VIRY.CZ

Počítač už mě jede jen v nouzovém režimu ! To že sem při startu mosel mačkat F1 sem ještě překousl to že se mi před týdnem hned po startu zapnuly dokumenty by se taky dalo , pak mi začal házet chybu hadr a nakonec mě Avast po cca 20 steřinách po startu začne házet okna co všechno zablokoval a pak se mi zobrazí modrá obrazovka s textem a restartuje počítač.

Prosím o radu.

RSIT log :

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-11-16 20:16:22
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 211 GB (69%) free of 305 GB
Total RAM: 1023 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:16:28, on 16.11.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\windows\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TMHGCITN\RSIT[1].exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60016
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60016
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=c:\windows\explorer.exe
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file)
O3 - Toolbar: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B315} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [PCSpeedUp] "C:\Program Files\Zrychleni Pocitace\PCSpeedUp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\RunServices: [kojefu] C:\WINDOWS\system32\sikyloon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Eurotran XP - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra 'Tools' menuitem: Eurotran XP... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Eurotran XP\etnxp.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: toolbarchrome - {718733BC-AD64-4E5F-AC18-A85FBD75D54D} - C:\Program Files\RadioBar\toolbar.ni.dll (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\0053.DLL
O20 - Winlogon Notify: winabi32 - winabi32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WDDMService - Unknown owner - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (file missing)
O23 - Service: WD File Management Engine (WDFME) - Unknown owner - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe (file missing)
O23 - Service: WD File Management Shadow Engine (WDSC) - Unknown owner - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe (file missing)

