VIRY.CZ

Dobrý den,

byl bych moc vděčný za pomoc s tímto problém.

Moji hloupostí jsem si stáhl "exáč", který jsem posléze otevřel. Od té doby mi po zapnuti OS vyskočí okno s hláškou: "Při spučtění souboru C:\Windows\system32\sshnas21.dll doslo k problemu. Uvedeny modul nebyl nalezen." Ihned jsem nainstaloval aviru personal, ale nehlásila žádny virus.

log rsit:


Logfile of random's system information tool 1.08 (written by random/random)
Run by simpancz at 2010-09-30 22:14:39
Microsoft Windows 7 Professional
System drive C: has 11 GB (24%) free of 48 GB
Total RAM: 4095 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:14:49, on 30.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Users\simpancz\AppData\Local\Temp\Wrx.exe
C:\Program Files (x86)\ATK Hotkey\HControlUser.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\Wkufya.exe
C:\Windows\WindowsMobile\WmdHost.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\QIP Infium JadrisPack\infium.exe
C:\Program Files (x86)\Java\jre6\bin\javaw.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe
C:\Program Files\trend micro\simpancz.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [HControlUser] "C:\Program Files (x86)\ATK Hotkey\HcontrolUser.exe"
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [WMUAgent.exe] C:\Program Files (x86)\WakeMeUp\WMUAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /ns
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [WMUTray.exe] C:\Program Files (x86)\WakeMeUp\WMUTray.exe
O4 - HKCU\..\Run: [Metropolis] rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
O4 - HKCU\..\Run: [3FWHZQA3LT] C:\Users\simpancz\AppData\Local\Temp\Wrx.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: CCC.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files (x86)\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: OpcEnum - Unknown owner - C:\Windows\SysWOW64\OpcEnum.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8883 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
winlogon.exe
C:\Windows\system32\svchost.exe -k LocalService
Ati2evxx.exe -Client
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SysWOW64\ZoneLabs\vsmon.exe -service
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files\ATKGFNEX\GFNEXSrv.exe"
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
"C:\Windows\WindowsMobile\wmdc.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files (x86)\RocketDock\RocketDock.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
"C:\Users\simpancz\AppData\Local\Temp\Wrx.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\ATK Hotkey\HControlUser.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files\ATKOSD2\ATKOSD2.exe"
"C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /ns
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\ATK Hotkey\Hcontrol.exe"
"C:\Program Files (x86)\ATK Hotkey\MsgTranAgt.exe"
"C:\Program Files (x86)\ATK Hotkey\MsgTranAgt64.exe"
"C:\Program Files (x86)\ASUS\Splendid\ACMON.exe"
"C:\Program Files\Wireless Console 2\wcourier.exe"
"C:\Windows\SysWOW64\ACEngSvr.exe" -Embedding
"C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
Atouch64.exe
ATKOSD.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_000009cc
taskeng.exe {1A0FE5D7-6CA1-44C4-8D3E-098EDA8EB6C2}
\??\C:\Windows\system32\conhost.exe
WDC.exe
C:\Windows\Wkufya.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-91d31e6b-abab-45ef-9fca-298645bbf57f -SystemEventPortName:HostProcess-a2dc290d-017f-47a2-a0d4-b29d3bc8da35 -IoCancelEventPortName:HostProcess-0d650e74-839a-41c9-8972-20f3ace98f66 -NonStateChangingEventPortName:HostProcess-8a8668e3-54a0-4572-bfaf-dd2ed9948fe9 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:b59e8b4b-a7c9-4246-95f7-a822c9ea8ccc
