VIRY.CZ

Zdravim.
po vyčišteni počitace od viru s dalsi haveti, se mi po spušteni windows objevuji dve hlášky o nenalezeni knihen clswdis.dll a pschmdrf.dll.
Vypadá to na pozustatek od viru, zkoušel sem vypnout všechny položky po s pušteni v msconfig a nepomohlo to.
Předem diky za pomoc:)

log z RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Michaela Šteffelová at 2010-11-14 09:07:51
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 123 GB (81%) free of 153 GB
Total RAM: 1015 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:08:06, on 14.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HPBTWD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Michaela Šteffelová\Plocha\RSIT.exe
C:\Program Files\trend micro\Michaela Šteffelová.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP BTW Detect Program] C:\Program Files\HP\HPBTWD.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

--
End of file - 8768 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
C:\WINDOWS\tasks\RMSchedule.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-06-02 1018616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-07-23 498744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-01-16 1418536]
"HP BTW Detect Program"=C:\Program Files\HP\HPBTWD.exe [2009-03-30 319488]
"AESTFltr"=C:\WINDOWS\system32\AESTFltr.exe [2009-07-06 737280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe [2008-02-15 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2008-02-15 135168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe [2008-02-15 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-11-13 3037696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
C:\Program Files\IDT\WDM\sttray.exe [2009-06-29 458844]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\rodina\Plocha\TmNationsForever\TmForever.exe"="C:\Documents and Settings\rodina\Plocha\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-11-13 19:42:52 ----A---- C:\WINDOWS\system32\CleanMFT32.exe
2010-11-13 19:42:44 ----D---- C:\Program Files\Common Files\PC Tools
2010-11-13 19:42:43 ----D---- C:\Program Files\Registry Mechanic
2010-11-13 19:36:34 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:35:03 ----A---- C:\WINDOWS\system32\DfSdkBt.exe
2010-11-13 18:34:48 ----D---- C:\Program Files\Ashampoo
2010-11-13 18:14:27 ----ASH---- C:\pagefile.sys
2010-11-13 16:35:09 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2010-11-13 16:35:08 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 16:35:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 16:35:03 ----D---- C:\Program Files\Spyware Terminator
2010-11-13 16:33:38 ----D---- C:\Program Files\CCleaner
2010-11-13 14:50:51 ----D---- C:\Program Files\trend micro
2010-11-13 14:50:50 ----D---- C:\rsit
2010-11-13 14:30:58 ----SHD---- C:\RECYCLER
2010-11-13 14:27:43 ----A---- C:\ComboFix.txt
2010-11-13 14:24:13 ----A---- C:\WINDOWS\system.ini
2010-11-13 13:57:21 ----A---- C:\Boot.bak
2010-11-13 13:57:15 ----RASHD---- C:\cmdcons
2010-11-13 13:48:12 ----A---- C:\WINDOWS\zip.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\SWSC.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\SWREG.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\sed.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\PEV.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\NIRCMD.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\MBR.exe
2010-11-13 13:48:12 ----A---- C:\WINDOWS\grep.exe
2010-11-13 13:48:11 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-11-13 13:02:43 ----D---- C:\Program Files\TrendMicro
2010-11-13 12:54:57 ----D---- C:\WINDOWS\ERDNT
2010-11-13 12:49:34 ----D---- C:\Qoobox
2010-11-13 11:48:22 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 11:47:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:35:09 ----D---- C:\Program Files\ESET
2010-11-12 17:31:19 ----ASH---- C:\hiberfil.sys
2010-11-07 19:00:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\TrackMania
2010-11-06 09:11:44 ----D---- C:\Program Files\Common Files\Adobe
2010-11-06 09:11:44 ----D---- C:\Program Files\Adobe
2010-11-06 09:04:04 ----A---- C:\WINDOWS\win.ini
2010-11-06 08:56:48 ----D---- C:\WINDOWS\pss
2010-11-05 23:51:46 ----D---- C:\WINDOWS\Downloaded Program Files
2010-11-05 23:39:51 ----D---- C:\WINDOWS\Registration
2010-11-05 23:23:09 ----A---- C:\WINDOWS\vmmreg32.dll
2010-11-05 23:23:09 ----A---- C:\WINDOWS\twunk_32.exe
2010-11-05 23:23:08 ----A---- C:\WINDOWS\twunk_16.exe
2010-11-05 23:23:08 ----A---- C:\WINDOWS\twain.dll
2010-11-05 23:23:07 ----A---- C:\WINDOWS\taskman.exe
2010-11-05 23:23:07 ----A---- C:\WINDOWS\notepad.exe
2010-11-05 23:23:06 ----A---- C:\WINDOWS\twain_32.dll
2010-11-05 23:22:29 ----A---- C:\WINDOWS\winhlp32.exe
2010-11-05 23:22:27 ----A---- C:\WINDOWS\hh.exe
2010-11-05 21:29:31 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\SMIIPVUE
2010-11-05 21:28:40 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\45e034
2010-11-05 19:41:11 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 19:39:10 ----A---- C:\WINDOWS\system32\wdisrvac.exe
2010-11-05 13:59:39 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-10-23 15:51:16 ----D---- C:\Program Files\Games
2010-10-18 15:02:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2279986$
2010-10-18 15:02:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2345886$
2010-10-18 15:01:55 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2010-10-18 15:01:26 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2010-10-18 15:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB981957$
2010-10-16 19:03:53 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 16:49:51 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2010-10-16 16:40:06 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 16:19:02 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 08:37:13 ----D---- C:\Program Files\Restaurace U Amálky

