VIRY.CZ

predem bych chtel informovat že na pc mam naistalovane 3 winy... .)

LOG Z RSIT



Logfile of random's system information tool 1.08 (written by random/random)
Run by breta at 2010-12-18 11:45:40
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 9 GB (30%) free of 30 GB
Total RAM: 1023 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:00, on 18.12.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOW\System32\smss.exe
C:\WINDOW\system32\winlogon.exe
C:\WINDOW\system32\services.exe
C:\WINDOW\system32\lsass.exe
C:\WINDOW\system32\Ati2evxx.exe
C:\WINDOW\system32\svchost.exe
C:\WINDOW\System32\svchost.exe
C:\WINDOW\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOW\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOW\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOW\SOUNDMAN.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOW\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOW\system32\wuauclt.exe
C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOW\system32\svchost.exe
C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\breta\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\breta.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60347
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crawler.com/homepage.aspx?tbid=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60347
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOW\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [MultiCalc] C:\Program Files\MultiCalc\MultiCalc.exe WinStart
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOW\system32\Macromed\Flash\FlashUtil10i_ActiveX.exe -update activex
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOW\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOW\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\DOCUME~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\window\system32\nwprovau.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{158AAD56-A49D-4120-9982-96110D811D5D}: NameServer = 213.192.40.6,77.48.254.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{158AAD56-A49D-4120-9982-96110D811D5D}: NameServer = 213.192.40.6,77.48.254.254
O17 - HKLM\System\CS3\Services\Tcpip\..\{158AAD56-A49D-4120-9982-96110D811D5D}: NameServer = 213.192.40.6,77.48.254.254
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOW\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOW\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOW\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOW\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOW\system32\GameMon.des.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O24 - Desktop Component 0: (no name) - http://mail.centrum.cz/img/js76dfa9/ego.orig.js

--
End of file - 9716 bytes

======Scheduled tasks folder======

C:\WINDOW\tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1757981266-839522115-1003Core.job
C:\WINDOW\tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1757981266-839522115-1003UA.job
C:\WINDOW\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-08-10 1242064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-16 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-09-16 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-08-10 1242064]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-11-30 344064]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2004-11-30 32768]
"SoundMan"=C:\WINDOW\SOUNDMAN.EXE [2007-04-16 577536]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2010-08-24 2176512]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\breta\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-08-14 136176]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-08-24 3037696]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]
"ctfmon.exe"=C:\WINDOW\system32\ctfmon.exe [2004-08-17 15360]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2010-08-20 33120]
"MultiCalc"=C:\Program Files\MultiCalc\MultiCalc.exe WinStart []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOW\system32\Macromed\Flash\FlashUtil10i_ActiveX.exe [2010-08-11 232912]

C:\Documents and Settings\All Users.WINDOW\Nabídka Start\Programy\Po spuštění
ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOW\system32\Ati2evxx.dll [2004-12-01 94208]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Program Files\World of Warcraft\Launcher.exe"="D:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"D:\Program Files\BF2.exe"="D:\Program Files\BF2.exe:*:Enabled:Battlefield 2"
"D:\Program Files\World of Warcraft\Repair.exe"="D:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Repair"
"D:\Documents and Settings\Warcraft III Demo\War3Demo.exe"="D:\Documents and Settings\Warcraft III Demo\War3Demo.exe:*:Enabled:Warcraft III Demo"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"D:\Documents and Settings\Warcraft III\Warcraft III.exe"="D:\Documents and Settings\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\hra\BlackShot\BlackShot\system\BlackShot.exe"="D:\hra\BlackShot\BlackShot\system\BlackShot.exe:*:Enabled:BlackShot"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-12-17 17:26:00 ----A---- C:\WINDOW\system32\npptNT2.sys
2010-12-04 18:00:33 ----D---- C:\Program Files\PhotoFiltre

