VIRY.CZ

Logfile of random's system information tool 1.06 (written by random/random)
Run by Tom at 2010-11-16 12:51:06
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 6 GB (28%) free of 20 GB
Total RAM: 1023 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51:11, on 16.11.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Icons\SetIcon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
D:\Programy\PowerDVD\PDVDServ.exe
D:\Programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
C:\Program Files\Trust\305KS\Mouse\mouse32a.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\hoofyw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\OSCAR Editor\OscarEditor.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\Programy\AverTV\QuickTV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\OSCAR Editor\OscarData\Tools\MyShowMessage.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RapidBIT\cidaemon.exe
C:\DOCUME~1\Tom\LOCALS~1\Temp\887920.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\RapidBIT\iedw.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Tom\Plocha\Antivir\RSIT.exe
D:\hijackthis\Tom.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\SetIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] D:\Programy\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [FLMBROWSEMOUSE] C:\Program Files\Trust\305KS\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [gudev] C:\WINDOWS\system32\hoofyw.exe
O4 - HKLM\..\RunServices: [gudev] C:\WINDOWS\system32\hoofyw.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files\OSCAR Editor\OscarEditor.exe" Minimum
O4 - HKCU\..\Run: [MSConfig] C:\Documents and Settings\Tom\emxg.exe \u
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: 0di81uf.exe
O4 - Startup: 1u9qvwr.exe
O4 - Startup: 2rmm6yy.exe
O4 - Startup: 6q8mwnn.exe
O4 - Startup: 7091a9w.exe
O4 - Startup: 9y1p70l.exe
O4 - Startup: a1qrcxxy.exe
O4 - Startup: a70bxss6e.exe
O4 - Startup: abg81sdezp.exe
O4 - Startup: bg81sdezpq.exe
O4 - Startup: bxnnoo6a.exe
O4 - Startup: de1u2vrhs5.exe
O4 - Startup: dj60lghm.exe
O4 - Startup: e97081whit.exe
O4 - Startup: faa6w81yt.exe
O4 - Startup: g9c1yuk0gg.exe
O4 - Startup: hdyzuu6gg6.exe
O4 - Startup: j981gwcs.exe
O4 - Startup: k1abg870.exe
O4 - Startup: lbh60jpz.exe
O4 - Startup: n2zuu6gg.exe
O4 - Startup: n6jo86a8.exe
O4 - Startup: p0vrmm6yy.exe
O4 - Startup: pggbssneezq.exe
O4 - Startup: q0xsi0zu.exe
O4 - Startup: rhhd2zuu.exe
O4 - Startup: s1opu81g9n.exe
O4 - Startup: s3ezf3wrhy.exe
O4 - Startup: tpffbrc5y6.exe
O4 - Startup: w1soojaa.exe
O4 - Startup: ww6ii6uu6.exe
O4 - Startup: z1ka1wm0iy.exe
O4 - Startup: zvllhhdd5z.exe
O4 - Startup: zvllhhdd9e.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: QuickTV.lnk = D:\Programy\AverTV\QuickTV.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Asset Management Daemon (azo9xayjhoem) - Unknown owner - C:\WINDOWS\system32\zyloucook.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Remote Connections Service (FlexService) - BitMicro Software Corporation - C:\Program Files\RapidBIT\cisvc.exe
O23 - Service: Služba Google Update (gupdate1c9aa3ffc762012) (gupdate1c9aa3ffc762012) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj7600 - Unknown owner - C:\DOCUME~1\Tom\LOCALS~1\Temp\hpdj7600.exe (file missing)
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Tom/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 11640 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Norton Security Scan for Tom.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Program Files\Orbitdownloader\orbitcth.dll [2010-05-07 240912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-28 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-21 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} - Grab Pro - C:\Program Files\Orbitdownloader\GrabPro.dll [2010-05-07 666816]

{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-03-28 1017592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"nwiz"=nwiz.exe /install []
"SetIcon"=C:\Program Files\Icons\SetIcon.exe [2002-08-22 39936]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-10-08 57344]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2002-09-25 87751]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"RemoteControl"=D:\Programy\PowerDVD\PDVDServ.exe [2003-10-31 32768]
"PCSuiteTrayApplication"=D:\Programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-06-18 271360]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-28 136600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-07-25 188416]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunesHelper.exe [2009-09-21 305440]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"FLMBROWSEMOUSE"=C:\Program Files\Trust\305KS\Mouse\mouse32a.exe [2010-04-04 360448]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]
"gudev"=C:\WINDOWS\system32\hoofyw.exe [2010-11-13 201216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-03-21 39408]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"OscarEditor"=C:\Program Files\OSCAR Editor\OscarEditor.exe [2008-07-30 2865152]
"MSConfig"=C:\Documents and Settings\Tom\emxg.exe [2010-11-15 19456]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
QuickTV.lnk - D:\Programy\AverTV\QuickTV.exe