C:\Windows\System32\mobsync.exe -Embedding
C:\Windows\WindowsMobile\WmdHost.exe -Embedding
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe"
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=extension --lang=cs --force-fieldtest=DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.028EBD80.222194015 --ignored=" --type=renderer "
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=extension --lang=cs --force-fieldtest=DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.028EBC00.513541901 --ignored=" --type=renderer "
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=extension --lang=cs --force-fieldtest=DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.028EBA80.1275738360 --ignored=" --type=renderer "
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=extension --lang=cs --force-fieldtest=DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.028EB900.744114591 --ignored=" --type=renderer "
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=renderer --lang=cs --force-fieldtest=DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.0413C780.1526405377
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=plugin --plugin-path=C:\Users\simpancz\AppData\Roaming\ChromePlus\1.4.1.0\gcswf32.dll --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --lang=cs --plugin-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData\Default --channel=3476.0822D8C0.461844408
"C:\QIP Infium JadrisPack\infium.exe" /isolated /acc já /pass profil /savepass /trylogin
"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -jar -Xmx512m JDownloader.jar -rfu
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=renderer --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_3/DnsImpact/_max_2s_queue_prefetch/GlobalSdch/_global_enable_sdch/IPv6_Probe/_IPv6_probe_skipped/ --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --channel=3476.07415480.843677184
"C:\Users\simpancz\AppData\Roaming\ChromePlus\chrome.exe" --type=plugin --plugin-path=C:\Users\simpancz\AppData\Roaming\ChromePlus\1.4.1.0\gears.dll --user-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData --lang=cs --plugin-data-dir=C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData\Default --channel=3476.08F9D1C0.1492659447
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\simpancz\Desktop\hodiny.txt
taskhost.exe $(Arg0)
"C:\Users\simpancz\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-12-07 1216808]
"SMSERIAL"=C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-05-05 1702400]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 660360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Program Files (x86)\RocketDock\RocketDock.exe [2007-09-02 495616]
"WMUTray.exe"=C:\Program Files (x86)\WakeMeUp\WMUTray.exe []
"Metropolis"=C:\Windows\system32\sshnas21.dll,GetHandle []
"3FWHZQA3LT"=C:\Users\simpancz\AppData\Local\Temp\Wrx.exe [2010-09-29 248832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"HControlUser"=C:\Program Files (x86)\ATK Hotkey\HcontrolUser.exe [2008-01-11 98304]
"ATKOSD2"=C:\Program Files\ATKOSD2\ATKOSD2.exe [2008-01-23 7766016]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Media\DMEDIA.EXE [2008-02-01 61440]
"WMUAgent.exe"=C:\Program Files (x86)\WakeMeUp\WMUAgent.exe []
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe []
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"ZoneAlarm Client"=C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe [2010-05-20 1043968]