--
End of file - 11191 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\NeroLiveEpgUpdate-ASM-PC_admin.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll []
{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - SweetIM For Internet Explorer - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll [2006-03-02 24576]
{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}
{5B291E6C-9A74-4034-971B-A4B007A0B315}
{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Ask Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2006-03-02 24576]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-10-12 16384512]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-11-06 8523776]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"SweetIM"=C:\Program Files\Macrogaming\SweetIM\SweetIM.exe [2008-01-02 103712]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-03-18 185896]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
"Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2006-11-24 487424]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe /runcleanupscript []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"MSSE"=c:\Program Files\Microsoft Security Essentials\msseces.exe -hide -runkey []
"PCSpeedUp"=C:\Program Files\Zrychleni Pocitace\PCSpeedUp.exe []
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Regedit32"=C:\WINDOWS\system32\regedit.exe [2006-03-02 24576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
WDDMStatus.lnk - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\0053.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winabi32]
C:\WINDOWS\system32\winabi32.dll [2006-03-02 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\btxsveef]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ipnmgslf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lnmowcud]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\nljdxbob]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pkzomqcd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ytmmcvhp.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\zunxfium]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\btxsveef]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnmgslf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\lnmowcud]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nljdxbob]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\pkzomqcd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ytmmcvhp.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\zunxfium]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"DisableLocalMachineRun"=0
"DisableLocalMachineRunOnce"=0
"DisableLocalUserRun"=0
"DisableLocalUserRunOnce"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Valve\hlds.exe"="C:\Program Files\Valve\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Autodesk\Backburner\monitor.exe"="C:\Program Files\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\Backburner\manager.exe"="C:\Program Files\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\Backburner\server.exe"="C:\Program Files\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\admin\Dokumenty\Stažené soubory\chmatakov15.exe"="C:\Documents and Settings\admin\Dokumenty\Stažené soubory\chmatakov15.exe:*:Enabled:chmatakov15"
"C:\Documents and Settings\admin\Plocha\291411832 Sivák\chmatakov15.exe"="C:\Documents and Settings\admin\Plocha\291411832 Sivák\chmatakov15.exe:*:Enabled:chmatakov15"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\WINDOWS\system32\winver.exe"="C:\WINDOWS\system32\winver.exe:*:Enabled:winver"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\B2BPOKER\Doxxbet\jre\bin\javaw.exe"="C:\Program Files\B2BPOKER\Doxxbet\jre\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Documents and Settings\admin\Dokumenty\Downloads\P17535732.JPG-www.facebook.exe"="C:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-11-16 20:16:22 ----DC---- C:\rsit
2010-11-16 20:11:40 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
2010-11-16 20:11:03 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2010-11-16 20:05:11 ----ASH---- C:\Documents and Settings\Administrator\Data aplikací\desktop.ini
2010-11-16 20:05:10 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2010-11-16 13:47:09 ----A---- C:\WINDOWS\system32\drivers\218.exe
2010-11-16 10:23:33 ----A---- C:\WINDOWS\system32\drivers\859.exe
2010-11-16 10:22:05 ----A---- C:\WINDOWS\system32\drivers\62.exe
2010-11-16 10:22:04 ----A---- C:\WINDOWS\system32\drivers\437.exe
2010-11-15 23:23:12 ----A---- C:\WINDOWS\system32\regedit.exe
2010-11-15 21:39:25 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2010-11-15 21:22:22 ----A---- C:\WINDOWS\system32\drivers\0.exe
2010-11-15 21:12:21 ----SHDC---- C:\Recycled
2010-11-15 21:00:13 ----A---- C:\WINDOWS\system32\drivers\ipnmgslf.sys
2010-11-15 20:48:52 ----A---- C:\WINDOWS\ntbtlog.txt
2010-11-15 20:24:58 ----A---- C:\WINDOWS\system32\drivers\968.exe
2010-11-15 20:24:51 ----A---- C:\WINDOWS\system32\drivers\843.exe
2010-11-15 20:24:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-11-15 20:24:48 ----A---- C:\WINDOWS\system32\drivers\328.exe
2010-11-15 20:24:40 ----A---- C:\WINDOWS\system32\drivers\484.exe
2010-11-15 20:24:37 ----A---- C:\WINDOWS\system32\drivers\765.exe
2010-11-15 20:14:42 ----A---- C:\WINDOWS\system32\drivers\640.exe
2010-11-15 17:09:01 ----A---- C:\WINDOWS\system32\drivers\109.exe
2010-11-15 17:08:38 ----A---- C:\WINDOWS\system32\drivers\250.exe
2010-11-15 17:08:10 ----A---- C:\WINDOWS\system32\drivers\140.exe
2010-11-15 17:08:09 ----A---- C:\WINDOWS\system32\drivers\125.exe
2010-11-15 17:08:07 ----A---- C:\WINDOWS\system32\drivers\718.exe
2010-11-15 17:08:06 ----A---- C:\WINDOWS\system32\drivers\546.exe
2010-11-15 17:08:05 ----A---- C:\WINDOWS\system32\drivers\234.exe
2010-11-15 17:07:58 ----A---- C:\WINDOWS\system32\drivers\296.exe
2010-11-15 17:07:55 ----A---- C:\WINDOWS\system32\drivers\671.exe
2010-11-15 17:07:54 ----A---- C:\WINDOWS\system32\drivers\828.exe
2010-11-15 15:53:03 ----A---- C:\WINDOWS\system32\ntcore.dll1
2010-11-15 15:52:42 ----A---- C:\WINDOWS\system32\drivers\875.exe
2010-11-15 13:15:41 ----A---- C:\WINDOWS\system32\drivers\312.exe
2010-11-15 07:37:12 ----A---- C:\WINDOWS\system32\drivers\46.exe
2010-11-15 06:57:50 ----A---- C:\WINDOWS\system32\drivers\406.exe
2010-11-14 17:29:14 ----A---- C:\WINDOWS\system32\drivers\515.exe
2010-11-14 16:50:06 ----A---- C:\WINDOWS\system32\drivers\625.exe
2010-11-14 16:12:17 ----A---- C:\WINDOWS\system32\winabi32.dll
2010-11-14 16:11:33 ----A---- C:\WINDOWS\system32\drivers\203.exe
2010-11-14 13:31:47 ----A---- C:\WINDOWS\system32\0053.dll
2010-11-14 13:28:11 ----D---- C:\WINDOWS\system32\coredb
2010-11-14 13:27:53 ----A---- C:\WINDOWS\system32\drivers\atmapi.sys
2010-11-14 13:26:24 ----A---- C:\WINDOWS\system32\drivers\343.exe
2010-11-14 13:21:26 ----A---- C:\WINDOWS\system32\drivers\ndisvvan.sys
2010-11-10 07:03:00 ----A---- C:\WINDOWS\system32\drivers\ytmmcvhp.sys
2010-11-06 10:46:01 ----D---- C:\Program Files\PLAY
2010-10-31 16:37:50 ----D---- C:\Program Files\DVD Decrypter
2010-10-30 15:20:00 ----RA---- C:\WINDOWS\system32\vp6vfw.dll
2010-10-30 15:19:56 ----D---- C:\Program Files\Microsoft WSE

