitComet 8635 UDP

R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [10.12.2006 14:03 76373]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [10.12.2006 14:03 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [10.12.2006 14:03 10005]
S2 SPAMfighter Update Service;SPAMfighter Update Service; [x]
S3 PAC207;VideoCAM GE111;c:\windows\system32\drivers\pfc027.sys [8.4.2005 11:46 162176]
S3 tap0901_2gm;VPN Anonymizer Adapter;c:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 17:21 30720]
S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4; [x]
S3 WFIOCTL;WFIOCTL; [x]
.
Obsah adresáře 'Naplánované úlohy'

2007-12-15 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2004-08-17 03:22]

2010-09-19 c:\windows\Tasks\User_Feed_Synchronization-{DB840A68-7C4D-43C1-A6B8-4409DF16EDC0}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/
uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: imon.dll
TCP: {B4D0CC8B-D071-4EF4-9393-8CB0754F2390} = 10.93.0.2,10.93.0.1
DPF: {0A6112F2-F9D1-4FBF-A6EC-B67B22915873} - hxxp://foto.ihned.cz/snadno-vlozit-fotografie/ilt/ilikethisPhotoUploader2.dll
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://192.168.1.12/xplugLite.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 11:37
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(1180)
c:\windows\system32\relog_ap.dll
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(868)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-09-19 11:39:05
ComboFix-quarantined-files.txt 2010-09-19 09:39
ComboFix2.txt 2010-09-16 09:45

Před spuštěním: Volných bajtů: 44 518 957 056
Po spuštění: Volných bajtů: 44 514 086 912

- - End Of File - - 94353A7F449E3AE825D8AE943BA4CD1D

V logu nic nevidím, máte s počítačem nějaké problémy?

Nemam,tak zaplAT panbuh.
Dekuji mc za vas cas

Ještě mi neutíkejte, přece jen něco málo domažeme

Otestujte na www.virustotal.com
c:\windows\system32\winlogon.exe
-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.

Ja myslel,ze sem vyrizenej..No to sem taky

AhnLab-V3 2010.09.15.00 2010.09.14 -
AntiVir 8.2.4.52 2010.09.14 -
Antiy-AVL 2.0.3.7 2010.09.14 -
Authentium 5.2.0.5 2010.09.14 -
Avast 4.8.1351.0 2010.09.14 -
Avast5 5.0.594.0 2010.09.14 -
AVG 9.0.0.851 2010.09.14 -
BitDefender 7.2 2010.09.14 -
CAT-QuickHeal 11.00 2010.09.14 -
ClamAV 0.96.2.0-git 2010.09.14 -
Comodo 6076 2010.09.14 -
DrWeb 5.0.2.03300 2010.09.14 -
Emsisoft 5.0.0.37 2010.09.14 -
eSafe 7.0.17.0 2010.09.14 -
eTrust-Vet 36.1.7854 2010.09.14 -
F-Prot 4.6.1.107 2010.09.14 -
F-Secure 9.0.15370.0 2010.09.14 -
Fortinet 4.1.143.0 2010.09.13 -
GData 21 2010.09.14 -
Ikarus T3.1.1.88.0 2010.09.14 -
Jiangmin 13.0.900 2010.09.14 -
K7AntiVirus 9.63.2512 2010.09.14 -
Kaspersky 7.0.0.125 2010.09.14 -
McAfee 5.400.0.1158 2010.09.14 -
McAfee-GW-Edition 2010.1B 2010.09.14 -
Microsoft 1.6103 2010.09.14 -
NOD32 5451 2010.09.14 -
Norman 6.06.06 2010.09.14 -
nProtect 2010-09-14.01 2010.09.14 -
Panda 10.0.2.7 2010.09.14 -
PCTools 7.0.3.5 2010.09.14 -
Prevx 3.0 2010.09.14 -
Rising 22.65.01.04 2010.09.14 -
Sophos 4.57.0 2010.09.14 -
Sunbelt 6876 2010.09.14 -
SUPERAntiSpyware 4.40.0.1006 2010.09.14 -
Symantec 20101.1.1.7 2010.09.14 -
TheHacker 6.7.0.0.017 2010.09.14 -
TrendMicro 9.120.0.1004 2010.09.14 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.14 -
VBA32 3.12.14.0 2010.09.14 -
ViRobot 2010.8.25.4006 2010.09.14 -
VirusBuster 12.65.6.0 2010.09.14 -
Additional informationShow all
MD5 : cddb1f8e1aea356f3ad106f2cf9b7fea
SHA1 : ce6f5d103536a14e2cb63e53fb1338091ce9762e
SHA256: fe79b20b9a82559b5cd6ad5334fc24a88deb4fca79f23360c382a06b7dedd0d7
ssdeep: 6144:6NZlxEdL5RvGlcHF37newMLao6nMnKHOD13XRnCfOVSePfLtisgZYlS:Vdz+lcDKao6nSK
HsRqOMgxZgb
File size : 507904 bytes
First seen: 2009-02-16 20:56:43
Last seen : 2010-09-14 20:47:39
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. V_echna pr_va vyhrazena.
product......: Opera_n_ syst_m Microsoft_ Windows_
description..: Windows NT Logon Application
original name: WINLOGON.EXE
internal name: winlogon
file version.: 5.1.2600.5512 (xpsp.080413-2113)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x103E5E1
timedatestamp....: 0x48027549 (Sun Apr 13 21:04:09 2008)
machinetype......: 0x14C (Intel I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x70991, 0x70A00, 6.82, 70f976636c86cc2d3438d06d8474c236
.data, 0x72000, 0x4E70, 0x2000, 6.28, 44bd27282514b5e3a27b570106930d8d
.rsrc, 0x77000, 0x9028, 0x9200, 3.97, 3ec26c0e7c4fe93c542d09d65718f571