======List of files/folders modified in the last 1 months======

2010-12-18 11:45:47 ----D---- C:\WINDOW\Prefetch
2010-12-18 11:45:43 ----D---- C:\Program Files\Trend Micro
2010-12-18 11:40:49 ----D---- C:\WINDOW\Temp
2010-12-18 11:23:01 ----D---- C:\Documents and Settings\breta\Data aplikací\Skype
2010-12-18 10:15:27 ----D---- C:\WINDOW\system32
2010-12-18 09:42:32 ----D---- C:\WINDOW\system32\drivers
2010-12-18 08:22:17 ----D---- C:\WINDOW
2010-12-17 21:22:46 ----A---- C:\WINDOW\SchedLgU.Txt
2010-12-17 17:14:07 ----D---- C:\Program Files\Garena
2010-12-17 16:04:26 ----D---- C:\Documents and Settings\breta\Data aplikací\skypePM
2010-12-16 15:09:47 ----A---- C:\WINDOW\system32\MRT.exe
2010-12-15 20:28:01 ----D---- C:\Program Files\Mozilla Firefox
2010-12-13 20:52:16 ----D---- C:\Documents and Settings\All Users.WINDOW\Data aplikací\Spyware Terminator
2010-12-11 14:38:05 ----D---- C:\WINDOW\system32\CatRoot2
2010-12-11 11:28:31 ----D---- C:\Documents and Settings\breta\Data aplikací\Spyware Terminator
2010-12-11 11:28:20 ----D---- C:\Program Files\Spyware Terminator
2010-12-06 19:23:41 ----HD---- C:\WINDOW\inf
2010-12-04 18:00:33 ----RD---- C:\Program Files
2010-11-21 18:29:57 ----D---- C:\Program Files\Common Files
2010-11-21 18:28:12 ----D---- C:\Documents and Settings\breta\Data aplikací\Macromedia
2010-11-21 18:26:31 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOW\system32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOW\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOW\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOW\System32\drivers\sfsync02.sys [2005-08-10 19968]
R0 sptd;sptd; C:\WINDOW\System32\Drivers\sptd.sys [2010-11-13 436792]
R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOW\system32\DRIVERS\uagp35.sys [2004-08-04 44672]
R0 viaagp1;VIA AGP Filter; C:\WINDOW\system32\DRIVERS\viaagp1.sys [2003-07-01 27904]
R0 viasraid;viasraid; C:\WINDOW\system32\DRIVERS\viasraid.sys [2003-06-12 75904]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOW\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOW\system32\DRIVERS\amdk7.sys [2004-08-17 41216]
R1 aswSP;aswSP; C:\WINDOW\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\WINDOW\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOW\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOW\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOW\system32\drivers\aswMon2.sys [2010-09-07 100176]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOW\system32\drivers\ALCXWDM.SYS [2007-04-25 4030144]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOW\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
R3 aswRdr;aswRdr; C:\WINDOW\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 ati2mtag;ati2mtag; C:\WINDOW\system32\DRIVERS\ati2mtag.sys [2004-12-01 928256]
R3 NIC1394;1394 Net Driver; C:\WINDOW\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
R3 RTL8023;Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver; C:\WINDOW\system32\DRIVERS\Rtlnic51.sys [2003-08-13 65280]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOW\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 a1we21he;a1we21he; C:\WINDOW\system32\drivers\a1we21he.sys []
S3 agoby1qc;agoby1qc; C:\WINDOW\system32\drivers\agoby1qc.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\breta\LOCALS~1\Temp\catchme.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\breta\LOCALS~1\Temp\VWK17C.tmp []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files\Garena\safedrv.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOW\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOW\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOW\system32\Ati2evxx.exe [2004-12-01 425984]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-16 153376]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-08-24 488960]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S2 ATI Smart;ATI Smart; C:\WINDOW\system32\ati2sgag.exe [2004-11-30 516096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOW\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOW\system32\GameMon.des [2010-10-11 3641832]

-----------------EOF-----------------


diky

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

počitač se mi jevil jako zavirovany ,proto jsem k avastu pridal nejakou ochranu lištu na mozilu crawler nebo tak neco, pak spybot a spyware terminator, je možne že se to navzajem bije??


