zavirovanej svchost

[kotekdan]

Prosím o pomoc. Tady je log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Dann at 2010-12-12 16:36:05
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 9 GB (8%) free of 114 GB
Total RAM: 511 MB (24% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-04-24 2176000]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"wuaucldt"=c:\windows\system32\wuaucldt.exe [2010-11-23 33280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"wuaucldt"=c:\documents and settings\dann\wuaucldt.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6b5s70t.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\6b5s70t.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6y81kvw.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\6y81kvw.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^70aaqg0.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\70aaqg0.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^91kvwrx.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\91kvwrx.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^aa6mm6yy6kk.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\aa6mm6yy6kk.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^pllhxxtj.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\pllhxxtj.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^q3ssneezqql.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\q3ssneezqql.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^yjkfvwrhid.exe]
C:\Documents and Settings\Dann\Nabídka Start\Programy\Po spuštění\yjkfvwrhid.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-02-21 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\jghpxjtz.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\jghpxjtz.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\hlds.exe"="C:\Program Files\Valve\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Program Files\Valve 3\hl.exe"="C:\Program Files\Valve 3\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe"="C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\Documents and Settings\Dann\Plocha\TmDedicatedServer_2006-05-30\TmDedicatedServer\TrackManiaServer.exe"="C:\Documents and Settings\Dann\Plocha\TmDedicatedServer_2006-05-30\TmDedicatedServer\TrackManiaServer.exe:*:Enabled:TrackManiaServer"
"C:\Program Files\TrackMania Nations ESWC\TrackManiaServer.exe"="C:\Program Files\TrackMania Nations ESWC\TrackManiaServer.exe:*:Enabled:TrackManiaServer"
"C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe"="C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe:*:Enabled:vietcong"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Documents and Settings\Dann\Plocha\VC 10\Vietcong.exe"="C:\Documents and Settings\Dann\Plocha\VC 10\Vietcong.exe:*:Enabled:Vietcong"
"C:\Program Files\VC 10\Vietcong.exe"="C:\Program Files\VC 10\Vietcong.exe:*:Enabled:Vietcong"
"C:\Documents and Settings\Dann\Plocha\Vietcong\Vietcong.exe"="C:\Documents and Settings\Dann\Plocha\Vietcong\Vietcong.exe:*:Enabled:Vietcong"
"C:\Program Files\Aptana\jre\bin\javaw.exe"="C:\Program Files\Aptana\jre\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\VIETCONG\vietcong.exe"="C:\Program Files\VIETCONG\vietcong.exe:*:Enabled:vietcong"
"C:\Vietcong\VietCong.exe"="C:\Vietcong\VietCong.exe:*:Enabled:VietCong"
"C:\Documents and Settings\Dann\Plocha\B2_chosen\Blood II The Chosen RIP\BLOOD2\CLIENT.EXE"="C:\Documents and Settings\Dann\Plocha\B2_chosen\Blood II The Chosen RIP\BLOOD2\CLIENT.EXE:*:Enabled:Client"
"C:\Documents and Settings\Dann\Plocha\B2_chosen\Blood II The Chosen RIP\BLOOD2\BLOOD2SV.EXE"="C:\Documents and Settings\Dann\Plocha\B2_chosen\Blood II The Chosen RIP\BLOOD2\BLOOD2SV.EXE:*:Enabled:Blood2 Stand-Alone Server"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\VIETCONG\vcded.exe"="C:\Program Files\VIETCONG\vcded.exe:*:Enabled:vcded"
"C:\Documents and Settings\Dann\Plocha\NFS und.2\Need for Speed Underground 2\SPEED2.EXE"="C:\Documents and Settings\Dann\Plocha\NFS und.2\Need for Speed Underground 2\SPEED2.EXE:*:Enabled:SPEED2"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Documents and Settings\Dann\Plocha\VC1.20\Vietcong.exe"="C:\Documents and Settings\Dann\Plocha\VC1.20\Vietcong.exe:*:Enabled:Vietcong"
"C:\Documents and Settings\Dann\Plocha\VC1.20\vcded.exe"="C:\Documents and Settings\Dann\Plocha\VC1.20\vcded.exe:*:Enabled:vcded"
"C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe"="C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"C:\VC1.20\Vietcong.exe"="C:\VC1.20\Vietcong.exe:*:Enabled:Vietcong"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\Miranda IM KP v5.0.8.15\miranda32.exe"="C:\Program Files\Miranda IM KP v5.0.8.15\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Return to Castle Wolfenstein\WolfMP.exe"="C:\Program Files\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Disabled:aolload.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour"
"C:\Documents and Settings\Dann\Plocha\Vietcong\cept_CLIENT.exe"="C:\Documents and Settings\Dann\Plocha\Vietcong\cept_CLIENT.exe:*:Disabled:CE Port Test"