C:\Users\simpancz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
CCC.lnk - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger="C:\Windows\SysWOW64\svchost.exe

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-09-30 22:14:39 ----D---- C:\Program Files\trend micro
2010-09-30 21:47:06 ----D---- C:\rsit
2010-09-30 21:47:06 ----D---- C:\Program Files (x86)\trend micro
2010-09-30 21:38:33 ----A---- C:\Windows\SYSWOW64\vsregexp.dll
2010-09-30 21:38:32 ----A---- C:\Windows\SYSWOW64\zlcommdb.dll
2010-09-30 21:38:32 ----A---- C:\Windows\SYSWOW64\zlcomm.dll
2010-09-30 21:38:29 ----A---- C:\Windows\SYSWOW64\vswmi.dll
2010-09-30 21:38:27 ----A---- C:\Windows\SYSWOW64\zpeng25.dll
2010-09-30 21:38:27 ----A---- C:\Windows\SYSWOW64\vsxml.dll
2010-09-30 21:38:26 ----D---- C:\Windows\SYSWOW64\ZoneLabs
2010-09-30 21:38:26 ----A---- C:\Windows\SYSWOW64\vspubapi.dll
2010-09-30 21:38:26 ----A---- C:\Windows\SYSWOW64\vsmonapi.dll
2010-09-30 21:38:26 ----A---- C:\Windows\SYSWOW64\vsdata.dll
2010-09-30 21:38:26 ----A---- C:\Windows\system32\drivers\~GLH0023.TMP
2010-09-30 21:38:22 ----N---- C:\Windows\system32\drivers\vsdatant.sys
2010-09-30 21:38:21 ----D---- C:\Program Files (x86)\Zone Labs
2010-09-30 21:37:30 ----D---- C:\ProgramData\CheckPoint
2010-09-30 21:37:29 ----D---- C:\Windows\Internet Logs
2010-09-30 21:37:29 ----A---- C:\Windows\SYSWOW64\vsutil.dll
2010-09-30 21:37:29 ----A---- C:\Windows\SYSWOW64\vsinit.dll
2010-09-30 00:24:53 ----D---- C:\Windows\NI BERLIN Uninstaller
2010-09-30 00:24:53 ----A---- C:\Windows\NI BERLIN.ini
2010-09-30 00:24:53 ----A---- C:\Windows\NI BERLIN.exe
2010-09-30 00:24:06 ----D---- C:\Windows\TRAKTOR SCRATCH BLING Uninstaller
2010-09-30 00:24:06 ----A---- C:\Windows\TRAKTOR SCRATCH BLING.ini
2010-09-30 00:24:06 ----A---- C:\Windows\TRAKTOR SCRATCH BLING.exe
2010-09-30 00:22:19 ----D---- C:\Windows\TRAKTOR SCRATCH Uninstaller
2010-09-30 00:22:19 ----A---- C:\Windows\TRAKTOR SCRATCH.ini
2010-09-30 00:22:19 ----A---- C:\Windows\TRAKTOR SCRATCH.exe
2010-09-29 20:03:09 ----DC---- C:\ProgramData\{47803536-1938-4D3F-86D6-F4876B645542}
2010-09-29 18:27:39 ----D---- C:\Users\simpancz\AppData\Roaming\Avira
2010-09-29 18:26:29 ----D---- C:\ProgramData\Avira
2010-09-29 18:26:29 ----D---- C:\Program Files (x86)\Avira
2010-09-29 18:26:29 ----A---- C:\Windows\SYSWOW64\drivers\avgntmgr.sys
2010-09-29 18:26:29 ----A---- C:\Windows\SYSWOW64\drivers\avgntdd.sys
2010-09-29 18:26:29 ----A---- C:\Windows\system32\drivers\avipbb.sys
2010-09-29 18:26:29 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2010-09-29 17:35:25 ----A---- C:\Windows\Wkufya.exe
2010-09-29 17:35:14 ----A---- C:\Windows\SYSWOW64\sshnas21.dll
2010-09-29 17:22:59 ----DC---- C:\ProgramData\{BC13C66E-D01E-4443-A1D1-35EEDF3A964A}
2010-09-29 16:53:28 ----HDC---- C:\ProgramData\{C5A0D307-9319-4B00-9734-C0F4B0454A7B}
2010-09-29 16:38:11 ----HDC---- C:\ProgramData\{B5F0C192-874D-49A8-88D7-8431E3714756}
2010-09-29 14:04:02 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-09-29 14:04:02 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 14:03:39 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-09-29 14:03:39 ----A---- C:\Windows\system32\tzres.dll
2010-09-29 08:36:25 ----D---- C:\Users\simpancz\AppData\Roaming\MathWorks
2010-09-29 08:23:36 ----D---- C:\Program Files\MATLAB
2010-09-15 22:33:44 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-08 14:09:47 ----D---- C:\Program Files (x86)\Drobné účetnictví