ComboFix 10-12-17.02 - breta 18.12.2010 14:27:17.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.567 [GMT 1:00]
Spuštěný z: c:\documents and settings\breta\Dokumenty\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\breta\DokumentyEcI67h_save2pc.exe
c:\documents and settings\breta\DokumentyKpD2Ec_save2pc.exe
c:\documents and settings\breta\DokumentyMcV1Gr_save2pc.exe
c:\documents and settings\breta\DokumentyTyQ22d_save2pc.exe
c:\documents and settings\breta\DokumentyUrF0Op_save2pc.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-18 do 2010-12-18 )))))))))))))))))))))))))))))))
.

2010-12-17 16:26 . 2010-10-11 08:50 3641832 ----a-w- c:\window\system32\GameMon.des
2010-12-17 16:26 . 2005-01-03 06:43 4682 ----a-w- c:\window\system32\npptNT2.sys
2010-12-17 16:25 . 2003-07-19 15:17 5174 ----a-w- c:\window\system32\nppt9x.vxd
2010-12-04 17:00 . 2010-12-04 17:03 -------- d-----w- c:\program files\PhotoFiltre

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-13 14:06 . 2010-08-28 13:48 436792 ----a-w- c:\window\system32\drivers\sptd.sys
2010-10-24 16:17 . 2010-10-24 16:16 249856 ------w- c:\window\Setup1.exe
2010-10-24 16:17 . 2010-10-24 16:16 73216 ----a-w- c:\window\ST6UNST.EXE
2010-10-11 16:15 . 2010-10-11 16:15 98304 ----a-w- c:\window\system32\CmdLineExt.dll
2010-10-02 15:46 . 2004-07-17 09:36 163644 ----a-w- c:\window\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-08-24_09.12.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-28 14:10 . 2010-08-29 08:10 88961 c:\window\War3Unin.dat
+ 2010-12-18 13:21 . 2010-12-18 13:21 16384 c:\window\Temp\Perflib_Perfdata_a4.dat
+ 2010-10-29 15:41 . 2005-12-05 16:07 61136 c:\window\system32\xinput9_1_0.dll
+ 2010-10-29 15:41 . 2006-07-28 07:30 62744 c:\window\system32\xinput1_2.dll
+ 2010-10-29 15:41 . 2006-03-31 10:39 62672 c:\window\system32\xinput1_1.dll
+ 2010-10-29 15:41 . 2006-02-03 06:41 14032 c:\window\system32\x3daudio1_0.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 30749 c:\window\system32\vbajet32.dll
+ 2004-08-17 15:49 . 2004-08-17 15:49 30749 c:\window\system32\vbajet32.dll
+ 1998-06-17 22:00 . 1998-06-17 22:00 89360 c:\window\system32\VB5DB.DLL
+ 2010-08-27 06:18 . 2010-08-27 06:19 65292 c:\window\system32\Restore\rstrlog.dat
+ 2001-10-25 12:00 . 2010-10-31 06:21 52764 c:\window\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-08-16 17:17 52764 c:\window\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-10-31 06:21 61958 c:\window\system32\perfc005.dat
- 2001-10-25 12:00 . 2010-08-16 17:17 61958 c:\window\system32\perfc005.dat
+ 2010-09-03 19:07 . 2010-09-03 19:07 86016 c:\window\system32\OpenAL32.dll
+ 1998-04-23 22:00 . 1998-04-23 22:00 24848 c:\window\system32\MSJTER35.DLL
+ 2005-08-10 14:06 . 2005-08-10 14:06 19968 c:\window\system32\drivers\sfsync02.sys
+ 2005-08-10 12:44 . 2005-08-10 12:44 50688 c:\window\system32\drivers\sfdrv01.sys
- 2010-08-11 13:57 . 2010-06-28 20:37 46672 c:\window\system32\drivers\aswTdi.sys
+ 2010-08-11 13:57 . 2010-09-07 14:52 46672 c:\window\system32\drivers\aswTdi.sys
- 2010-08-11 13:57 . 2010-06-28 20:33 23376 c:\window\system32\drivers\aswRdr.sys
+ 2010-08-11 13:57 . 2010-09-07 14:47 23376 c:\window\system32\drivers\aswRdr.sys
- 2010-08-11 13:57 . 2010-06-28 20:32 94544 c:\window\system32\drivers\aswmon.sys
+ 2010-08-11 13:57 . 2010-09-07 14:47 94544 c:\window\system32\drivers\aswmon.sys
- 2010-08-11 13:57 . 2010-06-28 20:32 17744 c:\window\system32\drivers\aswFsBlk.sys
+ 2010-08-11 13:57 . 2010-09-07 14:47 17744 c:\window\system32\drivers\aswFsBlk.sys
+ 2010-08-11 13:57 . 2010-09-07 14:46 28880 c:\window\system32\drivers\aavmker4.sys