"C:\Program Files\Dude\dudes.exe"="C:\Program Files\Dude\dudes.exe:*:Disabled:dudes"
"C:\Documents and Settings\Dann\Local Settings\Temp\Rar$EX00.797\EZTelnet\EZTelnet.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\Rar$EX00.797\EZTelnet\EZTelnet.exe:*:Disabled:EZTelnet, Telnet Server"
"C:\Documents and Settings\Dann\Local Settings\Temp\Rar$EX00.297\EZTelnet\EZTelnet.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\Rar$EX00.297\EZTelnet\EZTelnet.exe:*:Disabled:EZTelnet, Telnet Server"
"C:\Downloads\TeamSpeak Hacks\TS Flooder\Ts Flooder (not @ free hack)\flood.exe"="C:\Downloads\TeamSpeak Hacks\TS Flooder\Ts Flooder (not @ free hack)\flood.exe:*:Disabled:flood"
"C:\Downloads\TeamSpeak Hacks\TS Flooder\Free-Hack - blubablub - EasyFlooder\EasyFlooder 1.3\flood.exe"="C:\Downloads\TeamSpeak Hacks\TS Flooder\Free-Hack - blubablub - EasyFlooder\EasyFlooder 1.3\flood.exe:*:Disabled:flood"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Disabled:Nokia Service Layer Host Process "
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Disabled:Nokia Software Updater"
"C:\Documents and Settings\Dann\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe"="C:\Documents and Settings\Dann\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Disabled:Octoshape add-in for Adobe Flash Player"
"C:\Documents and Settings\Dann\Local Settings\Temp\pylE0.tmp\pyrun.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\pylE0.tmp\pyrun.exe:*:Disabled:pyrun"
"C:\Documents and Settings\Dann\Local Settings\Temp\pyl4.tmp\pyrun.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\pyl4.tmp\pyrun.exe:*:Disabled:pyrun"
"C:\Documents and Settings\Dann\Local Settings\Temp\pyl3.tmp\pyrun.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\pyl3.tmp\pyrun.exe:*:Disabled:pyrun"
"C:\Documents and Settings\Dann\Local Settings\Temp\pyl2.tmp\pyrun.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\pyl2.tmp\pyrun.exe:*:Disabled:pyrun"
"C:\Documents and Settings\Dann\Local Settings\Temp\pyl1.tmp\pyrun.exe"="C:\Documents and Settings\Dann\Local Settings\Temp\pyl1.tmp\pyrun.exe:*:Disabled:pyrun"
"C:\Program Files\NCH Software\ScreenStream\screenstream.exe"="C:\Program Files\NCH Software\ScreenStream\screenstream.exe:*:Disabled:screenstream"
"C:\Downloads\TeamSpeak Hacks\TS Flooder\TeamSpeak-Spam\Spamer.exe"="C:\Downloads\TeamSpeak Hacks\TS Flooder\TeamSpeak-Spam\Spamer.exe:*:Disabled:Spamer"
"C:\Documents and Settings\Dann\Plocha\srct\server\srct_server.exe"="C:\Documents and Settings\Dann\Plocha\srct\server\srct_server.exe:*:Disabled:srct_server"
"C:\Documents and Settings\Dann\Plocha\server\srct_server.exe"="C:\Documents and Settings\Dann\Plocha\server\srct_server.exe:*:Disabled:srct_server"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Eidos\Praetorians\Praetorians.exe"="C:\Program Files\Eidos\Praetorians\Praetorians.exe:*:Enabled:Praetorians"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Application"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync RAPI Manager"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Disabled:BitComet.exe"
"C:\Documents and Settings\Dann\Plocha\My Mobile\MyMobiler\MyMobiler.exe"="C:\Documents and Settings\Dann\Plocha\My Mobile\MyMobiler\MyMobiler.exe:*:Disabled:My Mobiler"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\System32\svchost.exe"="C:\WINDOWS\System32\svchost.exe:*:Enabled:Microsoft Office"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-12-12 15:58:24 ----RD---- C:\32788R22FWJFW
2010-12-12 15:52:32 ----D---- C:\Qoobox
2010-12-12 15:30:55 ----D---- C:\Program Files\trend micro
2010-12-12 15:30:52 ----D---- C:\rsit
2010-12-01 17:17:09 ----D---- C:\$WINDOWS.~LS
2010-12-01 17:15:42 ----D---- C:\$WINDOWS.~BT
2010-11-30 20:53:46 ----A---- C:\WINDOWS\OEWABLog.txt
2010-11-23 18:05:11 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-11-23 18:05:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-11-23 15:36:23 ----A---- C:\WINDOWS\system32\wuaucldt.exe
2010-11-22 14:39:10 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2010-11-22 14:39:09 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2010-11-22 14:37:51 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2010-11-22 14:37:48 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2010-11-22 14:37:41 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2010-11-22 14:37:40 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2010-11-22 14:37:30 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2010-11-22 14:30:59 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-11-22 14:30:43 ----D---- C:\Program Files\Alwil Software
2010-11-22 14:30:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-11-21 19:33:50 ----D---- C:\Program Files\Windows Defender
2010-11-21 19:04:39 ----D---- C:\WINDOWS\pss
2010-11-21 15:03:19 ----RA---- C:\Documents and Settings\Dann\Data aplikací\BG0Ai.txt
2010-11-21 12:19:51 ----HD---- C:\WINDOWS\PIF