C:\Documents and Settings\Tom\Nabídka Start\Programy\Po spuštění
0di81uf.exe
1u9qvwr.exe
2rmm6yy.exe
6q8mwnn.exe
7091a9w.exe
9y1p70l.exe
a1qrcxxy.exe
a70bxss6e.exe
abg81sdezp.exe
bg81sdezpq.exe
bxnnoo6a.exe
de1u2vrhs5.exe
dj60lghm.exe
e97081whit.exe
faa6w81yt.exe
g9c1yuk0gg.exe
hdyzuu6gg6.exe
j981gwcs.exe
k1abg870.exe
lbh60jpz.exe
n2zuu6gg.exe
n6jo86a8.exe
p0vrmm6yy.exe
pggbssneezq.exe
q0xsi0zu.exe
rhhd2zuu.exe
s1opu81g9n.exe
s3ezf3wrhy.exe
tpffbrc5y6.exe
w1soojaa.exe
ww6ii6uu6.exe
z1ka1wm0iy.exe
zvllhhdd5z.exe
zvllhhdd9e.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hoabgdnx]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hrjcznoa]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\htgslnoi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\kncdxory]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pyrntnrs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uggvftve]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hoabgdnx]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hrjcznoa]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\htgslnoi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\kncdxory]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\pyrntnrs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uggvftve]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Hry\Valve\hl.exe"="D:\Hry\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Programy\uTorrent\uTorrent.exe"="D:\Programy\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\pinacle\Programs\RM.exe"="D:\Program Files\pinacle\Programs\RM.exe:*:Enabled:Render Manager"
"D:\Program Files\pinacle\Programs\PMSRegisterFile.exe"="D:\Program Files\pinacle\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"D:\Program Files\pinacle\Programs\umi.exe"="D:\Program Files\pinacle\Programs\umi.exe:*:Enabled:umi"
"D:\Program Files\pinacle\Programs\VideoSpin.exe"="D:\Program Files\pinacle\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes.exe"="C:\Program Files\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Orbitdownloader\orbitdm.exe"="C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Program Files\Orbitdownloader\orbitnet.exe"="C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"Z:\Pinnacle 14\Programs\RM.exe"="Z:\Pinnacle 14\Programs\RM.exe:*:Enabled:Render Manager"
"Z:\Pinnacle 14\Programs\Studio.exe"="Z:\Pinnacle 14\Programs\Studio.exe:*:Enabled:Studio"
"Z:\Pinnacle 14\Programs\umi.exe"="Z:\Pinnacle 14\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"Z:\P17535732.JPG-www.facebook.exe"="C:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"Z:\ArchiCAD 14\ArchiCAD 14\ArchiCAD.exe"="Z:\ArchiCAD 14\ArchiCAD 14\ArchiCAD.exe:*:Disabled:ArchiCAD 14.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-11-13 20:07:36 ----D---- C:\Documents and Settings\Tom\Data aplikací\Help
2010-11-13 19:19:26 ----RSHD---- C:\RECYCLER
2010-11-13 19:02:54 ----A---- C:\ComboFix.txt
2010-11-13 18:57:11 ----A---- C:\WINDOWS\VFIND.exe
2010-11-13 18:57:11 ----A---- C:\WINDOWS\fdsv.exe
2010-11-13 18:56:56 ----D---- C:\Qoobox
2010-11-13 17:54:56 ----A---- C:\WINDOWS\system32\zyloucook.exe
2010-11-13 17:54:38 ----A---- C:\WINDOWS\system32\hoofyw.exe
2010-11-13 17:53:34 ----RSH---- C:\Documents and Settings\Tom\Data aplikací\juzjf.exe
2010-11-13 17:53:01 ----A---- C:\t6.exe
2010-11-10 12:47:06 ----A---- C:\jshd.exe
2010-11-09 18:36:03 ----D---- C:\Documents and Settings\Tom\Data aplikací\Graphisoft
2010-11-09 17:54:18 ----AD---- C:\Program Files\Common Files\Graphisoft Shared
2010-10-23 16:45:36 ----D---- C:\Documents and Settings\Tom\Data aplikací\DivX
2010-10-17 16:58:15 ----D---- C:\Program Files\Norton Security Scan
2010-10-17 16:58:12 ----D---- C:\Program Files\NortonInstaller
2010-10-17 13:58:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\DivX

======List of files/folders modified in the last 1 months======

2010-11-16 12:47:33 ----D---- C:\WINDOWS\system32\drivers
2010-11-16 12:47:09 ----AD---- C:\WINDOWS\Temp
2010-11-16 12:34:43 ----D---- C:\WINDOWS\system32
2010-11-16 12:34:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-16 12:31:15 ----A---- C:\WINDOWS\AVerTV.ini
2010-11-16 12:30:42 ----SD---- C:\WINDOWS\Tasks
2010-11-16 00:26:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-15 23:12:04 ----D---- C:\Program Files\Mozilla Firefox
2010-11-15 20:39:22 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-15 19:58:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google Updater
2010-11-14 23:21:04 ----D---- C:\Documents and Settings\Tom\Data aplikací\uTorrent
2010-11-14 23:15:56 ----D---- C:\Documents and Settings\Tom\Data aplikací\vlc
2010-11-14 20:49:16 ----D---- C:\WINDOWS
2010-11-14 20:48:51 ----SHD---- C:\WINDOWS\Installer
2010-11-14 20:48:09 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-11-13 19:58:36 ----RD---- C:\Program Files
2010-11-13 19:01:39 ----A---- C:\WINDOWS\system.ini
2010-11-13 18:56:53 ----D---- C:\WINDOWS\Prefetch
2010-11-09 17:54:18 ----D---- C:\Program Files\Common Files
2010-10-24 19:57:36 ----D---- C:\downloads
2010-10-17 16:58:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2010-10-17 13:59:41 ----D---- C:\Program Files\Common Files\DivX Shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-06-28 28880]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2009-01-08 82380]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-06-28 46672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-06-28 100176]
R3 AgereSoftModem;Microcom InPorte Home; C:\WINDOWS\System32\DRIVERS\AGRSM.sys [2002-09-25 1141248]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-10-04 391552]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-10-09 475788]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-06-28 23376]
R3 Cap7134;AVerMedia, AVerTV WDM Video Capture (Silicon); C:\WINDOWS\System32\DRIVERS\Cap7134.sys [2008-12-24 407072]
R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2007-01-04 171520]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-01-09 47360]
R3 PhTVTune;Cap7134 TVTuner; C:\WINDOWS\System32\DRIVERS\PhTVTune.sys [2008-12-24 57152]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 knof5b0;knof5b0; C:\WINDOWS\System32\drivers\knof5b0.sys [2010-11-16 138272]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys [2003-07-17 46167]
S2 pyrntnrs;pyrntnrs; C:\WINDOWS\system32\drivers\pyrntnrs.sys [2010-11-16 82944]
S3 a873cexj;a873cexj; C:\WINDOWS\system32\drivers\a873cexj.sys []
S3 adiusbaw;USB ADSL WAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbaw.sys [2003-03-27 127145]
S3 axutyd8l;axutyd8l; C:\WINDOWS\system32\drivers\axutyd8l.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 fbtzvgon;fbtzvgon; \??\C:\WINDOWS\System32\Drivers\fbtzvgon.sys []
S3 fbugkxgp;fbugkxgp; \??\C:\WINDOWS\System32\Drivers\fbugkxgp.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [2005-07-08 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [2005-07-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [2005-07-08 21744]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 vcwqoklu;vcwqoklu; \??\C:\WINDOWS\System32\Drivers\vcwqoklu.sys []
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 zyfvafow;zyfvafow; \??\C:\WINDOWS\System32\Drivers\zyfvafow.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-03-28 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-28 152984]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\System32\wdfmgr.exe [2005-01-28 38912]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-09-21 545568]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
S2 azo9xayjhoem;Asset Management Daemon; C:\WINDOWS\system32\zyloucook.exe [2010-11-13 201216]
S2 FlexService;Remote Connections Service; C:\Program Files\RapidBIT\cisvc.exe [2009-05-17 41984]
S2 gupdate1c9aa3ffc762012;Služba Google Update (gupdate1c9aa3ffc762012); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-21 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-21 183280]
S2 hpdj7600;hpdj7600; C:\DOCUME~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 []
S2 PCLEPCI;PCLEPCI; C:\WINDOWS\system32\drivers\pclepci.sys [2005-02-09 14165]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-01-22 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\HPZipm12.exe [2004-03-18 65536]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