- 2010-08-11 13:57 . 2010-06-28 20:32 28880 c:\window\system32\drivers\aavmker4.sys
+ 2004-08-17 15:49 . 2004-08-17 15:49 30749 c:\window\system32\dllcache\vbajet32.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 30749 c:\window\system32\dllcache\vbajet32.dll
+ 2004-08-17 15:49 . 2010-03-05 14:57 65536 c:\window\system32\dllcache\asycfilt.dll
- 2004-08-17 13:49 . 2010-03-05 14:57 65536 c:\window\system32\dllcache\asycfilt.dll
+ 2010-10-16 11:32 . 2000-02-02 14:30 22528 c:\window\system32\csthread.dll
+ 2010-10-16 11:32 . 2001-03-08 07:32 32256 c:\window\system32\cdvccodc.dll
+ 2004-08-17 15:49 . 2010-03-05 14:57 65536 c:\window\system32\asycfilt.dll
- 2004-08-17 13:49 . 2010-03-05 14:57 65536 c:\window\system32\asycfilt.dll
+ 2001-03-02 18:52 . 2001-03-02 18:52 15360 c:\window\system32\asfsipc.dll
+ 2010-10-02 15:36 . 2010-10-02 15:36 14366 c:\window\Installer\{D0A05794-48C2-4424-A15A-9F20FCFDD374}\ARPPRODUCTICON.exe
+ 2010-08-11 13:56 . 2010-09-07 15:12 38848 c:\window\avastSS.scr
- 2010-08-11 13:56 . 2010-06-28 20:57 38848 c:\window\avastSS.scr
+ 2010-10-29 15:41 . 2010-10-29 15:41 12800 c:\window\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 12800 c:\window\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 53248 c:\window\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 53248 c:\window\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2010-08-28 14:10 . 2010-08-28 14:27 2829 c:\window\War3Unin.pif
+ 2001-03-02 18:52 . 2001-03-02 18:52 8704 c:\window\system32\npwmsdrm.dll
+ 2005-05-16 13:20 . 2005-05-16 13:20 6656 c:\window\system32\drivers\sfhlp02.sys
+ 2010-06-10 13:37 . 2010-06-10 13:37 655872 c:\window\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2010-06-10 13:37 . 2010-06-10 13:37 568832 c:\window\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2010-06-10 13:37 . 2010-06-10 13:37 224768 c:\window\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2006-12-01 20:54 . 2006-12-01 20:54 626688 c:\window\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 20:54 . 2006-12-01 20:54 548864 c:\window\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 20:54 . 2006-12-01 20:54 479232 c:\window\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2010-08-28 14:10 . 2010-08-28 14:27 139264 c:\window\War3Unin.exe
+ 2010-11-17 14:40 . 2008-12-04 20:46 180224 c:\window\system32\xvidvfw.dll
+ 2010-11-17 14:40 . 2008-12-04 20:42 815104 c:\window\system32\xvidcore.dll
+ 2007-02-18 10:06 . 2007-02-18 10:06 121856 c:\window\system32\xmllite.dll
+ 2010-10-29 15:41 . 2006-07-28 07:30 236824 c:\window\system32\xactengine2_3.dll
+ 2010-10-29 15:41 . 2006-05-31 05:24 230168 c:\window\system32\xactengine2_2.dll
+ 2010-10-29 15:41 . 2006-03-31 10:39 229584 c:\window\system32\xactengine2_1.dll
+ 2010-10-29 15:41 . 2006-02-03 06:42 230096 c:\window\system32\xactengine2_0.dll
+ 2010-09-03 19:07 . 2010-09-03 19:07 262144 c:\window\system32\wrap_oal.dll
+ 2001-05-09 14:50 . 2001-05-09 14:50 446464 c:\window\system32\wmvdmoe.dll
+ 2001-05-09 14:47 . 2001-05-09 14:47 466944 c:\window\system32\wmv8dmoe.dll
+ 2001-05-09 15:40 . 2001-05-09 15:40 309584 c:\window\system32\wmv8dmod.dll
+ 2010-09-28 07:47 . 2004-08-17 13:49 221184 c:\window\system32\wmpns.dll
+ 1998-06-17 22:00 . 1999-03-25 22:00 101888 c:\window\system32\VB6STKIT.DLL
+ 2000-04-03 15:52 . 2000-04-03 15:52 151552 c:\window\system32\RDOCURS.DLL
+ 2001-10-25 12:00 . 2010-10-31 06:21 380350 c:\window\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-08-16 17:17 380350 c:\window\system32\perfh009.dat
+ 2001-10-25 12:00 . 2010-10-31 06:21 379294 c:\window\system32\perfh005.dat
- 2001-10-25 12:00 . 2010-08-16 17:17 379294 c:\window\system32\perfh005.dat