======List of files/folders modified in the last 1 months======

2010-09-30 22:14:49 ----D---- C:\Windows\Prefetch
2010-09-30 22:14:39 ----RD---- C:\Program Files
2010-09-30 22:14:37 ----D---- C:\Windows\Temp
2010-09-30 21:54:27 ----D---- C:\Windows\system32\config
2010-09-30 21:47:06 ----RD---- C:\Program Files (x86)
2010-09-30 21:45:34 ----D---- C:\Windows\System32
2010-09-30 21:45:34 ----D---- C:\Windows\inf
2010-09-30 21:45:34 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-30 21:41:10 ----D---- C:\Windows\Tasks
2010-09-30 21:41:09 ----D---- C:\Windows\system32\Tasks
2010-09-30 21:38:33 ----D---- C:\Windows\SysWOW64
2010-09-30 21:38:32 ----D---- C:\Windows
2010-09-30 21:38:26 ----D---- C:\Windows\SYSWOW64\drivers
2010-09-30 21:38:26 ----D---- C:\Windows\system32\drivers
2010-09-30 21:38:23 ----D---- C:\Windows\system32\DriverStore
2010-09-30 21:38:23 ----D---- C:\Windows\system32\catroot
2010-09-30 21:37:30 ----HD---- C:\ProgramData
2010-09-30 20:41:41 ----D---- C:\Users\simpancz\AppData\Roaming\vlc
2010-09-30 00:41:55 ----SHD---- C:\System Volume Information
2010-09-30 00:20:43 ----SHD---- C:\Windows\Installer
2010-09-29 22:16:06 ----D---- C:\Windows\rescache
2010-09-29 18:26:24 ----D---- C:\Windows\winsxs
2010-09-29 18:24:04 ----D---- C:\Program Files (x86)\Java
2010-09-29 16:56:52 ----D---- C:\Program Files\Common Files\Native Instruments
2010-09-29 16:53:02 ----D---- C:\Program Files\Native Instruments
2010-09-29 16:53:02 ----D---- C:\Program Files (x86)\Common Files
2010-09-29 15:57:49 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2010-09-29 14:35:18 ----D---- C:\Windows\SYSWOW64\cs-CZ
2010-09-29 14:35:18 ----D---- C:\Windows\system32\cs-CZ
2010-09-29 14:03:10 ----D---- C:\Windows\system32\catroot2
2010-09-29 08:34:11 ----RSD---- C:\Windows\assembly
2010-09-28 14:57:55 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-09-27 22:31:37 ----D---- C:\Users\simpancz\AppData\Roaming\Skype
2010-09-25 03:48:29 ----A---- C:\Windows\system32\acovcnt.exe
2010-09-18 21:58:32 ----D---- C:\Users\simpancz\AppData\Roaming\dvdcss
2010-09-15 22:34:11 ----A---- C:\Windows\system32\MRT.exe
2010-09-07 23:55:54 ----D---- C:\Temp
2010-09-06 21:47:37 ----D---- C:\Users\simpancz\AppData\Roaming\uTorrent
2010-09-05 23:25:57 ----D---- C:\Program Files (x86)\uTorrent
2010-08-31 14:55:49 ----SD---- C:\Users\simpancz\AppData\Roaming\Microsoft
2010-08-31 14:55:49 ----SD---- C:\ProgramData\Microsoft
2010-08-31 01:37:02 ----D---- C:\Windows\Microsoft.NET

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2010-07-06 198944]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-02-22 834544]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-03-02 116568]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 Vsdatant;Zone Alarm Firewall Driver; C:\Windows\system32\DRIVERS\vsdatant.sys [2010-05-15 458840]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-02-16 81072]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2007-08-08 60928]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2007-07-26 55296]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2007-07-27 57856]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-03-29 4249600]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-12-03 716872]
R3 DCamUSBET;USB2.0 1.3M UVC WebCam; C:\Windows\system32\DRIVERS\etDevice64.sys [2007-09-07 530944]
R3 FiltUSBET;ET USB Device Lower Filter; C:\Windows\system32\DRIVERS\etFilter64.sys [2007-10-16 284416]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 24064]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2006-10-28 13680]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
R3 ScanUSBET;ET USB Still Image Capture Device; C:\Windows\system32\DRIVERS\etScan64.sys [2007-09-07 9216]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 109056]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-05-05 1202688]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-07 320048]
R3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 19968]
S3 61883;61883 Unit Device; C:\Windows\system32\DRIVERS\61883.sys [2009-07-14 60288]
S3 Avc;Zařízení AVC; C:\Windows\system32\DRIVERS\avc.sys [2009-07-14 48768]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 551936]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 79360]
S3 KORG_1394;KORG_1394; C:\Windows\System32\Drivers\KORG_1394_x64.sys [2008-09-19 176728]
S3 KORG_avs;KORG_avs; C:\Windows\System32\Drivers\KORG_avs_x64.sys [2008-09-19 68184]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WINUSB;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUSB.SYS [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ATK Hotkey\ASLDRSrv.exe [2007-10-02 94208]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-03-29 870400]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 vsmon;TrueVector Internet Monitor; C:\Windows\SysWOW64\ZoneLabs\vsmon.exe [2010-05-20 2437176]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-03-15 2233400]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 OpcEnum;OpcEnum; C:\Windows\SysWOW64\OpcEnum.exe []
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-18 1255736]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [2007-11-07 4466688]