VT Community

Ještě se mi nelíbí jeden soubor, něco bych si ráda ověřila. Pokud ho budu bezhlavě mazat, může se stát, že se nedostanete do svého profilu, takže mějte teď se mnou trpělivost .



Stáhněte SystemLook
http://jpshortstuff.247fixes.com/SystemLook.exe

- uložte ho na plochu a spustte.
- do okénka zkopírujte - klikněte na Look, proběhne sken, na konci se zobrazí log, jehož obsah zkopírujete sem

SystemLook 04.09.10 by jpshortstuff
Log created at 13:47 on 20/09/2010 by pajik
Administrator - Elevation successful

========== filefind ==========

Searching for "winlogon.exe"
C:\WINDOWS\ERDNT\cache\winlogon.exe --a---- 507904 bytes [09:44 16/09/2010] [03:22 14/04/2008] CDDB1F8E1AEA356F3AD106F2CF9B7FEA
C:\WINDOWS\ServicePackFiles\i386\winlogon.exe ------- 507904 bytes [09:09 25/01/2007] [03:22 14/04/2008] CDDB1F8E1AEA356F3AD106F2CF9B7FEA
C:\WINDOWS\system32\winlogon.exe --a---- 507904 bytes [13:49 17/08/2004] [03:22 14/04/2008] CDDB1F8E1AEA356F3AD106F2CF9B7FEA