+ 1998-04-23 21:00 . 1998-04-23 21:00 287504 c:\window\system32\MSXBSE35.DLL
+ 1998-04-23 21:00 . 1998-04-23 21:00 165648 c:\window\system32\MSTEXT35.DLL
+ 2000-05-24 05:45 . 2000-05-24 05:45 118784 c:\window\system32\msstdfmt.dll
+ 1998-04-23 22:00 . 1998-04-23 22:00 407312 c:\window\system32\MSREPL35.DLL
+ 2000-05-11 11:06 . 2000-05-11 11:06 397312 c:\window\system32\MSRDO20.DLL
+ 1998-04-23 22:00 . 1998-04-23 22:00 252176 c:\window\system32\MSRD2X35.DLL
+ 1998-04-23 21:00 . 1998-04-23 21:00 250128 c:\window\system32\MSPDOX35.DLL
+ 1998-04-23 21:00 . 1998-04-23 21:00 166160 c:\window\system32\MSLTUS35.DLL
+ 1998-04-23 22:00 . 1998-04-23 22:00 123664 c:\window\system32\MSJINT35.DLL
+ 1998-04-23 21:00 . 1998-04-23 21:00 330000 c:\window\system32\MSEXCH35.DLL
+ 1998-04-23 21:00 . 1998-04-23 21:00 250128 c:\window\system32\MSEXCL35.DLL
+ 2010-09-16 17:30 . 2010-09-16 17:30 153376 c:\window\system32\javaws.exe
+ 2010-09-16 17:30 . 2010-09-16 17:30 145184 c:\window\system32\javaw.exe
+ 2010-09-16 17:30 . 2010-09-16 17:30 145184 c:\window\system32\java.exe
+ 2004-08-17 15:49 . 2004-08-17 15:49 134144 c:\window\system32\itss.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 134144 c:\window\system32\itss.dll
+ 2004-08-17 15:49 . 2004-08-17 15:49 143872 c:\window\system32\itircl.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 143872 c:\window\system32\itircl.dll
+ 2010-10-16 11:32 . 2002-06-10 15:48 376832 c:\window\system32\hlcdvc.dll
+ 2010-07-29 20:26 . 2010-09-04 13:47 168304 c:\window\system32\FNTCACHE.DAT
- 2004-08-17 13:49 . 2004-08-17 13:49 380957 c:\window\system32\expsrv.dll
+ 2004-08-17 15:49 . 2004-08-17 15:49 380957 c:\window\system32\expsrv.dll
+ 2010-08-24 12:00 . 2010-08-24 12:00 142592 c:\window\system32\drivers\sp_rsdrv2.sys
+ 2010-08-11 13:57 . 2010-09-07 14:52 165584 c:\window\system32\drivers\aswSP.sys
- 2010-08-11 13:57 . 2010-06-28 20:32 100176 c:\window\system32\drivers\aswmon2.sys
+ 2010-08-11 13:57 . 2010-09-07 14:47 100176 c:\window\system32\drivers\aswmon2.sys
+ 2004-08-17 15:49 . 2004-08-17 15:49 134144 c:\window\system32\dllcache\itss.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 134144 c:\window\system32\dllcache\itss.dll
+ 2004-08-17 15:49 . 2004-08-17 15:49 143872 c:\window\system32\dllcache\itircl.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 143872 c:\window\system32\dllcache\itircl.dll
+ 2004-08-17 15:49 . 2004-08-17 15:49 380957 c:\window\system32\dllcache\expsrv.dll
- 2004-08-17 13:49 . 2004-08-17 13:49 380957 c:\window\system32\dllcache\expsrv.dll
+ 2010-09-16 17:30 . 2010-09-16 17:30 423656 c:\window\system32\deployJava1.dll
+ 1998-04-26 22:00 . 1998-04-26 22:00 570128 c:\window\system32\DAO350.DLL
+ 2010-10-16 11:32 . 2001-07-19 13:25 372736 c:\window\system32\csedv.dll
+ 2010-10-16 11:32 . 2001-07-19 13:26 102400 c:\window\system32\csccdvcx.dll
+ 2010-10-16 11:32 . 2001-07-19 13:25 118272 c:\window\system32\csccdvc.dll
+ 2010-08-11 13:56 . 2010-09-07 15:11 167592 c:\window\system32\aswBoot.exe
+ 2010-10-29 15:41 . 2006-03-31 09:27 578560 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2006-02-03 05:40 578560 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2005-12-05 15:20 577536 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2005-09-28 12:11 577536 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2005-07-22 15:21 577024 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2005-05-26 13:15 576000 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2005-02-05 17:32 563712 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-09-16 17:31 . 2010-09-16 17:31 180224 c:\window\Installer\1763b7.msi