A teď se k tomu přidalo i to že se počítač sám vypnul a od té doby, když ho zapnu sám se o 1 minuty vypne a zobrazí hlášku "Vypnutí vyvolal NT AUTHORITY\SYSTEM"

Zdravím,

při restartu se dostaň do Nouzového režimu s prací v síti (F8)

Odinstaluj starý ComboFix takto:
Start -> Spustit... - zkopíruj ComboFix /uninstall -> OK

Stáhni Rkill z jednoho z odkazů na plochu, pokud by ho vir blokoval, zkus stáhnout jiný

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr

Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

-spusť a nechej ho pracovat. Sám se ukončí.

- Teď nesmíš restartovat počítač!

Stáhni ComboFix zde: http://www.bleepingcomputer.com/downloa ... s/combofix
Ulož ho přejmenovaný jako "zmije.com" na plochu

návod na použití: http://www.bleepingcomputer.com/combofi ... t-combofix

spustit zmije.com - log sem zkopíruj

dík za pomoc, log tady:



ComboFix 10-11-15.06 - Tom 16.11.2010 15:57:47.8.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.729 [GMT 1:00]
Spuštěný z: c:\documents and settings\Tom\Plocha\zmije.com
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Tom\Local Settings\Data aplikací\DoubleD
c:\documents and settings\Tom\Recent\-=[SUMOTorrent.pif
c:\documents and settings\Tom\secupdat.dat
c:\windows\System32\drivers\knof5b0.sys
c:\windows\system32\secupdat.dat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_knof5b0
-------\Service_knof5b0


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-16 do 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 13:53 . 2010-11-16 14:08 -------- d-----w- C:\zmije
2010-11-16 13:38 . 2010-11-16 13:53 -------- d-----w- C:\ComboFix
2010-11-16 13:38 . 2010-11-16 13:38 389632 ----a-w- c:\windows\system32\CF25096.exe
2010-11-16 13:01 . 2010-11-16 13:01 40128 ----a-w- c:\windows\system32\drivers\csdcpova.sys
2010-11-16 12:06 . 2010-11-16 12:06 82944 ----a-w- c:\windows\system32\drivers\zjobscwh.sys
2010-11-16 11:36 . 2010-11-16 11:36 0 ----a-w- c:\windows\system32\drivers\arxcijri.sys
2010-11-14 19:48 . 2010-11-14 19:48 22016 ----a-r- c:\documents and settings\Tom\Data aplikací\Microsoft\Installer\{2EE90F26-20B3-4423-81DE-E57E5D2E4FEF}\Icon2EE90F261.exe
2010-11-13 19:07 . 2010-11-13 19:07 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Help
2010-11-13 16:53 . 2010-11-13 16:53 91136 --sh--r- c:\documents and settings\Tom\Data aplikací\juzjf.exe
2010-11-10 11:47 . 2010-11-10 12:13 257 ----a-w- C:\jshd.exe
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Data aplikací\Graphisoft
2010-11-09 16:54 . 2010-11-09 16:54 -------- d---a-w- c:\program files\Common Files\Graphisoft Shared
2010-10-23 15:45 . 2010-10-23 15:45 -------- d-----w- c:\documents and settings\Tom\Data aplikací\DivX
2010-10-17 15:58 . 2010-10-17 15:58 -------- d-----w- c:\windows\system32\drivers\NSS
2010-10-17 15:58 . 2010-10-17 15:58 -------- d-----w- c:\program files\Norton Security Scan
2010-10-17 15:58 . 2010-10-17 15:58 -------- d-----w- c:\program files\NortonInstaller

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 14:36 . 2009-09-21 14:36 294688 ----a-w- c:\program files\iTunesOutlookAddIn.dll
2009-09-21 14:36 . 2009-09-21 14:36 292128 ----a-w- c:\program files\iTunesPhotoProcessor.exe
2009-09-21 14:36 . 2009-09-21 14:36 384800 ----a-w- c:\program files\iTunesAdmin.dll
2009-09-21 14:36 . 2009-09-21 14:36 305440 ----a-w- c:\program files\iTunesHelper.exe
2009-09-21 14:36 . 2009-09-21 14:36 124192 ----a-w- c:\program files\iTunesMiniPlayer.dll
2009-09-21 14:36 . 2009-09-21 14:36 10309408 ----a-w- c:\program files\iTunes.exe
2009-09-21 14:36 . 2009-09-21 14:36 14691112 ----a-w- c:\program files\iTunes.dll
2009-09-21 14:36 . 2009-09-21 14:36 722160 ----a-w- c:\program files\CDDBControlApple.dll
2009-09-21 14:36 . 2009-09-21 14:36 648480 ----a-w- c:\program files\iPodUpdaterExt.dll
2009-09-21 14:36 . 2009-09-21 14:36 111912 ----a-w- c:\program files\ITDetector.ocx
.