========== regfind ==========

Searching for "winlogon"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"d"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"e"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\system32\winlogon.exe"="Windows NT Logon Application"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\winlogon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu\StartMenuLogoff\Policy\LogonType]
"RegKey"="Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot]
"Shell"="SYS:Microsoft\Windows NT\CurrentVersion\Winlogon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini]
"Winlogon"="SYS:Microsoft\Windows NT\CurrentVersion\Winlogon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/AllocateCDRoms]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/AllocateDASD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/AllocateFloppies]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/CachedLogonsCount]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/ForceUnlockLogon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/PasswordExpiryWarning]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/ScRemoveOption]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"Logon"="WinlogonLogonEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"Logoff"="WinlogonLogoffEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"ScreenSaver"="WinlogonScreenSaverEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"Startup"="WinlogonStartupEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"Shutdown"="WinlogonShutdownEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"StartShell"="WinlogonStartShellEvent"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup]
"Winlogon debug"="%WINDIR%\debug\*"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Winlogon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\BackupRestore\FilesNotToBackup]
"Winlogon debug"="%WINDIR%\debug\*"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinVNC4 WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WgaSetup WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog STI Simulator Starter Spybot - Search & Destroy 2 SpoolerCtrs Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley O&O Defrag 2000 ntbackup NeroCheck MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Microsoft (R) Visual C# 2005 Compiler McLogEvent LogMeIn LoadPerf ids
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Winlogon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\BackupRestore\FilesNotToBackup]
"Winlogon debug"="%WINDIR%\debug\*"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinVNC4 WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WgaSetup WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog STI Simulator Starter Spybot - Search & Destroy 2 SpoolerCtrs Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley O&O Defrag 2000 ntbackup NeroCheck MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Microsoft (R) Visual C# 2005 Compiler McLogEvent LogMeIn LoadPerf ids
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinVNC4 WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WgaSetup WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog STI Simulator Starter Spybot - Search & Destroy 2 SpoolerCtrs Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley O&O Defrag 2000 ntbackup NeroCheck MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Microsoft (R) Visual C# 2005 Compiler McLogEvent LogMeIn LoadPerf ids
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup]
"Winlogon debug"="%WINDIR%\debug\*"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinVNC4 WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WgaSetup WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog STI Simulator Starter Spybot - Search & Destroy 2 SpoolerCtrs Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley O&O Defrag 2000 ntbackup NeroCheck MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Microsoft (R) Visual C# 2005 Compiler McLogEvent LogMeIn LoadPerf
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\.DEFAULT\Software\ORL\VNCHooks\Application_Prefs\winlogon.exe]
[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"d"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"e"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\system32\winlogon.exe"="Windows NT Logon Application"
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\S-1-5-18\Software\ORL\VNCHooks\Application_Prefs\winlogon.exe]

Searching for "winlogon.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"d"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"e"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\system32\winlogon.exe"="Windows NT Logon Application"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\winlogon.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Autochk]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon]
"EventMessageFile"="%SystemRoot%\System32\winlogon.exe"
[HKEY_USERS\.DEFAULT\Software\ORL\VNCHooks\Application_Prefs\winlogon.exe]
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"d"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"e"="C:\WINDOWS\system32\winlogon.exe"
[HKEY_USERS\S-1-5-21-1060284298-1682526488-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\system32\winlogon.exe"="Windows NT Logon Application"
[HKEY_USERS\S-1-5-18\Software\ORL\VNCHooks\Application_Prefs\winlogon.exe]

-= EOF =-

Pokud by jste se po tomto scriptu nedostal do svého profilu, zkuste to v nouzovém režimu (po restartu mačkejte F8)

Budeme nahrazovat winlogom. Pokud by jste něčemu nerozuměl, raději se zeptejte. Budu tu večer po 9. hodině.

Z přílohy stahněte soubor v Raru, rpzbalte ho a uložte přímo na disk C tak, aby cesta k němu byla
C:\winlogon.exe


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky

ComboFix 10-09-17.04 - pajik 20.09.2010 18:08:40.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.596 [GMT 2:00]
Spuštěný z: c:\documents and settings\pajik\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\stažené\cfscript.txt
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SPAMFIGHTER_UPDATE_SERVICE
-------\Legacy_UFASOFTSNIFDRIVER4
-------\Legacy_WFIOCTL
-------\Service_SPAMfighter Update Service
-------\Service_UfasoftSnifDriver4
-------\Service_WFIOCTL


((((((((((((((((((((((((( Soubory vytvořené od 2010-08-20 do 2010-09-20 )))))))))))))))))))))))))))))))
.