======List of files/folders modified in the last 1 months======

2010-11-16 20:16:24 ----D---- C:\Program Files\trend micro
2010-11-16 20:08:30 ----D---- C:\Program Files
2010-11-16 20:07:54 ----SHD---- C:\RECYCLER
2010-11-16 20:05:10 ----D---- C:\Documents and Settings
2010-11-16 20:03:05 ----AD---- C:\WINDOWS\Temp
2010-11-16 20:02:25 ----D---- C:\WINDOWS
2010-11-16 14:44:58 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-16 14:21:59 ----SD---- C:\WINDOWS\Tasks
2010-11-16 14:21:03 ----D---- C:\WINDOWS\system32
2010-11-16 14:18:08 ----D---- C:\WINDOWS\Prefetch
2010-11-16 13:47:09 ----D---- C:\WINDOWS\system32\drivers
2010-11-16 13:46:36 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-11-16 12:37:37 ----D---- C:\WINDOWS\security
2010-11-15 21:39:13 ----SHD---- C:\WINDOWS\Installer
2010-11-15 21:38:58 ----D---- C:\Program Files\Alwil Software
2010-11-15 21:21:52 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-15 21:09:03 ----D---- C:\Program Files\Mozilla Firefox
2010-11-15 21:02:15 ----D---- C:\WINDOWS\Minidump
2010-11-15 20:52:13 ----A---- C:\WINDOWS\imsins.BAK
2010-11-15 20:43:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-11-15 20:30:53 ----AC---- C:\WINDOWS\OEWABLog.txt
2010-11-15 20:30:20 ----D---- C:\Program Files\Windows Media Player
2010-11-15 20:25:39 ----D---- C:\WINDOWS\WinSxS
2010-11-14 17:01:55 ----HD---- C:\WINDOWS\inf
2010-11-14 17:01:55 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-11-13 23:57:01 ----A---- C:\WINDOWS\NeroDigital.ini
2010-11-10 07:03:01 ----D---- C:\Program Files\RadioBar
2010-11-03 07:07:16 ----RD---- C:\Hudba
2010-11-02 16:47:16 ----AC---- C:\WINDOWS\system32\MRT.exe
2010-11-01 06:27:11 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-31 17:03:11 ----RD---- C:\Downloads
2010-10-31 16:37:31 ----D---- C:\Program Files\Common Files
2010-10-30 15:19:59 ----RSD---- C:\WINDOWS\assembly
2010-10-30 15:01:00 ----HD---- C:\Program Files\InstallShield Installation Information
2010-10-30 08:01:31 ----D---- C:\Program Files\Microsoft Security Essentials
2010-10-27 13:19:58 ----D---- C:\WINDOWS\Microsoft.NET
2010-10-27 12:17:13 ----D---- C:\WINDOWS\system32\en-us
2010-10-27 12:17:00 ----D---- C:\Program Files\Microsoft.NET
2010-10-21 20:55:47 ----D---- C:\1d3ae137d40514a0364733698f94
2010-10-19 21:51:33 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2010-10-18 15:50:21 ----D---- C:\Program Files\Cheat Engine

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-11-17 717296]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R0 ytmmcvhp;ytmmcvhp; C:\WINDOWS\System32\Drivers\ytmmcvhp.sys [2010-11-10 40128]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-10-12 94592]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-03-02 20480]
S0 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys []
S1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
S1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2010-09-07 340048]
S1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
S1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2006-03-02 14848]
S1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
S1 prodrv04;Star Force copy protection driver v4; C:\WINDOWS\System32\drivers\prodrv04.sys [2008-01-27 114496]
S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
S2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
S2 ipnmgslf;ipnmgslf; \??\C:\WINDOWS\system32\Drivers\ipnmgslf.sys []
S2 lnmowcud;lnmowcud; \??\C:\WINDOWS\system32\Drivers\lnmowcud.sys []
S3 aayaeuno;aayaeuno; C:\WINDOWS\system32\drivers\aayaeuno.sys []
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2004-08-03 207360]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;Filtr Dot4USB Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2006-03-02 9600]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-10-12 4609024]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-11-06 7429088]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-11-10 61600]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-11-10 9360]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-11-10 97184]
S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-11-10 88688]
S3 se2End5;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS); C:\WINDOWS\system32\DRIVERS\se2End5.sys [2006-11-10 18704]
S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-11-10 86560]
S3 se2Eunic;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM); C:\WINDOWS\system32\DRIVERS\se2Eunic.sys [2006-11-10 90800]
S3 se45bus;Sony Ericsson Device 069 driver (WDM); C:\WINDOWS\system32\DRIVERS\se45bus.sys [2006-11-30 61536]
S3 se45mdfl;Sony Ericsson Device 069 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se45mdfl.sys [2006-11-30 9360]
S3 se45mdm;Sony Ericsson Device 069 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se45mdm.sys [2006-11-30 97088]
S3 se45mgmt;Sony Ericsson Device 069 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\se45mgmt.sys [2006-11-30 88624]
S3 se45nd5;Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (NDIS); C:\WINDOWS\system32\DRIVERS\se45nd5.sys [2006-11-30 18704]
S3 se45obex;Sony Ericsson Device 069 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se45obex.sys [2006-11-30 86432]
S3 se45unic;Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (WDM); C:\WINDOWS\system32\DRIVERS\se45unic.sys [2006-11-30 90800]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2006-03-02 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe /svc []
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-13 153376]
S2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-30 935208]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-11-06 155716]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S2 WDDMService;WDDMService; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe []
S2 WDFME;WD File Management Engine; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe []
S2 WDSC;WD File Management Shadow Engine; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe []
S2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-03-02 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-06-06 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Bude to chvíli trvat nejde mi vypnou antivirák tak to budu moset restartovat.

Pokud jste si jist, že jste Avast vypnul, můžete hlášku ignorovat.

Tak sláva už to je !