======List of files/folders modified in the last 1 months======

2010-12-12 16:36:42 ----AD---- C:\WINDOWS\Temp
2010-12-12 16:28:23 ----SD---- C:\WINDOWS\Tasks
2010-12-12 16:21:08 ----D---- C:\WINDOWS
2010-12-12 16:20:30 ----D---- C:\WINDOWS\Prefetch
2010-12-12 15:30:55 ----RD---- C:\Program Files
2010-12-12 13:35:16 ----D---- C:\Program Files\Spyware Terminator
2010-12-12 13:34:57 ----D---- C:\Documents and Settings\Dann\Data aplikací\Spyware Terminator
2010-12-09 19:54:17 ----D---- C:\WINDOWS\Minidump
2010-12-04 15:57:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-12-02 17:35:14 ----D---- C:\WINDOWS\system32\CatRoot2
2010-12-01 20:43:10 ----D---- C:\Program Files\EPSON
2010-12-01 20:43:08 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-01 20:36:10 ----D---- C:\Documents and Settings\Dann\Data aplikací\teamspeak2
2010-12-01 17:09:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-11-30 20:54:00 ----SHD---- C:\WINDOWS\Installer
2010-11-30 20:52:49 ----D---- C:\Documents and Settings
2010-11-25 16:03:25 ----D---- C:\Program Files\Mozilla Firefox
2010-11-25 16:03:07 ----D---- C:\Documents and Settings\Dann\Data aplikací\Mozilla
2010-11-24 17:57:57 ----D---- C:\WINDOWS\system32\drivers
2010-11-23 19:27:28 ----RASH---- C:\boot.ini
2010-11-23 18:26:00 ----D---- C:\WINDOWS\system32\drivers\etc
2010-11-23 15:59:44 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-11-23 15:36:23 ----D---- C:\WINDOWS\system32
2010-11-22 16:39:01 ----D---- C:\Program Files\Valve
2010-11-22 14:33:26 ----D---- C:\WINDOWS\WinSxS
2010-11-22 13:11:09 ----A---- C:\WINDOWS\system.ini
2010-11-21 19:33:51 ----HD---- C:\WINDOWS\inf
2010-11-21 19:28:36 ----A---- C:\WINDOWS\system32\MRT.exe
2010-11-21 18:37:19 ----D---- C:\Downloads
2010-11-21 17:28:57 ----D---- C:\Docs
2010-11-21 15:01:18 ----D---- C:\Program Files\Internet Explorer
2010-11-21 12:36:10 ----A---- C:\WINDOWS\imsins.BAK
2010-11-21 12:35:40 ----D---- C:\WINDOWS\ie8updates
2010-11-21 12:35:02 ----HD---- C:\WINDOWS\$hf_mig$
2010-11-21 11:41:22 ----RSHD---- C:\RECYCLER