======List of files/folders modified in the last 1 months======

2010-11-14 09:07:58 ----D---- C:\WINDOWS\Prefetch
2010-11-14 09:02:41 ----D---- C:\WINDOWS\temp
2010-11-14 09:01:28 ----A---- C:\Documents and Settings\All Users\Data aplikací\HPWALog.txt
2010-11-14 09:01:22 ----SD---- C:\WINDOWS\Tasks
2010-11-13 20:59:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-13 20:21:59 ----SHD---- C:\WINDOWS\Installer
2010-11-13 20:21:58 ----RD---- C:\Program Files\Skype
2010-11-13 19:50:20 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-11-13 19:49:47 ----SD---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Microsoft
2010-11-13 19:42:52 ----D---- C:\WINDOWS\system32
2010-11-13 19:42:44 ----D---- C:\Program Files\Common Files
2010-11-13 19:42:43 ----RD---- C:\Program Files
2010-11-13 19:41:55 ----RASH---- C:\boot.ini
2010-11-13 19:30:31 ----D---- C:\WINDOWS\system32\config
2010-11-13 18:51:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-11-13 17:48:27 ----SHD---- C:\System Volume Information
2010-11-13 17:48:27 ----D---- C:\WINDOWS\system32\Restore
2010-11-13 17:04:26 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-13 16:41:24 ----D---- C:\WINDOWS
2010-11-13 16:35:09 ----D---- C:\WINDOWS\system32\drivers
2010-11-13 14:39:48 ----D---- C:\WINDOWS\system32\drivers\etc
2010-11-13 14:30:58 ----D---- C:\WINDOWS\Debug
2010-11-13 14:08:40 ----D---- C:\WINDOWS\AppPatch
2010-11-13 12:57:24 ----D---- C:\WINDOWS\Network Diagnostic
2010-11-13 12:51:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2010-11-13 12:35:39 ----HD---- C:\WINDOWS\inf
2010-11-13 12:26:45 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$
2010-11-12 17:23:00 ----D---- C:\Documents and Settings
2010-11-12 17:21:57 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\uTorrent
2010-11-12 17:21:57 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\Skype
2010-11-09 17:16:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-06 20:09:22 ----D---- C:\WINDOWS\SoftwareDistribution
2010-11-06 16:18:45 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\ICQ
2010-11-06 09:18:49 ----D---- C:\Program Files\Windows Media Connect 2
2010-11-06 09:12:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-11-05 21:05:33 ----D---- C:\Documents and Settings\Michaela Šteffelová\Data aplikací\skypePM
2010-11-03 20:34:13 ----D---- C:\Program Files\ICQ7.2
2010-10-23 00:07:43 ----D---- C:\Program Files\HP Games
2010-10-18 15:12:25 ----A---- C:\WINDOWS\system32\MRT.exe
2010-10-18 15:02:45 ----RSHD---- C:\WINDOWS\system32\dllcache
2010-10-16 16:58:46 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\System32\DRIVERS\iaStor.sys [2009-06-05 330264]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-05-20 45200]
R0 SahdIa32;HDD Filter Driver; C:\WINDOWS\System32\Drivers\SahdIa32.sys [2009-06-02 21488]
R0 SaibIa32;Volume Filter Driver; C:\WINDOWS\System32\Drivers\SaibIa32.sys [2009-06-02 15856]
R0 SysCow;SysCow; C:\WINDOWS\system32\drivers\syscow32x.sys [2009-07-01 103792]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-15 40192]
R1 SaibVd32;Virtual Disk Driver; C:\WINDOWS\System32\Drivers\SaibVd32.sys [2009-06-02 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2009-04-21 113664]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2009-06-02 1746432]
R3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2009-05-07 37160]
R3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2009-05-07 992424]
R3 Cam3820;Cam3820 PC Camera Driver; C:\WINDOWS\System32\Drivers\cam3820a.sys [2009-06-18 308608]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-15 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-03-31 39424]
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-06-29 1642931]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-01-16 206512]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2009-06-19 533024]
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2009-05-07 156816]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2009-05-07 47272]
S3 catchme;catchme; \??\C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-15 40320]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys [2008-11-22 160256]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
S3 Rts516xIR;Realtek IR Driver; C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBCCID;Realtek Smartcard Reader Driver; C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
S4 agpCPQ;Filtr Compaq sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]
S4 alim1541;Filtr ALI sběrnice AGP; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]
S4 amdagp;Ovladač filtru AMD portu AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]
S4 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-02 436792]
S4 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service; C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
R2 BOTService;BOTService; C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2009-05-05 349528]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-09 153376]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-08-05 583640]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-11-13 488960]
R2 STacSV;Audio Service; c:\program files\idt\wdm\STacSV.exe [2009-06-29 221266]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 PASW;Process Activation Service; C:\WINDOWS\system32\psactive.exe [2006-08-01 5120]
S2 WdiSrvHost;Wdi Service Host; C:\WINDOWS\system32\wdisrvac.exe [2006-07-11 5120]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe [2009-08-24 406016]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe [2010-06-19 246520]
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Hezké dopoledne
Kdopak Vám poradil combofix?
Poprosím o tento log
C:\ComboFix.txt