2010-09-18 15:27 . 2010-09-18 15:27 -------- d-----r- C:\MSOCache
2010-09-18 08:14 . 2010-09-18 08:15 -------- d-----w- C:\rsit
2010-09-18 08:14 . 2010-09-18 08:15 -------- d-----w- c:\program files\trend micro
2010-09-16 13:30 . 2010-09-16 13:30 -------- d-----w- C:\house Zoly
2010-09-15 06:30 . 2010-09-16 07:50 -------- d--h--w- c:\windows\$hf_mig$
2010-09-15 06:24 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-09-15 06:24 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-09-14 10:01 . 2010-09-14 10:01 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-09-14 10:01 . 2010-09-14 10:01 -------- d-----w- c:\program files\Windows Live
2010-09-14 09:59 . 2010-09-14 09:59 -------- d-----w- c:\program files\Common Files\Windows Live
2010-08-31 10:44 . 2010-08-31 10:44 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-08-31 10:43 . 2010-09-14 09:49 -------- d-----w- c:\program files\Google
2010-08-31 10:43 . 2010-08-31 10:43 -------- d-----w- c:\program files\Common Files\Skype
2010-08-28 17:01 . 2008-04-14 03:21 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-08-28 17:01 . 2008-04-14 03:21 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-08-28 17:01 . 2008-04-14 02:29 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-08-28 17:01 . 2008-04-14 02:29 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-08-28 07:40 . 2010-08-28 07:40 -------- d-sh--w- c:\documents and settings\pajik\UserData
2010-08-23 14:34 . 2010-09-14 09:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-22 14:28 . 2010-08-22 14:28 -------- d-sh--w- c:\documents and settings\pajik\PrivacIE
2010-08-22 14:28 . 2010-08-22 14:28 -------- d-sh--w- c:\documents and settings\pajik\IECompatCache
2010-08-22 08:49 . 2010-08-22 08:51 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-22 08:36 . 2010-08-22 08:36 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 13:17 . 2004-08-17 13:49 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-14 09:43 . 2010-08-14 09:43 -------- d-----w- c:\program files\XXCLONE
2010-08-12 13:36 . 2006-11-13 12:10 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2010-08-12 08:25 . 2001-10-25 14:00 82372 ----a-w- c:\windows\system32\perfc005.dat
2010-08-12 08:25 . 2001-10-25 14:00 437558 ----a-w- c:\windows\system32\perfh005.dat
2010-08-10 10:17 . 2006-11-11 16:29 1243680 ----a-w- c:\windows\system32\AutoPartNt.exe
2010-08-04 12:27 . 2009-07-10 08:47 -------- d-----w- c:\program files\ESET
2010-07-22 15:46 . 2004-08-17 13:49 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:33 . 2004-08-17 13:49 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 08:00 . 2010-06-30 09:14 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-06-24 12:27 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-17 13:44 1851904 ----a-w- c:\windows\system32\win32k.sys
2006-05-03 10:06 . 2008-02-12 11:21 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2008-02-12 11:21 31232 --sh--r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-02-12 11:22 27648 --sh--w- c:\windows\system32\Smab0.dll
2008-02-04 19:26 . 2008-02-12 11:22 151040 --sh--w- c:\windows\system32\VistaUltm.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-09-19_09.37.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-09-18 15:29 . 2010-09-18 15:29 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2010-09-18 15:29 . 2010-09-18 15:29 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2010-09-18 15:29 . 2010-09-20 09:38 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2010-08-20 11:50 . 2010-08-20 11:50 5518848 c:\windows\Installer\1e15c.msp
+ 2005-10-26 12:59 . 2005-10-26 12:59 2883072 c:\windows\Installer\1e147.msp
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-19 1188456]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-17 87584]
"AcronisTimounterMonitor"="d:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-19 1962896]
"c:\windows\system32\winlogon.exe"="c:\windows\system32\winlogon.exe" [2008-04-14 507904]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-03-30 917504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TMMonitor.lnk - d:\program files\ArcSoft\TotalMedia 3\TMMonitor.exe [2010-7-4 245760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk autopartntautopartnt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\strong\\StrongDC.exe"=
"d:\\Program Files\\Miranda IM\\miranda32.exe"=
"d:\\TOTALCMD\\TOTALCMD.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\skype\\Skype.exe"=
"d:\\Program Files\\ICQ6.5\\ICQ.exe"=
"d:\\Program Files\\skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"27598:TCP"= 27598:TCP:BitComet 27598 TCP
"27598:UDP"= 27598:UDP:BitComet 27598 UDP
"8635:TCP"= 8635:TCP:BitComet 8635 TCP
"8635:UDP"= 8635:UDP:BitComet 8635 UDP