Ale jak jsem dával log z Rsitu tak potom jsem ještě dával v Avastu test a smazal asi 370 infikovaných souborů.

log :

ComboFix 10-11-16.02 - admin 16.11.2010 22:16:53.3.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.462 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dir\install
c:\documents and settings\admin\Data aplikací\AD ON Multimedia
c:\documents and settings\admin\Data aplikací\AD ON Multimedia\eBay Shortcuts\config.ini
c:\documents and settings\admin\Data aplikací\Desktopicon
c:\documents and settings\admin\Data aplikací\Desktopicon\config.ini
c:\documents and settings\admin\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\admin\secupdat.dat
c:\documents and settings\admin\System
c:\documents and settings\admin\System\win_qs.jqx
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.0.inf
c:\windows\system32\0053.dll
c:\windows\system32\coredb
c:\windows\system32\coredb\storage
c:\windows\system32\d.dll
c:\windows\system32\drivers\0.exe
c:\windows\system32\drivers\109.exe
c:\windows\system32\drivers\125.exe
c:\windows\system32\drivers\140.exe
c:\windows\system32\drivers\203.exe
c:\windows\system32\drivers\218.exe
c:\windows\system32\drivers\234.exe
c:\windows\system32\drivers\250.exe
c:\windows\system32\drivers\296.exe
c:\windows\system32\drivers\312.exe
c:\windows\system32\drivers\328.exe
c:\windows\system32\drivers\343.exe
c:\windows\system32\drivers\406.exe
c:\windows\system32\drivers\437.exe
c:\windows\system32\drivers\46.exe
c:\windows\system32\drivers\484.exe
c:\windows\system32\drivers\515.exe
c:\windows\system32\drivers\546.exe
c:\windows\system32\drivers\62.exe
c:\windows\system32\drivers\625.exe
c:\windows\system32\drivers\640.exe
c:\windows\system32\drivers\671.exe
c:\windows\system32\drivers\718.exe
c:\windows\system32\drivers\765.exe
c:\windows\system32\drivers\828.exe
c:\windows\system32\drivers\843.exe
c:\windows\system32\drivers\859.exe
c:\windows\system32\drivers\875.exe
c:\windows\system32\drivers\968.exe
c:\windows\system32\drivers\atmapi.sys
c:\windows\system32\drivers\ndisvvan.sys
c:\windows\system32\Drivers\ytmmcvhp.sys
c:\windows\system32\mycom.crt
c:\windows\system32\n.dll
c:\windows\system32\o.dll
c:\windows\system32\p.dll
c:\windows\system32\regedit.exe
c:\windows\system32\secupdat.dat
c:\windows\system32\skype
c:\windows\system32\skype\klog.dat
c:\windows\system32\wupd.dat
c:\windows\worklog0

Nakažená kopie c:\windows\system32\ole32.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\$NtUninstallKB894391$\ole32.dll

c:\windows\system32\drivers\cdrom.sys . . . chybí !!

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ytmmcvhp
-------\Service_ytmmcvhp


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-16 do 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 19:16 . 2010-11-16 19:16 -------- dc----w- C:\rsit
2010-11-16 19:05 . 2010-11-16 19:05 -------- d-----w- c:\documents and settings\Administrator
2010-11-15 20:39 . 2010-09-07 15:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-11-15 20:00 . 2010-11-15 20:00 83456 ----a-w- c:\windows\system32\drivers\ipnmgslf.sys
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-11-15 19:25 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-15 19:24 . 2010-11-15 19:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2010-11-15 14:53 . 2010-11-15 19:36 311296 ----a-w- c:\windows\system32\ntcore.dll1
2010-11-14 16:30 . 2010-11-14 16:30 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\PCHealth
2010-11-14 15:12 . 2006-03-02 12:00 24576 ----a-w- c:\windows\system32\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
2010-11-14 15:12 . 2006-03-02 12:00 24576 ----a-w- c:\windows\system32\{5b291e6c-9a74-4034-971b-a4b007a0b315}
2010-11-14 15:12 . 2006-03-02 12:00 24576 ----a-w- c:\windows\system32\winabi32.dll
2010-11-14 12:31 . 2006-03-02 12:00 24576 ----a-w- c:\documents and settings\admin\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
2010-11-14 12:31 . 2006-03-02 12:00 24576 ----a-w- c:\documents and settings\admin\{5b291e6c-9a74-4034-971b-a4b007a0b315}
2010-11-14 12:31 . 2006-03-02 12:00 24576 ----a-w- c:\documents and settings\admin\winabi32.dll
2010-11-14 12:31 . 2006-03-02 12:00 24576 ----a-w- c:\documents and settings\admin\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3}
2010-11-06 09:46 . 2010-11-06 09:46 -------- d-----w- c:\program files\PLAY
2010-10-31 15:37 . 2010-10-31 15:38 -------- d-----w- c:\program files\DVD Decrypter
2010-10-30 14:20 . 2008-09-04 18:17 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2010-10-30 14:19 . 2010-10-30 14:19 -------- d-----w- c:\program files\Microsoft WSE
2010-10-29 07:25 . 2010-10-07 23:21 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DF626C9B-2C2B-4590-9D20-984229F5947A}\mpengine.dll
2010-10-27 11:22 . 2010-11-03 13:04 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\Deployment
2010-10-19 16:28 . 2010-10-19 16:28 -------- d-----w- c:\documents and settings\admin\Data aplikací\InstantAction