combofix mi občas pomuze,tak ho obcas taky zkusim:)

log combofix:

ComboFix 10-11-12.06 - Michaela Šteffelová 14.11.2010 10:47:41.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.680 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-14 do 2010-11-14 )))))))))))))))))))))))))))))))
.

2010-11-14 09:15 . 2010-11-14 09:14 390144 ----a-w- c:\windows\system32\CF31741.exe
2010-11-13 18:42 . 2010-08-05 07:46 37336 ----a-w- c:\windows\system32\CleanMFT32.exe
2010-11-13 18:42 . 2008-04-02 14:54 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2010-11-13 18:42 . 2008-04-02 14:53 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2010-11-13 18:42 . 2008-04-02 14:53 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2010-11-13 18:42 . 2008-09-17 20:17 658432 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2010-11-13 18:42 . 2010-11-13 18:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-11-13 18:36 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:19 . 2004-03-08 23:00 1081616 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-11-13 17:35 . 2009-08-24 21:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-11-13 17:34 . 2010-11-13 17:34 -------- d-----w- c:\program files\Ashampoo
2010-11-13 15:35 . 2010-11-13 15:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-11-13 15:35 . 2010-11-13 15:36 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-13 15:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-13 15:35 -------- d-----w- c:\program files\Spyware Terminator
2010-11-13 15:33 . 2010-11-13 15:33 -------- d-----w- c:\program files\CCleaner
2010-11-13 13:50 . 2010-11-14 08:07 -------- d-----w- c:\program files\trend micro
2010-11-13 13:50 . 2010-11-13 13:51 -------- d-----w- C:\rsit
2010-11-13 12:02 . 2010-11-13 12:02 388096 ----a-r- c:\documents and settings\Michaela Šteffelová\Data aplikací\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-11-13 12:02 . 2010-11-13 12:02 -------- d-----w- c:\program files\TrendMicro
2010-11-13 10:48 . 2010-11-13 10:48 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 10:47 . 2010-11-13 10:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:18 . 2010-11-13 09:18 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Local Settings\Data aplikací\ESET
2010-11-13 08:35 . 2010-11-13 08:35 -------- d-----w- c:\program files\ESET
2010-11-12 16:23 . 2010-11-13 18:30 -------- d-----w- c:\documents and settings\Administrator.YOUR-210CB98EE3
2010-11-07 18:00 . 2010-11-09 14:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TrackMania
2010-11-06 08:11 . 2010-11-06 08:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-11-05 22:51 . 2010-11-05 22:51 -------- d-----w- c:\windows\Downloaded Program Files
2010-11-05 22:23 . 2008-04-15 04:00 25600 ----a-w- c:\windows\twunk_32.exe
2010-11-05 22:23 . 2008-04-15 04:00 18944 ----a-w- c:\windows\vmmreg32.dll
2010-11-05 22:23 . 2008-04-15 04:00 94784 ----a-w- c:\windows\twain.dll
2010-11-05 22:23 . 2008-04-15 04:00 49680 ----a-w- c:\windows\twunk_16.exe
2010-11-05 22:23 . 2008-04-15 04:00 69632 ----a-w- c:\windows\notepad.exe
2010-11-05 22:23 . 2008-04-15 04:00 15360 ----a-w- c:\windows\taskman.exe
2010-11-05 22:23 . 2008-04-15 04:00 50688 ----a-w- c:\windows\twain_32.dll
2010-11-05 22:22 . 2008-04-15 04:00 283648 ----a-w- c:\windows\winhlp32.exe
2010-11-05 22:22 . 2008-04-15 04:00 10752 ----a-w- c:\windows\hh.exe
2010-11-05 20:29 . 2010-11-05 20:29 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\SMIIPVUE
2010-11-05 20:28 . 2010-11-05 22:09 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\45e034
2010-11-05 18:41 . 2010-11-05 18:41 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 18:39 . 2006-07-11 09:00 5120 ----a-w- c:\windows\system32\wdisrvac.exe
2010-11-05 12:59 . 2010-11-05 12:59 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-11-02 11:04 . 2010-11-02 11:30 -------- d-----w- c:\documents and settings\rodina\Data aplikací\DivX
2010-10-27 21:21 . 2010-10-27 21:21 -------- d-----w- c:\documents and settings\rodina\PrivacIE
2010-10-27 14:04 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\Conduit
2010-10-27 14:03 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\free-downloads.net
2010-10-23 14:51 . 2010-10-23 14:51 -------- d-----w- c:\program files\Games
2010-10-16 18:03 . 2010-10-16 18:03 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 15:49 . 2010-10-16 15:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-10-16 15:40 . 2010-10-16 15:40 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 15:19 . 2010-10-16 15:19 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 07:37 . 2010-10-16 07:37 -------- d-----w- c:\program files\Restaurace U Amálky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-02 12:16 . 2010-05-29 15:47 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 10:23 . 2010-09-18 10:23 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2010-10-13 15:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2010-10-13 15:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2010-10-13 15:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2010-10-13 14:26 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2010-10-13 14:26 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2010-10-13 14:26 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2010-09-01 11:52 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2010-09-01 07:57 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2010-08-27 08:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2010-08-27 05:54 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-27 01:43 5632 ------w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2010-08-26 13:39 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2010-10-13 14:56 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2010-08-17 13:17 58880 ----a-w- c:\windows\system32\spoolsv.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-11-13_13.24.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-14 09:36 . 2010-11-14 09:36 16384 c:\windows\temp\Perflib_Perfdata_2a8.dat
+ 2009-08-28 07:54 . 2010-11-13 17:51 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-09-17 05:04 . 2010-09-17 05:04 9401856 c:\windows\Installer\551f1.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43 1980416 c:\windows\Installer\551e0.msp
- 2009-08-28 07:54 . 2010-10-13 15:11 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-11-10 01:41 . 2008-11-10 01:41 2014584 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6425\PPTVIEW.EXE
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-5-5 607584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-15 21:46 159744 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-15 21:46 135168 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-15 21:46 131072 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-11-13 15:35 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-06-29 20:44 458844 ----a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\rodina\\Plocha\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:TCP"= 21:TCP:FTP
"443:TCP"= 443:TCP:HTTPS