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2008-04-13 46464]
R0 Lbd;Lbd; C:\WINDOWS\system32\DRIVERS\Lbd.sys [2009-04-24 64160]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-05-01 721904]
R0 viaagp1;VIA AGP Filter; C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2003-07-02 27904]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-05-08 35840]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 ATITool;ATITool Overclocking Utility; C:\WINDOWS\system32\DRIVERS\ATITool.sys [2006-11-10 24064]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R1 VD_FileDisk;VD_FileDisk; C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-18 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-18 55936]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-09-21 2278784]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-02-21 1505792]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-04-13 70144]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 CCDevice;CCDevice; C:\WINDOWS\system32\drivers\CCDevice.sys []
S3 axgvagcp;axgvagcp; C:\WINDOWS\system32\drivers\axgvagcp.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-08-13 25280]
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys []
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys []
S3 NPF;Netgroup Packet Filter; C:\WINDOWS\system32\drivers\npf.sys []
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 PAC207;VideoCAM GF112; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Pomocná služba protokolu IPv6; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-02-21 405504]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe [2002-07-17 94208]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-05-06 152984]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-04-24 487424]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S2 t1acvodattuyjo;Asset Management Daemon; C:\WINDOWS\system32\soogylou.exe []
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-06-10 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-05 1029456]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-03-04 621056]
S3 wampapache;wampapache; c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe [2008-12-10 24636]
S3 wampmysqld;wampmysqld; c:\wamp\bin\mysql\mysql5.1.33\bin\mysqld.exe [2009-03-16 6562432]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[kotekdan]

To bude nejspíš problém, protože mi ComboFix nejde spustit. Nejspíš mi to blokuje rezidentní štít SpywareTerminator, problém je že když ho vypnu tak se celej PC sekne a musim ho resetovat

[Rudy]

Zkuste to v nouz. režimu.

[kotekdan]

Tak jsem ten combofix rozběhl, vyskočilo mi tam nějaké okno, dal sem ano.. pak se něco načítalo, pak to zmizelo a nic tam není. Koukl bych se do procesů jesli to běží, ale tam se nedostanu, hází mi to nějakou chybu
Co s tím?

[Rudy]

OK. Udělejte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log.

[kotekdan]

tak se mi to nakonec povedlo tím Combofixem :

ComboFix 10-12-11.06 - Dann 12.12.2010 18:43:29.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.166 [GMT 1:00]
Spuštěný z: c:\documents and settings\Dann\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Spyware Terminator *Enabled/Updated* {55EE49A8-16BE-4601-BBE6-607B7F7317DE}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Dann\secupdat.dat
c:\windows\system32\drivers\wcscd.sys
c:\windows\system32\mxpvct22.dat
c:\windows\system32\mxpvct25.dat
c:\windows\system32\secupdat.dat
c:\windows\system32\wuaucldt.exe
c:\windows\wpe pro.INI

c:\windows\system32\drivers\cdrom.sys chyběl.
Obnovena kopie z - c:\windows\system32\dllcache\cdrom.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CDFSS
-------\Legacy_NPF
-------\Service_cdfss
-------\Service_NPF
-------\Service_wcscd


((((((((((((((((((((((((( Soubory vytvořené od 2010-11-12 do 2010-12-12 )))))))))))))))))))))))))))))))
.

2010-12-12 18:19 . 2008-04-13 19:40 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
2010-12-12 18:19 . 2008-04-13 19:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-12-12 14:30 . 2010-12-12 14:30 -------- d-----w- c:\program files\trend micro
2010-12-12 14:30 . 2010-12-12 14:31 -------- d-----w- C:\rsit
2010-12-01 16:17 . 2010-12-01 16:17 -------- d-----w- C:\$WINDOWS.~LS
2010-12-01 16:15 . 2010-12-01 16:15 -------- d-----w- C:\$WINDOWS.~BT
2010-11-30 19:52 . 2010-11-30 19:53 -------- d-----w- c:\documents and settings\Testing
2010-11-23 17:05 . 2010-11-24 16:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-23 17:05 . 2010-11-23 17:12 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-11-22 13:39 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-11-22 13:39 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-11-22 13:37 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-11-22 13:37 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-11-22 13:37 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-11-22 13:37 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-11-22 13:37 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-11-22 13:31 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-22 13:30 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-11-22 13:30 . 2010-11-22 13:30 -------- d-----w- c:\program files\Alwil Software
2010-11-22 13:30 . 2010-11-22 13:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2010-11-21 18:35 . 2007-03-09 10:25 2321288 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2010-11-21 18:34 . 2010-11-16 11:01 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\{D837DA54-3B0F-49E5-8154-67AC02645439}\mpengine.dll
2010-11-21 18:33 . 2010-11-21 18:33 -------- d-----w- c:\program files\Windows Defender
2010-11-21 11:19 . 2010-11-21 11:19 -------- d--h--w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-24 09:44 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-18 10:23 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Silvie\Nabˇdka Start\Programy\Po spuçtŘnˇ\
prf13B.tmp [2009-5-10 0]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"TaskMan"="c:\recycler\S-1-5-21-7136779289-0155492040-107834160-9524\yv8g67.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6b5s70t.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\6b5s70t.exe
backup=c:\windows\pss\6b5s70t.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6y81kvw.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\6y81kvw.exe
backup=c:\windows\pss\6y81kvw.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^70aaqg0.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\70aaqg0.exe
backup=c:\windows\pss\70aaqg0.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^91kvwrx.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\91kvwrx.exe
backup=c:\windows\pss\91kvwrx.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^aa6mm6yy6kk.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\aa6mm6yy6kk.exe
backup=c:\windows\pss\aa6mm6yy6kk.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^pllhxxtj.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\pllhxxtj.exe
backup=c:\windows\pss\pllhxxtj.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^q3ssneezqql.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\q3ssneezqql.exe
backup=c:\windows\pss\q3ssneezqql.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^yjkfvwrhid.exe]
path=c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\yjkfvwrhid.exe
backup=c:\windows\pss\yjkfvwrhid.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 18:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\Valve 3\\hl.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TrackManiaServer.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\VC 10\\Vietcong.exe"=
"c:\\Documents and Settings\\Dann\\Plocha\\Vietcong\\Vietcong.exe"=
"c:\\Program Files\\VIETCONG\\vietcong.exe"=
"c:\\Vietcong\\VietCong.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\VIETCONG\\vcded.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\VC1.20\\Vietcong.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\ICQ7.1\\ICQ.exe"=
"c:\\Program Files\\Miranda IM KP v5.0.8.15\\miranda32.exe"=
"c:\\Program Files\\Return to Castle Wolfenstein\\WolfMP.exe"=
"c:\\Program Files\\ICQ7.1\\aolload.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Dann\\Plocha\\srct\\server\\srct_server.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Eidos\\Praetorians\\Praetorians.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Dann\\Plocha\\My Mobile\\MyMobiler\\MyMobiler.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12426:TCP"= 12426:TCP:*:Disabled:BitComet 12426 TCP
"12426:UDP"= 12426:UDP:*:Disabled:BitComet 12426 UDP