------- Sigcheck -------

[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 20:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-21 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"OscarEditor"="c:\program files\OSCAR Editor\OscarEditor.exe" [2008-07-30 2865152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"SetIcon"="c:\program files\Icons\SetIcon.exe" [2002-08-22 39936]
"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]
"AGRSMMSG"="AGRSMMSG.exe" [2002-09-25 87751]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="d:\programy\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PCSuiteTrayApplication"="d:\programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-25 188416]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunesHelper.exe" [2009-09-21 305440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"FLMBROWSEMOUSE"="c:\program files\Trust\305KS\Mouse\mouse32a.exe" [2010-04-04 360448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="d:\programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-7-2 966756]
QuickTV.lnk - d:\programy\AverTV\QuickTV.exe [2005-10-30 393216]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Hry\\Valve\\hl.exe"=
"d:\\Programy\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\pinacle\\Programs\\RM.exe"=
"d:\\Program Files\\pinacle\\Programs\\PMSRegisterFile.exe"=
"d:\\Program Files\\pinacle\\Programs\\umi.exe"=
"d:\\Program Files\\pinacle\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"z:\\Pinnacle 14\\Programs\\RM.exe"=
"z:\\Pinnacle 14\\Programs\\Studio.exe"=
"z:\\Pinnacle 14\\Programs\\umi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"z:\\P17535732.JPG-www.facebook.exe"= c:\\WINDOWS\\nvsvc32.exe
"z:\\ArchiCAD 14\\ArchiCAD 14\\ArchiCAD.exe"=

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [24.12.2008 14:51 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [24.12.2008 14:51 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.1.2010 20:29 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [25.5.2009 12:30 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25.5.2009 12:30 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [22.7.2010 19:42 246520]
R3 PhTVTune;Cap7134 TVTuner;c:\windows\system32\drivers\PhTVTune.sys [24.12.2008 12:28 57152]
S2 azo9xayjhoem;Asset Management Daemon;c:\windows\system32\zyloucook.exe --> c:\windows\system32\zyloucook.exe [?]
S2 FlexService;Remote Connections Service;c:\program files\RapidBIT\cisvc.exe [17.5.2009 5:16 41984]
S2 gupdate1c9aa3ffc762012;Služba Google Update (gupdate1c9aa3ffc762012);c:\program files\Google\Update\GoogleUpdate.exe [21.3.2009 17:13 133104]
S2 hpdj7600;hpdj7600;c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 --> c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 [?]
S2 zjobscwh;zjobscwh;c:\windows\system32\drivers\zjobscwh.sys [16.11.2010 13:06 82944]
S3 fbtzvgon;fbtzvgon;\??\c:\windows\System32\Drivers\fbtzvgon.sys --> c:\windows\System32\Drivers\fbtzvgon.sys [?]
S3 fbugkxgp;fbugkxgp;\??\c:\windows\System32\Drivers\fbugkxgp.sys --> c:\windows\System32\Drivers\fbugkxgp.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26.1.2010 21:32 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26.1.2010 21:32 8320]
S3 vcwqoklu;vcwqoklu;\??\c:\windows\System32\Drivers\vcwqoklu.sys --> c:\windows\System32\Drivers\vcwqoklu.sys [?]
S3 zgvedtpx;zgvedtpx;\??\c:\windows\System32\Drivers\zgvedtpx.sys --> c:\windows\System32\Drivers\zgvedtpx.sys [?]
S3 zyfvafow;zyfvafow;\??\c:\windows\System32\Drivers\zyfvafow.sys --> c:\windows\System32\Drivers\zyfvafow.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-21 16:12]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-13 c:\windows\Tasks\Norton Security Scan for Tom.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-17 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - prefs.js: network.proxy.http - 203.153.227.201
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Plugins\npitunes.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-gudev - c:\windows\system32\hoofyw.exe
SafeBoot-hoabgdnx
SafeBoot-hrjcznoa
SafeBoot-htgslnoi
SafeBoot-kncdxory
SafeBoot-pyrntnrs
SafeBoot-rochpkur
SafeBoot-uggvftve
SafeBoot-vjbgxoqg
SafeBoot-zjobscwh
AddRemove-Flashpoint - c:\program files\Codemasters\UnInstall.exe
AddRemove-WhenUSearch - c:\program files\DAEMON Tools SearchBar\Uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 16:05
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1993962763-602162358-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:42,3e,62,c7,ae,52,65,41,79,06,7f,a8,18,de,50,9f,63,5f,d3,35,d5,9a,81,
94,14,2a,17,69,06,5b,68,75,d5,3b,9a,87,c5,0c,11,d9,65,53,82,64,bd,dd,af,4a,\
"??"=hex:a0,05,d9,48,67,37,eb,54,bc,08,47,13,47,51,f0,cb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(4980)
c:\program files\Trust\305KS\Mouse\MOUDL32A.DLL
c:\windows\system32\msi.dll
c:\windows\system32\browselc.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
z:\archicad 14\ArchiCAD 14\GSShellX32.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\AGRSMMSG.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\OSCAR Editor\OscarData\Tools\MyShowMessage.exe
c:\program files\RapidBIT\cidaemon.exe
.
**************************************************************************
.
Celkový čas: 2010-11-16 16:09:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-16 15:09
ComboFix2.txt 2010-11-13 18:02

Před spuštěním: 7 925 493 760
Po spuštění: 7 850 442 752

- - End Of File - - 3A0D5B5BF04D4BB0A99568B9FF48E408

Co je oddíl Z: - zapoj všechny flešky, ext. disky apod.

Otevři Poznámkový blok (Notepad) a zkopíruj celý zelený text z "CFscriptu".
Soubor ulož na plochu jako CFscript.txt a jeho ikonu přetáhni myší nad ikonu zmije.com - tam pusť.

ComboFix se spustí - počkej na log a vlož ho sem.