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [28.8.2009 8:56 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [28.8.2009 8:56 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [1.7.2009 22:10 103792]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [28.8.2009 8:56 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13.11.2010 16:35 142592]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2.6.2009 18:05 457200]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [9.7.2009 3:08 199152]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.6.2010 20:22 246520]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [13.11.2010 19:42 583640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [28.8.2009 8:44 113664]
R3 Cam3820;Cam3820 PC Camera Driver;c:\windows\system32\drivers\cam3820a.sys [18.6.2009 10:36 308608]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [31.3.2009 21:11 39424]
S2 PASW;Process Activation Service;c:\windows\system32\psactive.exe [26.9.2010 14:23 5120]
S2 WdiSrvHost;Wdi Service Host;c:\windows\system32\wdisrvac.exe [5.11.2010 19:39 5120]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [13.11.2010 18:35 406016]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [28.8.2009 8:42 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.5.2010 16:47 436792]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-14 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-11-13 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2010-11-13 07:46]

2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=cs_CZ&c=94&bd=Pavilion&pf=cnnb
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:25555
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 10:59
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3512)
c:\windows\system32\btmmhook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-11-14 11:01:58
ComboFix-quarantined-files.txt 2010-11-14 10:01

Před spuštěním: Volných bajtů: 129 466 122 240
Po spuštění: Volných bajtů: 129 447 501 824

- - End Of File - - E3EAA35EAC5227059A2AEE7647F8B97C

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:TCP"= 21:TCP:FTP
"443:TCP"= 443:TCP:HTTPS

- ty porty máte povoleny schválně?



Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.


Combofix není program, který se dá jen tak používat. Občas má bugy, kdy Vám může smazat nějaký systémový soubor a už nenabootujete. Navíc nemaže automaticky vše, log se musí zkontrolovat a napsat dočišťovací skript.

s tei porty si nejsme jist... pocitac byl znacn zavirovny a nesel ani internet...a jediny viditelny pozuststky sou t vyskakujici hlasky

log z mbam:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 5111

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14.11.2010 14:43:25
mbam-log-2010-11-14 (14-43-25).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 322845
Uplynulý čas: 2 hodina(y), 38 minuta(y), 14 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\System Rollback Data\Restore\Archive\00000046\00000045\0\Target\Documents and Settings\Michaela Šteffelová\Plocha\SM45e_2204.exe (Rogue.SmartEngine) -> No action taken.

V mbamu to smažte.
Můžu Vám ty porty zavřít? Moc se mi nelíbí
Máte někde nějaký svůj web, ke kterému by mohli ty porty patřit?
Hlášky stále vyskakují?

portx klidne zavrit, nic spatnyho byto udelt nemelo snad:D
a hlasky porad stejne.
neslo by napriklad udelat na oko ty pozadovane soubory? nevim jestli by to slo,ale problem by to prinejmensim skrylo, jinak se to totiz neprojevuje

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



Otestujte na http://www.virustotal.com
c:\windows\system32\wdisrvac.exe
c:\windows\system32\drivers\syscow32x.sys


Naoko by udělat šli, ale když nevíme umístění, tak je nám to na houby. Já tu budu večer, zkusíme je dohledat v registrech.

v regitrech sme se je snazil najit a nic

comboxif log:

ComboFix 10-11-12.06 - Michaela Šteffelová 14.11.2010 19:06:39.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.639 [GMT 1:00]
Spuštěný z: c:\documents and settings\Michaela Šteffelová\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Michaela Šteffelová\Plocha\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\45e034
c:\documents and settings\All Users\Data aplikací\SMIIPVUE
c:\documents and settings\All Users\Data aplikací\SMIIPVUE\SMQRZBE.cfg

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-14 do 2010-11-14 )))))))))))))))))))))))))))))))
.