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-14 19:49 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-16 09:43 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-27 06:17 . 2007-12-20 23:55 98304 ----a-w- c:\windows\DUMP6c37.tmp
2010-09-13 18:08 . 2008-10-19 16:54 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-13 18:08 . 2010-09-13 18:08 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-07 16:11 . 2007-12-25 18:13 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 15:52 . 2007-12-25 18:13 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 15:52 . 2008-08-05 15:53 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 15:47 . 2007-12-25 18:13 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 15:47 . 2007-12-25 18:13 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 15:47 . 2007-12-25 18:13 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 15:47 . 2008-08-05 15:53 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 15:46 . 2007-12-25 18:13 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2006-03-02 24576]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2006-03-02 24576]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 16:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-29 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-12 16384512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-18 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabi32]
2006-03-02 12:00 24576 ----a-w- c:\windows\system32\winabi32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\B2BPOKER\\Doxxbet\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\Škola\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22658:TCP"= 22658:TCP:BitComet 22658 TCP
"22658:UDP"= 22658:UDP:BitComet 22658 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.1.2008 16:37 717296]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [15.11.2010 21:39 340048]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.8.2008 16:53 165584]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [27.1.2008 13:11 114496]
S2 ASKService;ASKService; [x]
S2 ASKUpgrade;ASKUpgrade; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.8.2008 16:53 17744]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 ipnmgslf;ipnmgslf;c:\windows\system32\drivers\ipnmgslf.sys [15.11.2010 21:00 83456]
S2 lnmowcud;lnmowcud;\??\c:\windows\system32\Drivers\lnmowcud.sys --> c:\windows\system32\Drivers\lnmowcud.sys [?]
S2 WDDMService;WDDMService;"c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe" --> c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [?]
S2 WDFME;WD File Management Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [?]
S2 WDSC;WD File Management Shadow Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [16.10.2010 19:14 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-11-16 c:\windows\Tasks\NeroLiveEpgUpdate-ASM-PC_admin.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
mStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Link to &MidpX - c:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
Trusted Zone: facebook.com\login
Trusted Zone: mojebanka.cz\www
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-{5B291E6C-9A74-4034-971B-A4B007A0B315} - (no file)
WebBrowser-{5B291E6C-9A74-4034-971B-A4B007A0B315} - (no file)
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKCU-Run-Kalendar - c:\program files\Kalendar\kalendar.exe
HKCU-Run-wuaucldt - c:\documents and settings\admin\wuaucldt.exe
HKCU-Run-OEXPRESS - (no file)
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-MSSE - c:\program files\Microsoft Security Essentials\msseces.exe
HKLM-Run-PCSpeedUp - c:\program files\Zrychleni Pocitace\PCSpeedUp.exe
SafeBoot-btxsveef
SafeBoot-ipnmgslf
SafeBoot-lnmowcud
SafeBoot-nljdxbob
SafeBoot-pkzomqcd
SafeBoot-ytmmcvhp.sys
SafeBoot-zunxfium
AddRemove-BlueJ_is1 - c:\bluej\uninst\unins000.exe
AddRemove-SmartDraw_Catalog - c:\smartd~1\UNINSTAL.EXE
AddRemove-SnadBoy's Revelation v2 - c:\progra~1\SNADBO~1\UNWISE.EXE
AddRemove-Solitaire Isle_is1 - c:\program files\FreeGamePick.com\Solitaire Isle\unins000.exe
AddRemove-SpecOps US Army Green Berets - c:\program files\Zombie Studios\SpecOps US Army Green Berets\Uninst.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 22:31
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\winabi32.dll
.
Celkový čas: 2010-11-16 22:39:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-16 21:39

Před spuštěním: Volných bajtů: 221 140 377 600
Po spuštění: Volných bajtů: 234 301 427 712

- - End Of File - - 32F5F4F56155C50A5F698F18ED7A4AF0

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files\AskBarDis

Collect::
c:\windows\system32\drivers\ipnmgslf.sys
c:\windows\system32\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
c:\windows\system32\{5b291e6c-9a74-4034-971b-a4b007a0b315}
c:\windows\system32\winabi32.dll
c:\documents and settings\admin\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
c:\documents and settings\admin\{5b291e6c-9a74-4034-971b-a4b007a0b315}
c:\documents and settings\admin\winabi32.dll
c:\documents and settings\admin\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3}
c:\windows\system32\Drivers\lnmowcud.sys

Driver::
ipnmgslf
ASKService
ASKUpgrade
lnmowcud

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabi32]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