Zkus to v normálním režimu - při problémech v nouzovém

ty máš připojení v Brisbane, Australia (network.proxy.http - 203.153.227.201)

Oddíl Z je polovina jednoho z mých 2 HDD
Připojení přes proxy server v Austrálii jsem měl nastavený jako vedlejší ve firefoxu kvůli megavideu


Tady je log:



ComboFix 10-11-15.06 - Tom 16.11.2010 20:11:36.9.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.738 [GMT 1:00]
Spuštěný z: c:\documents and settings\Tom\Plocha\zmije.com
Použité ovládací přepínače :: c:\docume~1\Tom\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\Tom\Data aplikací\juzjf.exe"
"c:\documents and settings\Tom\Data aplikací\Microsoft\Installer\{2EE90F26-20B3-4423-81DE-E57E5D2E4FEF}\Icon2EE90F261.exe"
"C:\jshd.exe"
"c:\windows\nvsvc32.exe"
"z:\P17535732.JPG"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\jshd.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AZO9XAYJHOEM
-------\Legacy_ZJOBSCWH
-------\Service_azo9xayjhoem
-------\Service_fbtzvgon
-------\Service_fbugkxgp
-------\Service_vcwqoklu
-------\Service_zgvedtpx
-------\Service_zjobscwh
-------\Service_zyfvafow


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-16 do 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 13:53 . 2010-11-16 14:08 -------- d-----w- C:\zmije
2010-11-16 13:38 . 2010-11-16 13:53 -------- d-----w- C:\ComboFix
2010-11-16 13:38 . 2010-11-16 13:38 389632 ----a-w- c:\windows\system32\CF25096.exe
2010-11-16 13:01 . 2010-11-16 13:01 40128 ----a-w- c:\windows\system32\drivers\csdcpova.sys
2010-11-16 12:06 . 2010-11-16 12:06 82944 ----a-w- c:\windows\system32\drivers\zjobscwh.sys
2010-11-16 11:36 . 2010-11-16 11:36 0 ----a-w- c:\windows\system32\drivers\arxcijri.sys
2010-11-14 19:48 . 2010-11-14 19:48 22016 ----a-r- c:\documents and settings\Tom\Data aplikací\Microsoft\Installer\{2EE90F26-20B3-4423-81DE-E57E5D2E4FEF}\Icon2EE90F261.exe
2010-11-13 19:07 . 2010-11-13 19:07 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Help
2010-11-13 16:53 . 2010-11-13 16:53 91136 --sh--r- c:\documents and settings\Tom\Data aplikací\juzjf.exe
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Data aplikací\Graphisoft
2010-11-09 16:54 . 2010-11-09 16:54 -------- d---a-w- c:\program files\Common Files\Graphisoft Shared
2010-10-23 15:45 . 2010-10-23 15:45 -------- d-----w- c:\documents and settings\Tom\Data aplikací\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 14:36 . 2009-09-21 14:36 294688 ----a-w- c:\program files\iTunesOutlookAddIn.dll
2009-09-21 14:36 . 2009-09-21 14:36 292128 ----a-w- c:\program files\iTunesPhotoProcessor.exe
2009-09-21 14:36 . 2009-09-21 14:36 384800 ----a-w- c:\program files\iTunesAdmin.dll
2009-09-21 14:36 . 2009-09-21 14:36 305440 ----a-w- c:\program files\iTunesHelper.exe
2009-09-21 14:36 . 2009-09-21 14:36 124192 ----a-w- c:\program files\iTunesMiniPlayer.dll
2009-09-21 14:36 . 2009-09-21 14:36 10309408 ----a-w- c:\program files\iTunes.exe
2009-09-21 14:36 . 2009-09-21 14:36 14691112 ----a-w- c:\program files\iTunes.dll
2009-09-21 14:36 . 2009-09-21 14:36 722160 ----a-w- c:\program files\CDDBControlApple.dll
2009-09-21 14:36 . 2009-09-21 14:36 648480 ----a-w- c:\program files\iPodUpdaterExt.dll
2009-09-21 14:36 . 2009-09-21 14:36 111912 ----a-w- c:\program files\ITDetector.ocx
.

------- Sigcheck -------

[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 20:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-11-16_15.05.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-16 19:18 . 2010-11-16 19:18 16384 c:\windows\temp\Perflib_Perfdata_794.dat
+ 2010-11-16 19:21 . 2010-11-16 19:21 16384 c:\windows\temp\Perflib_Perfdata_314.dat
+ 2002-09-23 12:00 . 2010-11-16 19:22 71904 c:\windows\system32\perfc009.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 71904 c:\windows\system32\perfc009.dat
+ 2002-09-23 12:00 . 2010-11-16 19:22 83562 c:\windows\system32\perfc005.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 83562 c:\windows\system32\perfc005.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 444028 c:\windows\system32\perfh009.dat
+ 2002-09-23 12:00 . 2010-11-16 19:22 444028 c:\windows\system32\perfh009.dat
+ 2002-09-23 12:00 . 2010-11-16 19:22 440812 c:\windows\system32\perfh005.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 440812 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-21 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"OscarEditor"="c:\program files\OSCAR Editor\OscarEditor.exe" [2008-07-30 2865152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"SetIcon"="c:\program files\Icons\SetIcon.exe" [2002-08-22 39936]
"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]
"AGRSMMSG"="AGRSMMSG.exe" [2002-09-25 87751]
"RemoteControl"="d:\programy\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PCSuiteTrayApplication"="d:\programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-25 188416]
"iTunesHelper"="c:\program files\iTunesHelper.exe" [2009-09-21 305440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"FLMBROWSEMOUSE"="c:\program files\Trust\305KS\Mouse\mouse32a.exe" [2010-04-04 360448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="d:\programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-7-2 966756]
QuickTV.lnk - d:\programy\AverTV\QuickTV.exe [2005-10-30 393216]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Hry\\Valve\\hl.exe"=
"d:\\Programy\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\pinacle\\Programs\\RM.exe"=
"d:\\Program Files\\pinacle\\Programs\\PMSRegisterFile.exe"=
"d:\\Program Files\\pinacle\\Programs\\umi.exe"=
"d:\\Program Files\\pinacle\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"z:\\Pinnacle 14\\Programs\\RM.exe"=
"z:\\Pinnacle 14\\Programs\\Studio.exe"=
"z:\\Pinnacle 14\\Programs\\umi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"z:\\P17535732.JPG-www.facebook.exe"= c:\\WINDOWS\\nvsvc32.exe
"z:\\ArchiCAD 14\\ArchiCAD 14\\ArchiCAD.exe"=