+ 2010-09-16 17:29 . 2010-09-16 17:29 676352 c:\window\Installer\1763b1.msi
+ 2010-10-29 15:41 . 2010-10-29 15:41 223232 c:\window\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 223232 c:\window\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 178176 c:\window\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 178176 c:\window\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 364544 c:\window\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 364544 c:\window\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 159232 c:\window\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 159232 c:\window\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 145920 c:\window\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 145920 c:\window\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 578560 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 578560 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 577536 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 577536 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 577024 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 576000 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 567296 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 567296 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 563712 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 473600 c:\window\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2010-08-16 13:55 . 2010-08-16 13:55 473600 c:\window\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2001-10-25 14:00 . 2001-10-25 14:00 1388544 c:\window\system32\msvbvm60.dll
+ 1998-04-23 22:00 . 1998-04-23 22:00 1045776 c:\window\system32\MSJET35.DLL
+ 2010-10-29 15:41 . 2006-03-31 10:40 2388176 c:\window\system32\d3dx9_30.dll
+ 2010-10-29 15:41 . 2006-02-03 06:43 2332368 c:\window\system32\d3dx9_29.dll
+ 2010-10-29 15:41 . 2005-12-05 16:09 2323664 c:\window\system32\d3dx9_28.dll
+ 2010-10-29 15:41 . 2005-07-22 17:59 2319568 c:\window\system32\d3dx9_27.dll
+ 2010-10-29 15:41 . 2005-05-26 13:34 2297552 c:\window\system32\d3dx9_26.dll
+ 2010-08-26 15:18 . 2010-08-26 15:18 4681728 c:\window\system32\config\systemprofile\ntuser.dat
+ 2010-11-06 09:38 . 2004-01-27 19:50 1024000 c:\window\system32\3ivx.dll
+ 2010-10-29 15:41 . 2004-12-01 13:53 2846720 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2004-09-29 10:38 2676224 c:\window\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-02 15:35 . 2010-10-02 15:36 8455680 c:\window\Installer\9d82e0.msi
+ 2010-11-09 13:39 . 2010-11-09 13:39 3946496 c:\window\Installer\15bc9.msi
+ 2010-09-04 07:41 . 2010-09-04 07:41 3074560 c:\window\Installer\109a10.msi
+ 2010-10-29 15:41 . 2010-10-29 15:41 2846720 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-10-29 15:41 . 2010-10-29 15:41 2676224 c:\window\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-17 09:01 . 2010-12-16 14:09 37366216 c:\window\system32\MRT.exe
+ 2010-08-29 08:06 . 2010-08-29 08:06 10850668 c:\window\Downloaded Installations\{D0553B72-4AC5-4E83-9D69-78E484C35F51}\GameShadow.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\breta\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-08-14 136176]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-08-24 3037696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2010-08-20 33120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-30 344064]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-30 32768]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-08-24 2176512]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\window\system32\CTFMON.EXE" [2004-08-17 15360]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-30 32768]