ComboFix 10-11-16.02 - admin 16.11.2010 23:19:05.4.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.134 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

file zipped: c:\documents and settings\admin\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3}
file zipped: c:\documents and settings\admin\{5b291e6c-9a74-4034-971b-a4b007a0b315}
file zipped: c:\documents and settings\admin\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
file zipped: c:\documents and settings\admin\winabi32.dll
file zipped: c:\windows\system32\{5b291e6c-9a74-4034-971b-a4b007a0b315}
file zipped: c:\windows\system32\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
file zipped: c:\windows\system32\drivers\ipnmgslf.sys
file zipped: c:\windows\system32\winabi32.dll
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\admin\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3}
c:\documents and settings\admin\{5b291e6c-9a74-4034-971b-a4b007a0b315}
c:\documents and settings\admin\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
c:\documents and settings\admin\winabi32.dll
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askbar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\AskService.exe
c:\program files\AskBarDis\bar\bin\AskSplash.exe
c:\program files\AskBarDis\bar\bin\AskTBApp.exe
c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\002F2882
c:\program files\AskBarDis\bar\Cache\002F3091
c:\program files\AskBarDis\bar\Cache\002F31E8.bin
c:\program files\AskBarDis\bar\Cache\002F35D0.bin
c:\program files\AskBarDis\bar\Cache\002F38DE.bin
c:\program files\AskBarDis\bar\Cache\002F3A06.bin
c:\program files\AskBarDis\bar\Cache\002F3C97.bin
c:\program files\AskBarDis\bar\Cache\002F3E2D.bin
c:\program files\AskBarDis\bar\Cache\002F3FB4.bin
c:\program files\AskBarDis\bar\Cache\002F40DC
c:\program files\AskBarDis\bar\Cache\002F42B1
c:\program files\AskBarDis\bar\Cache\002F4DEC
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\AskLogo.ico
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
c:\windows\system32\{5b291e6c-9a74-4034-971b-a4b007a0b315}
c:\windows\system32\{ebe9e2b5-b526-48bc-ad46-687263edcb0e}
c:\windows\system32\drivers\ipnmgslf.sys
c:\windows\system32\winabi32.dll

c:\windows\system32\drivers\cdrom.sys . . . chybí !!

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASKSERVICE
-------\Legacy_ASKUPGRADE
-------\Legacy_IPNMGSLF
-------\Legacy_LNMOWCUD
-------\Service_ASKService
-------\Service_ASKUpgrade
-------\Service_ipnmgslf
-------\Service_lnmowcud


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-16 do 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 19:16 . 2010-11-16 19:16 -------- dc----w- C:\rsit
2010-11-16 19:05 . 2010-11-16 19:05 -------- d-----w- c:\documents and settings\Administrator
2010-11-15 20:39 . 2010-09-07 15:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-11-15 19:25 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-15 19:24 . 2010-11-15 19:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2010-11-15 14:53 . 2010-11-15 19:36 311296 ----a-w- c:\windows\system32\ntcore.dll1
2010-11-14 16:30 . 2010-11-14 16:30 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\PCHealth
2010-11-06 09:46 . 2010-11-06 09:46 -------- d-----w- c:\program files\PLAY
2010-10-31 15:37 . 2010-10-31 15:38 -------- d-----w- c:\program files\DVD Decrypter
2010-10-30 14:20 . 2008-09-04 18:17 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2010-10-30 14:19 . 2010-10-30 14:19 -------- d-----w- c:\program files\Microsoft WSE
2010-10-29 07:25 . 2010-10-07 23:21 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DF626C9B-2C2B-4590-9D20-984229F5947A}\mpengine.dll
2010-10-27 11:22 . 2010-11-03 13:04 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\Deployment
2010-10-19 16:28 . 2010-10-19 16:28 -------- d-----w- c:\documents and settings\admin\Data aplikací\InstantAction

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-14 19:49 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-16 09:43 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-27 06:17 . 2007-12-20 23:55 98304 ----a-w- c:\windows\DUMP6c37.tmp
2010-09-13 18:08 . 2008-10-19 16:54 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-13 18:08 . 2010-09-13 18:08 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-07 16:11 . 2007-12-25 18:13 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 15:52 . 2007-12-25 18:13 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 15:52 . 2008-08-05 15:53 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 15:47 . 2007-12-25 18:13 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 15:47 . 2007-12-25 18:13 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 15:47 . 2007-12-25 18:13 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 15:47 . 2008-08-05 15:53 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 15:46 . 2007-12-25 18:13 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 16:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-29 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-12 16384512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-18 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\B2BPOKER\\Doxxbet\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\Škola\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22658:TCP"= 22658:TCP:BitComet 22658 TCP
"22658:UDP"= 22658:UDP:BitComet 22658 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.1.2008 16:37 717296]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [15.11.2010 21:39 340048]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.8.2008 16:53 165584]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [27.1.2008 13:11 114496]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.8.2008 16:53 17744]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 WDDMService;WDDMService;"c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe" --> c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [?]
S2 WDFME;WD File Management Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [?]
S2 WDSC;WD File Management Shadow Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [16.10.2010 19:14 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-11-16 c:\windows\Tasks\NeroLiveEpgUpdate-ASM-PC_admin.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
mStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Link to &MidpX - c:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
Trusted Zone: facebook.com\login
Trusted Zone: mojebanka.cz\www
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 23:29
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(236)
c:\windows\system32\browselc.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
f:\škola\mozilla\mozilla\firefox.exe
.
**************************************************************************
.
Celkový čas: 2010-11-16 23:35:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-16 22:35
ComboFix2.txt 2010-11-16 21:39