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [24.12.2008 14:51 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [24.12.2008 14:51 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.1.2010 20:29 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [25.5.2009 12:30 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25.5.2009 12:30 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [22.7.2010 19:42 246520]
R3 PhTVTune;Cap7134 TVTuner;c:\windows\system32\drivers\PhTVTune.sys [24.12.2008 12:28 57152]
S2 FlexService;Remote Connections Service;c:\program files\RapidBIT\cisvc.exe [17.5.2009 5:16 41984]
S2 gupdate1c9aa3ffc762012;Služba Google Update (gupdate1c9aa3ffc762012);c:\program files\Google\Update\GoogleUpdate.exe [21.3.2009 17:13 133104]
S2 hpdj7600;hpdj7600;c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 --> c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26.1.2010 21:32 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26.1.2010 21:32 8320]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-21 16:12]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-13 c:\windows\Tasks\Norton Security Scan for Tom.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-17 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Plugins\npitunes.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 20:20
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1993962763-602162358-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:42,3e,62,c7,ae,52,65,41,79,06,7f,a8,18,de,50,9f,63,5f,d3,35,d5,9a,81,
94,14,2a,17,69,06,5b,68,75,d5,3b,9a,87,c5,0c,11,d9,65,53,82,64,bd,dd,af,4a,\
"??"=hex:a0,05,d9,48,67,37,eb,54,bc,08,47,13,47,51,f0,cb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3348)
c:\program files\Trust\305KS\Mouse\MOUDL32A.DLL
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\AGRSMMSG.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OSCAR Editor\OscarData\Tools\MyShowMessage.exe
c:\program files\RapidBIT\cidaemon.exe
.
**************************************************************************
.
Celkový čas: 2010-11-16 20:23:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-16 19:23
ComboFix2.txt 2010-11-16 15:09
ComboFix3.txt 2010-11-13 18:02

Před spuštěním: 7 785 136 128
Po spuštění: 7 773 650 944

- - End Of File - - 61334222798B888BAC696F2C470EE015

Nic moc

Znovu Nouzový režim -> Rkill -> zmije.com s následujícím scriptem

ComboFix 10-11-15.06 - Tom 16.11.2010 21:21:48.10.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.790 [GMT 1:00]
Spuštěný z: c:\documents and settings\Tom\Plocha\zmije.com
Použité ovládací přepínače :: c:\docume~1\Tom\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\Tom\Data aplikací\juzjf.exe"
"c:\windows\nvsvc32.exe"
"z:\P17535732.JPG"
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-16 do 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 13:53 . 2010-11-16 14:08 -------- d-----w- C:\zmije
2010-11-16 13:38 . 2010-11-16 13:53 -------- d-----w- C:\ComboFix
2010-11-16 13:38 . 2010-11-16 13:38 389632 ----a-w- c:\windows\system32\CF25096.exe
2010-11-16 13:01 . 2010-11-16 13:01 40128 ----a-w- c:\windows\system32\drivers\csdcpova.sys
2010-11-16 12:06 . 2010-11-16 12:06 82944 ----a-w- c:\windows\system32\drivers\zjobscwh.sys
2010-11-16 11:36 . 2010-11-16 11:36 0 ----a-w- c:\windows\system32\drivers\arxcijri.sys
2010-11-14 19:48 . 2010-11-14 19:48 22016 ----a-r- c:\documents and settings\Tom\Data aplikací\Microsoft\Installer\{2EE90F26-20B3-4423-81DE-E57E5D2E4FEF}\Icon2EE90F261.exe
2010-11-13 19:07 . 2010-11-13 19:07 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Help
2010-11-13 16:53 . 2010-11-13 16:53 91136 --sh--r- c:\documents and settings\Tom\Data aplikací\juzjf.exe
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Local Settings\Data aplikací\Graphisoft
2010-11-09 17:36 . 2010-11-09 17:36 -------- d-----w- c:\documents and settings\Tom\Data aplikací\Graphisoft
2010-11-09 16:54 . 2010-11-09 16:54 -------- d---a-w- c:\program files\Common Files\Graphisoft Shared
2010-10-23 15:45 . 2010-10-23 15:45 -------- d-----w- c:\documents and settings\Tom\Data aplikací\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 14:36 . 2009-09-21 14:36 294688 ----a-w- c:\program files\iTunesOutlookAddIn.dll
2009-09-21 14:36 . 2009-09-21 14:36 292128 ----a-w- c:\program files\iTunesPhotoProcessor.exe
2009-09-21 14:36 . 2009-09-21 14:36 384800 ----a-w- c:\program files\iTunesAdmin.dll
2009-09-21 14:36 . 2009-09-21 14:36 305440 ----a-w- c:\program files\iTunesHelper.exe
2009-09-21 14:36 . 2009-09-21 14:36 124192 ----a-w- c:\program files\iTunesMiniPlayer.dll
2009-09-21 14:36 . 2009-09-21 14:36 10309408 ----a-w- c:\program files\iTunes.exe
2009-09-21 14:36 . 2009-09-21 14:36 14691112 ----a-w- c:\program files\iTunes.dll
2009-09-21 14:36 . 2009-09-21 14:36 722160 ----a-w- c:\program files\CDDBControlApple.dll
2009-09-21 14:36 . 2009-09-21 14:36 648480 ----a-w- c:\program files\iPodUpdaterExt.dll
2009-09-21 14:36 . 2009-09-21 14:36 111912 ----a-w- c:\program files\ITDetector.ocx
.