2010-11-14 11:00 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-14 11:00 . 2010-11-14 11:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-14 11:00 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-14 09:15 . 2010-11-14 09:14 390144 ----a-w- c:\windows\system32\CF31741.exe
2010-11-13 18:42 . 2010-08-05 07:46 37336 ----a-w- c:\windows\system32\CleanMFT32.exe
2010-11-13 18:42 . 2008-04-02 14:54 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2010-11-13 18:42 . 2008-04-02 14:53 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2010-11-13 18:42 . 2008-04-02 14:53 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2010-11-13 18:42 . 2008-09-17 20:17 658432 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2010-11-13 18:42 . 2010-11-13 18:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-11-13 18:36 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Registry Mechanic
2010-11-13 18:19 . 2004-03-08 23:00 1081616 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-11-13 17:35 . 2009-08-24 21:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-11-13 17:34 . 2010-11-13 17:34 -------- d-----w- c:\program files\Ashampoo
2010-11-13 15:35 . 2010-11-13 15:35 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-11-13 15:35 . 2010-11-14 18:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-14 17:30 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Spyware Terminator
2010-11-13 15:35 . 2010-11-14 17:33 -------- d-----w- c:\program files\Spyware Terminator
2010-11-13 15:33 . 2010-11-13 15:33 -------- d-----w- c:\program files\CCleaner
2010-11-13 13:50 . 2010-11-14 08:07 -------- d-----w- c:\program files\trend micro
2010-11-13 13:50 . 2010-11-13 13:51 -------- d-----w- C:\rsit
2010-11-13 12:02 . 2010-11-13 12:02 388096 ----a-r- c:\documents and settings\Michaela Šteffelová\Data aplikací\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-11-13 12:02 . 2010-11-13 12:02 -------- d-----w- c:\program files\TrendMicro
2010-11-13 10:48 . 2010-11-13 10:48 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Malwarebytes
2010-11-13 10:47 . 2010-11-13 10:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-11-13 09:18 . 2010-11-13 09:18 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Local Settings\Data aplikací\ESET
2010-11-13 08:35 . 2010-11-13 08:35 -------- d-----w- c:\program files\ESET
2010-11-12 16:23 . 2010-11-13 18:30 -------- d-----w- c:\documents and settings\Administrator.YOUR-210CB98EE3
2010-11-07 18:00 . 2010-11-09 14:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TrackMania
2010-11-06 08:11 . 2010-11-06 08:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-11-05 22:51 . 2010-11-05 22:51 -------- d-----w- c:\windows\Downloaded Program Files
2010-11-05 22:23 . 2008-04-15 04:00 25600 ----a-w- c:\windows\twunk_32.exe
2010-11-05 22:23 . 2008-04-15 04:00 18944 ----a-w- c:\windows\vmmreg32.dll
2010-11-05 22:23 . 2008-04-15 04:00 94784 ----a-w- c:\windows\twain.dll
2010-11-05 22:23 . 2008-04-15 04:00 49680 ----a-w- c:\windows\twunk_16.exe
2010-11-05 22:23 . 2008-04-15 04:00 69632 ----a-w- c:\windows\notepad.exe
2010-11-05 22:23 . 2008-04-15 04:00 15360 ----a-w- c:\windows\taskman.exe
2010-11-05 22:23 . 2008-04-15 04:00 50688 ----a-w- c:\windows\twain_32.dll
2010-11-05 22:22 . 2008-04-15 04:00 283648 ----a-w- c:\windows\winhlp32.exe
2010-11-05 22:22 . 2008-04-15 04:00 10752 ----a-w- c:\windows\hh.exe
2010-11-05 18:41 . 2010-11-05 18:41 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Pogo Games
2010-11-05 18:39 . 2006-07-11 09:00 5120 ----a-w- c:\windows\system32\wdisrvac.exe
2010-11-05 12:59 . 2010-11-05 12:59 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Casual Mechanics
2010-11-02 11:04 . 2010-11-02 11:30 -------- d-----w- c:\documents and settings\rodina\Data aplikací\DivX
2010-10-27 21:21 . 2010-10-27 21:21 -------- d-----w- c:\documents and settings\rodina\PrivacIE
2010-10-27 14:04 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\Conduit
2010-10-27 14:03 . 2010-10-27 14:04 -------- d-----w- c:\documents and settings\rodina\Local Settings\Data aplikací\free-downloads.net
2010-10-23 14:51 . 2010-10-23 14:51 -------- d-----w- c:\program files\Games
2010-10-16 18:03 . 2010-10-16 18:03 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Sahmon Games