Před spuštěním: Volných bajtů: 234 278 928 384
Po spuštění: Volných bajtů: 234 298 933 248

- - End Of File - - 3E20D51863AB1A962141376E57959FCF

Ještě jednou spusťte CF tímto skriptem:

FCopy::
C:\windows\ServicePackFiles\i386\cdrom.sys | c:\windows\system32\drivers\cdrom.sys

Tak tady to je :


ComboFix 10-11-16.02 - admin 17.11.2010 12:28:49.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.247 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\cdrom.sys . . . chybí !!

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-17 do 2010-11-17 )))))))))))))))))))))))))))))))
.

2010-11-16 19:16 . 2010-11-16 19:16 -------- dc----w- C:\rsit
2010-11-16 19:05 . 2010-11-16 19:05 -------- d-----w- c:\documents and settings\Administrator
2010-11-15 20:39 . 2010-09-07 15:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-11-15 19:25 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-15 19:24 . 2010-11-15 19:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2010-11-15 14:53 . 2010-11-15 19:36 311296 ----a-w- c:\windows\system32\ntcore.dll1
2010-11-14 16:30 . 2010-11-14 16:30 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\PCHealth
2010-11-06 09:46 . 2010-11-06 09:46 -------- d-----w- c:\program files\PLAY
2010-10-31 15:37 . 2010-10-31 15:38 -------- d-----w- c:\program files\DVD Decrypter
2010-10-30 14:20 . 2008-09-04 18:17 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2010-10-30 14:19 . 2010-10-30 14:19 -------- d-----w- c:\program files\Microsoft WSE
2010-10-29 07:25 . 2010-10-07 23:21 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DF626C9B-2C2B-4590-9D20-984229F5947A}\mpengine.dll
2010-10-27 11:22 . 2010-11-03 13:04 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\Deployment
2010-10-19 16:28 . 2010-10-19 16:28 -------- d-----w- c:\documents and settings\admin\Data aplikací\InstantAction

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-14 19:49 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-16 09:43 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-27 06:17 . 2007-12-20 23:55 98304 ----a-w- c:\windows\DUMP6c37.tmp
2010-09-13 18:08 . 2008-10-19 16:54 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-13 18:08 . 2010-09-13 18:08 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-07 16:11 . 2007-12-25 18:13 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 15:52 . 2007-12-25 18:13 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 15:52 . 2008-08-05 15:53 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 15:47 . 2007-12-25 18:13 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 15:47 . 2007-12-25 18:13 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 15:47 . 2007-12-25 18:13 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 15:47 . 2008-08-05 15:53 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 15:46 . 2007-12-25 18:13 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 16:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-29 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-12 16384512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-18 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\B2BPOKER\\Doxxbet\\jre\\bin\\javaw.exe"=
"f:\\Škola\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22658:TCP"= 22658:TCP:BitComet 22658 TCP
"22658:UDP"= 22658:UDP:BitComet 22658 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.1.2008 16:37 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [15.11.2010 21:39 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.8.2008 16:53 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.8.2008 16:53 17744]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [27.1.2008 13:11 114496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 WDDMService;WDDMService;"c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe" --> c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [?]
S2 WDFME;WD File Management Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [?]
S2 WDSC;WD File Management Shadow Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [16.10.2010 19:14 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-11-16 c:\windows\Tasks\NeroLiveEpgUpdate-ASM-PC_admin.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
mStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Link to &MidpX - c:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
Trusted Zone: facebook.com\login
Trusted Zone: mojebanka.cz\www
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-17 12:40
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2152)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-11-17 12:44:33
ComboFix-quarantined-files.txt 2010-11-17 11:44
ComboFix2.txt 2010-11-16 22:35
ComboFix3.txt 2010-11-16 21:39

Před spuštěním: Volných bajtů: 233 037 856 768
Po spuštění: Volných bajtů: 233 052 700 672

- - End Of File - - 4C1E5A43FEBEAFAC9DB6988D99B0B30C

Stále se nepodařilo nakopírovat zpět cdrom.sys. Měl by být v C:\windows\ServicePackFiles\i386 . Pokud tam není, použijte ten, který vám pošlu. Rozbalte ho na plochu. Pak bude skript vypadat takto:

FCopy::
c:\documents and settings\admin\Plocha\cdrom.sys | c:\windows\system32\drivers\cdrom.sys

ComboFix 10-11-16.02 - admin 17.11.2010 13:21:55.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.293 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\documents and settings\admin\Plocha\cdrom.sys --> c:\windows\system32\drivers\cdrom.sys
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-17 do 2010-11-17 )))))))))))))))))))))))))))))))
.