------- Sigcheck -------

[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 20:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-11-16_15.05.16 )))))))))))))))))))))))))))))))))))))))))
.
- 2002-09-23 12:00 . 2010-11-16 15:06 71904 c:\windows\system32\perfc009.dat
+ 2002-09-23 12:00 . 2010-11-16 20:22 71904 c:\windows\system32\perfc009.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 83562 c:\windows\system32\perfc005.dat
+ 2002-09-23 12:00 . 2010-11-16 20:22 83562 c:\windows\system32\perfc005.dat
+ 2002-09-23 12:00 . 2010-11-16 20:22 444028 c:\windows\system32\perfh009.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 444028 c:\windows\system32\perfh009.dat
+ 2002-09-23 12:00 . 2010-11-16 20:22 440812 c:\windows\system32\perfh005.dat
- 2002-09-23 12:00 . 2010-11-16 15:06 440812 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-21 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"OscarEditor"="c:\program files\OSCAR Editor\OscarEditor.exe" [2008-07-30 2865152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"SetIcon"="c:\program files\Icons\SetIcon.exe" [2002-08-22 39936]
"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]
"AGRSMMSG"="AGRSMMSG.exe" [2002-09-25 87751]
"RemoteControl"="d:\programy\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PCSuiteTrayApplication"="d:\programy\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-25 188416]
"iTunesHelper"="c:\program files\iTunesHelper.exe" [2009-09-21 305440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"FLMBROWSEMOUSE"="c:\program files\Trust\305KS\Mouse\mouse32a.exe" [2010-04-04 360448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="d:\programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-7-2 966756]
QuickTV.lnk - d:\programy\AverTV\QuickTV.exe [2005-10-30 393216]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Hry\\Valve\\hl.exe"=
"d:\\Programy\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\pinacle\\Programs\\RM.exe"=
"d:\\Program Files\\pinacle\\Programs\\PMSRegisterFile.exe"=
"d:\\Program Files\\pinacle\\Programs\\umi.exe"=
"d:\\Program Files\\pinacle\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"z:\\Pinnacle 14\\Programs\\RM.exe"=
"z:\\Pinnacle 14\\Programs\\Studio.exe"=
"z:\\Pinnacle 14\\Programs\\umi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"z:\\P17535732.JPG-www.facebook.exe"= c:\\WINDOWS\\nvsvc32.exe
"z:\\ArchiCAD 14\\ArchiCAD 14\\ArchiCAD.exe"=

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [24.12.2008 14:51 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [24.12.2008 14:51 5248]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.1.2010 20:29 691696]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [25.5.2009 12:30 165456]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25.5.2009 12:30 17744]
S2 FlexService;Remote Connections Service;c:\program files\RapidBIT\cisvc.exe [17.5.2009 5:16 41984]
S2 gupdate1c9aa3ffc762012;Služba Google Update (gupdate1c9aa3ffc762012);c:\program files\Google\Update\GoogleUpdate.exe [21.3.2009 17:13 133104]
S2 hpdj7600;hpdj7600;c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 --> c:\docume~1\Tom\LOCALS~1\Temp\hpdj7600.exe -servicerunning=true -uninstall=hp photosmart 7600 series -product=7600 [?]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [22.7.2010 19:42 246520]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26.1.2010 21:32 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26.1.2010 21:32 8320]
S3 PhTVTune;Cap7134 TVTuner;c:\windows\system32\drivers\PhTVTune.sys [24.12.2008 12:28 57152]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-21 16:12]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-21 16:13]

2010-11-13 c:\windows\Tasks\Norton Security Scan for Tom.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-17 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Tom\Data aplikací\Mozilla\Firefox\Profiles\a4qv31ee.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 21:28
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1993962763-602162358-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:42,3e,62,c7,ae,52,65,41,79,06,7f,a8,18,de,50,9f,63,5f,d3,35,d5,9a,81,
94,14,2a,17,69,06,5b,68,75,d5,3b,9a,87,c5,0c,11,d9,65,53,82,64,bd,dd,af,4a,\
"??"=hex:a0,05,d9,48,67,37,eb,54,bc,08,47,13,47,51,f0,cb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(508)
c:\windows\system32\l3codeca.acm
.
Celkový čas: 2010-11-16 21:31:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-16 20:31
ComboFix2.txt 2010-11-16 19:23
ComboFix3.txt 2010-11-16 15:09
ComboFix4.txt 2010-11-13 18:02

Před spuštěním: 7 777 779 712
Po spuštění: 7 769 645 056

- - End Of File - - 4E06C54959A4A2FFA8DF36B8152DD871

No, nejsem z toho výsledku moc moudrý

Proveď ještě AVPTool
http://www.viry.cz/forum/viewtopic.php?f=29&t=58179/

http://img32.imageshack.us/img32/7604/93809819.gif

Čapí hnízdo bylo proti útrobám tvého PC sterilní jak operační sál.

Tak po projetí AVPTool to vypadá celkem dobře, odstranilo to několik věcí, provedlo dezinfekci a teď to je v pohodě. Díky moc