-----------------EOF-----------------

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

mbam log:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4733

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2.10.2010 10:30:02
mbam-log-2010-10-02 (10-30-02).txt

Typ skenu: Úplný sken (C:\|D:\|)
Skenované objekty: 395366
Uplynulý čas: 1 hodina(y), 2 minuta(y), 35 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 5
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 7

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\3FWHZQA3LT (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe (Security.Hijack) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3fwhzqa3lt (Trojan.FakeAlert) -> No action taken.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Windows\System32\sshnas21.dll (Trojan.Downloader) -> No action taken.
C:\Users\simpancz\AppData\Local\Temp\Wrv.exe (Trojan.Downloader) -> No action taken.
C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData\Default\Cache\f_001c51 (Trojan.Downloader) -> No action taken.
C:\Windows\SysWOW64\sshnas21.dll (Trojan.Downloader) -> No action taken.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> No action taken.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
C:\Users\simpancz\AppData\Local\Temp\Wrx.exe (Trojan.FakeAlert) -> No action taken.

Vše, co MBAM nalezl, smažte.

smazáno:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4733

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2.10.2010 12:27:17
mbam-log-2010-10-02 (12-27-17).txt

Typ skenu: Úplný sken (C:\|D:\|)
Skenované objekty: 395366
Uplynulý čas: 1 hodina(y), 2 minuta(y), 35 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 5
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 7

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\3FWHZQA3LT (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe (Security.Hijack) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3fwhzqa3lt (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Windows\System32\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\simpancz\AppData\Local\Temp\Wrv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\simpancz\AppData\Roaming\ChromePlus\ChromePlusUserData\Default\Cache\f_001c51 (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\simpancz\AppData\Local\Temp\Wrx.exe (Trojan.FakeAlert) -> Delete on reboot.

Smazáno. Nastala nějaká změna?

Výborně, nyní již nic nevyskakuje, jen po probuzeni počítače ze spánku se "wifinou" už nikam nepřípojim.

Každopádně velice děkuji za pomoc!

Zkuste přeinstalovat ovladač WiFi karty. Nemáte zač!

Dobry den mam uplne ten isty problem, tu je moj vypis:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verzia databázy: 4811

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

13. 10. 2010 16:07:50
mbam-log-2010-10-13 (16-07-50).txt

Typ kontroly: Úplná kontrola (C:\|D:\|E:\|)
Objektov kontrolovaných: 253545
Uplynulý čas: 28 min, 52 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 1
Infikované registračné kľúče: 4
Infikované registračné hodnoty: 2
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 12

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
C:\Windows\SysWOW64\driver32\dmu.dll (Riskware.HideWindow) -> No action taken.

Infikované registračné kľúče:
HKEY_CURRENT_USER\SOFTWARE\KOO9RV9K4Z (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.

Infikované registračné hodnoty:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updateshield (Backdoor.IRCBot) -> No action taken.

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
C:\Windows\SysWOW64\driver32\dmu.dll (Riskware.HideWindow) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rc1.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rc4.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rc6.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rc7.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rc9.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\AppData\Local\Temp\Rcz.exe (Trojan.Downloader) -> No action taken.
C:\Users\Jakub\Desktop\Adobe Photoshop CS5 Extended CZ\Adobe.Photoshop.CS5.Extended.v12.0.Keymaker-EMBRACE.exe (Malware.Packer.Gen) -> No action taken.
C:\Windows\System32\driver32\dmu.dll (Riskware.HideWindow) -> No action taken.
D:\CALL.OF.DUTY.4\rzr-cod4.exe (Trojan.Agent.CK) -> No action taken.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> No action taken.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.



Dakujem za pomoc

Vše, co MBAM nalezl, smažte. Pokud okno nadále vyskakuje, proveďte vše podle výše uvedeného postupu. Pro příště bych prosil, abyste si založil vlastní topic. Děkuji.