2010-10-16 15:49 . 2010-10-16 15:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-10-16 15:40 . 2010-10-16 15:40 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Leadertech
2010-10-16 15:19 . 2010-10-16 15:19 -------- d-----w- c:\documents and settings\Michaela Šteffelová\Data aplikací\Atari
2010-10-16 07:37 . 2010-10-16 07:37 -------- d-----w- c:\program files\Restaurace U Amálky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-02 12:16 . 2010-05-29 15:47 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 10:23 . 2010-09-18 10:23 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2010-10-13 15:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2010-10-13 15:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2010-10-13 15:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2010-10-13 14:26 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2010-10-13 14:26 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2010-10-13 14:26 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2010-09-01 11:52 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2010-09-01 07:57 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2010-08-27 08:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2010-08-27 05:54 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-27 01:43 5632 ------w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2010-08-26 13:39 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2010-10-13 14:56 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2010-08-17 13:17 58880 ----a-w- c:\windows\system32\spoolsv.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-11-13_13.24.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-14 17:35 . 2010-11-14 17:35 16384 c:\windows\temp\Perflib_Perfdata_284.dat
+ 2009-08-28 07:54 . 2010-11-13 17:51 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2009-08-28 07:54 . 2010-10-13 15:11 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-09-17 05:04 . 2010-09-17 05:04 9401856 c:\windows\Installer\551f1.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43 1980416 c:\windows\Installer\551e0.msp
- 2009-08-28 07:54 . 2010-10-13 15:11 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-28 07:54 . 2010-11-13 17:51 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-11-10 01:41 . 2008-11-10 01:41 2014584 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6425\PPTVIEW.EXE
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-11-13 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-5-5 607584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-15 21:46 159744 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-15 21:46 135168 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-15 21:46 131072 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-11-13 15:35 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-06-29 20:44 458844 ----a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\rodina\\Plocha\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [28.8.2009 8:56 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [28.8.2009 8:56 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [1.7.2009 22:10 103792]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [28.8.2009 8:56 25584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13.11.2010 16:35 142592]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2.6.2009 18:05 457200]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [9.7.2009 3:08 199152]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.6.2010 20:22 246520]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [13.11.2010 19:42 583640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [28.8.2009 8:44 113664]
R3 Cam3820;Cam3820 PC Camera Driver;c:\windows\system32\drivers\cam3820a.sys [18.6.2009 10:36 308608]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [31.3.2009 21:11 39424]
S2 PASW;Process Activation Service;c:\windows\system32\psactive.exe [26.9.2010 14:23 5120]
S2 WdiSrvHost;Wdi Service Host;c:\windows\system32\wdisrvac.exe [5.11.2010 19:39 5120]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [13.11.2010 18:35 406016]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [28.8.2009 8:42 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.5.2010 16:47 436792]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-14 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-11-14 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2010-11-13 07:46]