2010-11-17 12:22 . 2008-04-13 22:10 62976 ----a-w- c:\windows\system32\drivers\OLD46.tmp
2010-11-17 12:22 . 2010-11-17 12:22 -------- d-----w- c:\windows\LastGood
2010-11-17 12:21 . 2004-08-03 21:59 49536 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
2010-11-17 12:21 . 2004-08-03 21:59 49536 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-11-16 19:16 . 2010-11-16 19:16 -------- dc----w- C:\rsit
2010-11-16 19:05 . 2010-11-16 19:05 -------- d-----w- c:\documents and settings\Administrator
2010-11-15 20:39 . 2010-09-07 15:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-11-15 19:30 . 2010-11-15 19:34 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-11-15 19:30 . 2010-11-15 19:30 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-11-15 19:25 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-15 19:24 . 2010-11-15 19:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2010-11-15 14:53 . 2010-11-15 19:36 311296 ----a-w- c:\windows\system32\ntcore.dll1
2010-11-14 16:30 . 2010-11-14 16:30 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\PCHealth
2010-11-06 09:46 . 2010-11-06 09:46 -------- d-----w- c:\program files\PLAY
2010-10-31 15:37 . 2010-10-31 15:38 -------- d-----w- c:\program files\DVD Decrypter
2010-10-30 14:20 . 2008-09-04 18:17 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2010-10-30 14:19 . 2010-10-30 14:19 -------- d-----w- c:\program files\Microsoft WSE
2010-10-29 07:25 . 2010-10-07 23:21 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DF626C9B-2C2B-4590-9D20-984229F5947A}\mpengine.dll
2010-10-27 11:22 . 2010-11-03 13:04 -------- d-----w- c:\documents and settings\admin\Local Settings\Data aplikací\Deployment
2010-10-19 16:28 . 2010-10-19 16:28 -------- d-----w- c:\documents and settings\admin\Data aplikací\InstantAction

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-14 19:49 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-16 09:43 6146896 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-27 06:17 . 2007-12-20 23:55 98304 ----a-w- c:\windows\DUMP6c37.tmp
2010-09-13 18:08 . 2008-10-19 16:54 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-13 18:08 . 2010-09-13 18:08 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-07 16:11 . 2007-12-25 18:13 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 15:52 . 2007-12-25 18:13 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 15:52 . 2008-08-05 15:53 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 15:47 . 2007-12-25 18:13 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 15:47 . 2007-12-25 18:13 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 15:47 . 2007-12-25 18:13 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 15:47 . 2008-08-05 15:53 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 15:46 . 2007-12-25 18:13 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-11-17_11.40.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-17 12:22 . 2008-04-13 22:10 62976 c:\windows\LastGood\system32\drivers\cdrom.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 16:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-29 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-12 16384512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-18 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\B2BPOKER\\Doxxbet\\jre\\bin\\javaw.exe"=
"f:\\Škola\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22658:TCP"= 22658:TCP:BitComet 22658 TCP
"22658:UDP"= 22658:UDP:BitComet 22658 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.1.2008 16:37 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [15.11.2010 21:39 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.8.2008 16:53 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.8.2008 16:53 17744]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [27.1.2008 13:11 114496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 WDDMService;WDDMService;"c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe" --> c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [?]
S2 WDFME;WD File Management Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [?]
S2 WDSC;WD File Management Shadow Engine;"c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe" --> c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [16.10.2010 19:14 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-11-16 c:\windows\Tasks\NeroLiveEpgUpdate-ASM-PC_admin.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
mStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Link to &MidpX - c:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Eurotran XP\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Eurotran XP\etnxp.dll
Trusted Zone: facebook.com\login
Trusted Zone: mojebanka.cz\www
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-17 13:31
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3144)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-11-17 13:35:45
ComboFix-quarantined-files.txt 2010-11-17 12:35
ComboFix2.txt 2010-11-17 11:44
ComboFix3.txt 2010-11-16 22:35
ComboFix4.txt 2010-11-16 21:39

Před spuštěním: Volných bajtů: 233 038 913 536
Po spuštění: Volných bajtů: 232 950 517 760

- - End Of File - - 777EE5F04C0BDC702437A9A62220BAF9

Už je to v pořádku, log vypadá čistý.

A mám ještě dotaz ohledně pípnutí před startem počítače. Zvuk je krátký a hlubší. Po pípnutí je zapotřebí stisknout F1.

Už můžu ComboFix odinstalovat ?

CF můžete odinstalovat, pokujd jinak PC korektně funguje.

A mám ještě dotaz ohledně pípnutí před startem počítače. Zvuk je krátký a hlubší. Po pípnutí je zapotřebí stisknout F1.

Dává systém nějakou hlášku?

něco takového :