tady je kdyžtak výpis z AVPtool


Automatická kontrola: zastaveno před 2 hod. (události: 27, objekty: 238225, čas: 01:01:49)
16.11.2010 23:19:54 Úloha byla zastavena
16.11.2010 23:19:20 Zjištěno: Trojan.Win32.Jorik.IRCbot.pb Z:\P17535732.JPG-www.facebook.exe
16.11.2010 22:51:40 Odstraněno: Rootkit.Win32.Pakes.zo C:\WINDOWS\system32\drivers\csdcpova.sys
16.11.2010 22:51:33 Zjištěno: http://www.viruslist.com/cz/advisories/41917 C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
16.11.2010 22:51:24 Zjištěno: Rootkit.Win32.Pakes.zo C:\WINDOWS\system32\drivers\csdcpova.sys
16.11.2010 22:51:02 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll
16.11.2010 22:51:01 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
16.11.2010 22:43:49 Odstraněno: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062630.exe
16.11.2010 22:43:36 Zjištěno: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062630.exe
16.11.2010 22:42:24 Odstraněno: Rootkit.Win32.Agent.bivz C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0060189.sys
16.11.2010 22:42:16 Zjištěno: Rootkit.Win32.Agent.bivz C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0060189.sys
16.11.2010 22:41:06 Odstraněno: Backdoor.Win32.Cetorp.p C:\Qoobox\Quarantine\C\WINDOWS\system32\secupdat.dat.vir
16.11.2010 22:41:01 Odstraněno: Backdoor.Win32.Cetorp.p C:\Qoobox\Quarantine\C\Documents and Settings\Tom\secupdat.dat.vir
16.11.2010 22:40:55 Odstraněno: Rootkit.Win32.Agent.bivz C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\knof5b0.sys.vir
16.11.2010 22:39:52 Zjištěno: Backdoor.Win32.Cetorp.p C:\Qoobox\Quarantine\C\WINDOWS\system32\secupdat.dat.vir/PE-Crypt.XorPE
16.11.2010 22:39:52 Zjištěno: Backdoor.Win32.Cetorp.p C:\Qoobox\Quarantine\C\Documents and Settings\Tom\secupdat.dat.vir/PE-Crypt.XorPE
16.11.2010 22:39:51 Zjištěno: Rootkit.Win32.Agent.bivz C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\knof5b0.sys.vir
16.11.2010 22:39:36 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
16.11.2010 22:38:03 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
16.11.2010 22:37:03 Zjištěno: http://www.viruslist.com/cz/advisories/41791 C:\Program Files\Java\jre6\bin\java.exe
16.11.2010 22:34:59 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\chrome.dll
16.11.2010 22:34:45 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\nacl64.dll
16.11.2010 22:34:18 Zjištěno: http://www.viruslist.com/cz/advisories/31744 C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
16.11.2010 22:29:22 Zjištěno: http://www.viruslist.com/cz/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
16.11.2010 22:24:19 Odstraněno: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Tom\Data aplikací\juzjf.exe
16.11.2010 22:22:27 Zjištěno: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Tom\Data aplikací\juzjf.exe
16.11.2010 22:18:05 Úloha byla spuštěna
Dezinfikovat aktivní hrozby: dokončeno před 2 hod. (události: 7, objekty: 1841, čas: 00:06:33)
16.11.2010 23:26:26 Úloha byla dokončena
16.11.2010 23:24:43 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
16.11.2010 23:24:35 Zjištěno: http://www.viruslist.com/cz/advisories/41213 C:\Program Files\QuickTime\QuickTimePlayer.exe
16.11.2010 23:22:04 Zjištěno: http://www.viruslist.com/cz/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
16.11.2010 23:20:01 Odstraněno: Trojan.Win32.Jorik.IRCbot.pb Z:\P17535732.JPG-www.facebook.exe
16.11.2010 23:19:54 Zjištěno: Trojan.Win32.Jorik.IRCbot.pb Z:\P17535732.JPG-www.facebook.exe
16.11.2010 23:19:53 Úloha byla spuštěna
Automatická kontrola: dokončeno před 2 min. (události: 26, objekty: 624281, čas: 02:24:49)
16.11.2010 23:28:52 Úloha byla spuštěna
16.11.2010 23:41:54 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\nacl64.dll
16.11.2010 23:42:14 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\chrome.dll
16.11.2010 23:44:35 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
16.11.2010 23:46:01 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
16.11.2010 23:46:27 Zjištěno: Rootkit.Win32.Pakes.zo C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062631.sys
16.11.2010 23:46:54 Odstraněno: Rootkit.Win32.Pakes.zo C:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062631.sys
16.11.2010 23:51:32 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
16.11.2010 23:51:33 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll
16.11.2010 23:52:01 Zjištěno: http://www.viruslist.com/cz/advisories/41917 C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
17.11.2010 0:41:38 Zjištěno: Trojan.Win32.Jorik.IRCbot.pb Z:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062632.exe
17.11.2010 0:41:54 Odstraněno: Trojan.Win32.Jorik.IRCbot.pb Z:\System Volume Information\_restore{3D4E3946-6CB3-4962-8261-51E067EB35F4}\RP266\A0062632.exe
17.11.2010 0:51:25 Zjištěno: http://www.viruslist.com/cz/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
17.11.2010 0:51:53 Zjištěno: http://www.viruslist.com/cz/advisories/41213 C:\Program Files\QuickTime\QuickTimePlayer.exe
17.11.2010 0:51:56 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
17.11.2010 0:52:41 Zjištěno: http://www.viruslist.com/cz/advisories/31744 C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
17.11.2010 0:54:17 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
17.11.2010 0:54:24 Chyba zpracování C:\WINDOWS\system32\drivers\ac6ltong.sys Chyba čtení
17.11.2010 1:05:38 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\nacl64.dll
17.11.2010 1:05:38 Zjištěno: http://www.viruslist.com/cz/advisories/42109 C:\Program Files\Google\Chrome\Application\7.0.517.41\chrome.dll
17.11.2010 1:09:01 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
17.11.2010 1:10:34 Zjištěno: http://www.viruslist.com/cz/advisories/40534 C:\Program Files\Winamp\winamp.exe
17.11.2010 1:15:14 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
17.11.2010 1:15:14 Zjištěno: http://www.viruslist.com/cz/advisories/41932 C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll
17.11.2010 1:15:48 Zjištěno: http://www.viruslist.com/cz/advisories/41917 C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
17.11.2010 1:53:42 Úloha byla dokončena

Teď provedeme úklid
AVPTool odinstaluj podle návodu

ComboFix odinstalujeme
jdi Start -> Spustit... a zkopíruj ComboFix /Uninstall (pozor, za x je mezera) -> OK

Stáhni TempFolderCleaner http://oldtimer.geekstogo.com/TFC.exe
Zavři všechny programy a spusť. Po ukončení akce bude PC restartován.
Pokud ne, restartuj sám.
(čistí Temp složky , nečistí URL, historii, prefetch ani cookies)

stáhni program OTC tady: http://oldtimer.geekstogo.com/OTC.exe - spusť ho -> "CleanUp" (smaže dříve použité čističe)

Mohu doporučit kontrolu a vyčištění Ccleanerem

Stáhni Ccleaner - http://www.slunecnice.cz/sw/ccleaner/
Při instalaci vyhodit fajfku u "Instalovat Yahoo! Toolbar"

zavřít Internetový prohlížeč a
spustit "Čistič" > "Spustit Ccleaner" - odstraní nepotřebné
spustit "Registry" > "Hledej problémy" > "Opravit vybrané problémy"
souhlas se zálohou registrů - opakovat dokud nebudou registry čisté.
spustit "Nástroje" > "Obnova systému" - 1.řádek zachovej, ostatní "Odstranit"

Návod:http://jnp.zive.cz/Clanky/Prirucka-do-k ... fault.aspx

Ten si můžeš nechat i na budoucí občasné čištění.

Po vyčištění by se hodila defragmentace
doporučuji http://www.slunecnice.cz/sw/defraggler/ + čeština

Nakonec mi dej současný RSIT log