R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [10.12.2006 14:03 76373]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [10.12.2006 14:03 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [10.12.2006 14:03 10005]
S3 PAC207;VideoCAM GE111;c:\windows\system32\drivers\pfc027.sys [8.4.2005 11:46 162176]
S3 tap0901_2gm;VPN Anonymizer Adapter;c:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 17:21 30720]
.
Obsah adresáře 'Naplánované úlohy'

2007-12-15 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2004-08-17 03:22]

2010-09-20 c:\windows\Tasks\User_Feed_Synchronization-{DB840A68-7C4D-43C1-A6B8-4409DF16EDC0}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/
uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: imon.dll
TCP: {B4D0CC8B-D071-4EF4-9393-8CB0754F2390} = 10.93.0.2,10.93.0.1
DPF: {0A6112F2-F9D1-4FBF-A6EC-B67B22915873} - hxxp://foto.ihned.cz/snadno-vlozit-fotografie/ilt/ilikethisPhotoUploader2.dll
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://192.168.1.12/xplugLite.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-20 18:13
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(1184)
c:\windows\system32\relog_ap.dll
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(3520)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Eset\nod32krn.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\strong\StrongDC.exe
d:\program files\TightVNC\WinVNC.exe
.
**************************************************************************
.
Celkový čas: 2010-09-20 18:16:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-09-20 16:16
ComboFix2.txt 2010-09-19 09:39
ComboFix3.txt 2010-09-16 09:45

Před spuštěním: Volných bajtů: 44 689 551 360
Po spuštění: Volných bajtů: 44 674 764 800

- - End Of File - - 71E4477197D0767B879CFC84B064D75C








ten tools napsal,ze je to v poho,jen scan trvanl asi 18 min.

Použil jste ten winlogon na výměnu a dal ho správně na disk C? Protože výměna se neprovedla .

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
-přejmenujte ho na Cobra.com
- kdyby se nechtěl spustit, zkuste to v nouzovém režimu
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

tu je,jen druhy scan to nenabidlo
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-21 10:34:56
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\pajik\LOCALS~1\Temp\uxtdapod.sys


---- Kernel code sections - GMER 1.0.15 ----

init C:\WINDOWS\system32\drivers\ALCXSENS.SYS entry point in "init" section [0xF6231870]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat amon.sys (Amon monitor/Eset )
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

---- EOF - GMER 1.0.15 ----

to jsou všechny záložky v Gmeru?
Použil jste ten winlogon na výměnu a dal ho správně na disk C? Protože výměna se neprovedla .

Jde o to, že se Vám spouští systémový soubor z klíče, kde nemá co dělat. Soubor Vám smazat nemůžu, to by Vám nešel systém , zkouším ho vyměnit, jestli ho třeba nevyužívá nějaký rootkit.

Ještě se zeptám, máte dva disky C a D. Na obou discích máte složku Porgram files. D je na data nebo je také systémový? A tu složku Program files jste na disku D vzal kde?

to mam spis z lenosti,kazdej program nabidne instalaci do c?/program files,tak jen prepicu na d:

ten win logon nevim,na plose je.
nejde to jeste nejak?
nebo to mam spusit znova?
diky