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [24.4.2009 19:47 64160]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1.5.2009 17:16 721904]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [22.11.2010 14:39 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [24.4.2009 19:36 142592]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22.11.2010 14:39 17744]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S1 CCDevice;CCDevice; [x]
S2 t1acvodattuyjo;Asset Management Daemon;c:\windows\system32\soogylou.exe --> c:\windows\system32\soogylou.exe [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 22:34 1029456]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys --> c:\windows\system32\drivers\nmwcdnsu.sys [?]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys --> c:\windows\system32\drivers\nmwcdnsuc.sys [?]
S3 PAC207;VideoCAM GF112;c:\windows\system32\drivers\pfc027.sys [8.4.2005 10:46 162176]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:49]

2010-12-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
TCP: {F8A0228B-8C3F-47B6-97E3-E8C2690F1E07} = 10.100.1.254,212.24.128.8
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

SafeBoot-jghpxjtz.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-12 19:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2976)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\NOTEPAD.EXE
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Celkový čas: 2010-12-12 19:42:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-12 18:42

Před spuštěním: 9 430 528 000
Po spuštění: 9 434 357 760

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT
[spybotsd]
timeout.old=30

- - End Of File - - 2FD5B1D7346FA8FAAD97465AEE294BC9

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\documents and settings\Silvie\Nabídka Start\Programy\Po spuštění\prf13B.tmp
c:\recycler\S-1-5-21-7136779289-0155492040-107834160-9524\yv8g67.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\6b5s70t.exe
c:\windows\pss\6b5s70t.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\6y81kvw.exe
c:\windows\pss\6y81kvw.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\70aaqg0.exe
c:\windows\pss\70aaqg0.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\91kvwrx.exe
c:\windows\pss\91kvwrx.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\aa6mm6yy6kk.exe
c:\windows\pss\aa6mm6yy6kk.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\pllhxxtj.exe
c:\windows\pss\pllhxxtj.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\q3ssneezqql.exe
c:\windows\pss\q3ssneezqql.exe
c:\documents and settings\Dann\Nabídka Start\Programy\Po spuštění\yjkfvwrhid.exe
c:\windows\pss\yjkfvwrhid.exe
c:\windows\system32\soogylou.exe

Driver::
t1acvodattuyjo

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^yjkfvwrhid.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^q3ssneezqql.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^pllhxxtj.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^aa6mm6yy6kk.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^91kvwrx.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^70aaqg0.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6y81kvw.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Dann^Nabídka Start^Programy^Po spuštění^6b5s70t.exe]

Uložte na plochu jako CFScript.txt. Pak jej myší mpřetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[kotekdan]

Provedeno... Všechno se zdá být v pořádku, děkuji moc!

[Rudy]

Nemáte zač!