c:\documents and settings\All Users.WINDOW\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2004-11-30 32768]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-8-28 561152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"d:\\Program Files\\BF2.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"d:\\Documents and Settings\\Warcraft III\\Warcraft III.exe"=
"d:\\hra\\BlackShot\\BlackShot\\system\\BlackShot.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 viasraid;viasraid;c:\window\system32\drivers\viasraid.sys [15.8.2010 10:00 75904]
R1 aswSP;aswSP;c:\window\system32\drivers\aswSP.sys [11.8.2010 14:57 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\window\system32\drivers\sp_rsdrv2.sys [24.8.2010 13:00 142592]
R2 aswFsBlk;aswFsBlk;c:\window\system32\drivers\aswFsBlk.sys [11.8.2010 14:57 17744]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\breta\LOCALS~1\Temp\VWK17C.tmp --> c:\docume~1\breta\LOCALS~1\Temp\VWK17C.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\window\system32\GameMon.des -service --> c:\window\system32\GameMon.des -service [?]
S4 sptd;sptd;c:\window\system32\drivers\sptd.sys [28.8.2010 14:48 436792]
.
Obsah adresáře 'Naplánované úlohy'

2010-12-18 c:\window\Tasks\WGASetup.job
- c:\window\system32\KB905474\wgasetup.exe [2010-08-14 20:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.crawler.com/homepage.aspx?tbid=60347
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - d:\docume~1\Office12\EXCEL.EXE/3000
TCP: {158AAD56-A49D-4120-9982-96110D811D5D} = 213.192.40.6,77.48.254.254
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\breta\Data aplikací\Mozilla\Firefox\Profiles\l0tiyvaz.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60347&qkw=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-MultiCalc - c:\program files\MultiCalc\MultiCalc.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-18 14:31
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\breta\LOCALS~1\Temp\VWK17C.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\window\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-329068152-1757981266-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOW\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOW\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(572)
c:\window\system32\Ati2evxx.dll
.
Celkový čas: 2010-12-18 14:32:57
ComboFix-quarantined-files.txt 2010-12-18 13:32
ComboFix2.txt 2010-08-24 09:14
ComboFix3.txt 2010-02-13 08:07

Před spuštěním: 9 457 983 488
Po spuštění: 9 537 056 768

- - End Of File - - 7BFEAA1C5E43A80293E5DA434FA9DF0C

5 položek CF smazal, zbytek logu vypadá čistý. S&D a ST se spolu mohou bít, oba jsou to antispy. Doporučuji si ponechat ST a Spybot odinstalovat už proto, že ten má časy své největší slávy za sebou. Vyzkoušejte a ozvěte se.