2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{95611A5D-E4E6-45A7-B69B-0EF7464D1FF9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:25555
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 19:18
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-11-14 19:21:32
ComboFix-quarantined-files.txt 2010-11-14 18:21
ComboFix2.txt 2010-11-14 10:01

Před spuštěním: Volných bajtů: 129 264 037 888
Po spuštění: Volných bajtů: 129 244 459 008

- - End Of File - - 635CDA67A2BFA6894AF2260C08B5AF75





File name: wdisrvac.exe
Submission date: 2010-11-14 18:26:51 (UTC)
Current status: queued (#3) queued (#3) analysing finished


Result: 10/ 43 (23.3%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.15.00 2010.11.14 Win-Trojan/Agent.8192.Z
Emsisoft 5.0.0.50 2010.11.14 Win32.SuspectCrc!IK
Ikarus T3.1.1.90.0 2010.11.14 Win32.SuspectCrc
Jiangmin 13.0.900 2010.11.14 TrojanDropper.Microjoin.anl
K7AntiVirus 9.67.2973 2010.11.12 Trojan
McAfee 5.400.0.1158 2010.11.14 Artemis!8D470776C368
McAfee-GW-Edition 2010.1C 2010.11.14 Heuristic.BehavesLike.Win32.Suspicious.H
nProtect 2010-11-14.01 2010.11.14 Trojan/W32.Agent.5120.CU
Prevx 3.0 2010.11.14 Medium Risk Malware
VBA32 3.12.14.2 2010.11.12 Trojan-Dropper.Win32.Microjoin.hfg

-prvni soubor sem smazal a jenda hlaska o chybejici knihovne zmizela... zustava pschmdrf.dll
a na druhy soubor to nic nenaslo

Já ho smažu znovu přes combofix, má tak ještě funkční driver, tak ať je smazaný komplet, a pak se uvidí.


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci