VIRY.CZ

Zdravím a tímto prosím o pomoc...

Za poslední tři týdny byl počítač napaden několika Spywary, pomocí WinDoctor, ComboFix, CCleaner, The Avenger jsem docílila aspon toho že mi jede internet a zobrazují se stránky. Nicméně nejde opravit připojení, ani přeinstalovat ovladač na Wifi Receiver a ani ho odstranit. Přestože mi jede net tak Wireless Utility tvrdí že není nic připojeno a nejde ani obnovit status. Po odpojení příjmače Wifi z USB se už znovu nepřipojí...

Posílám log a ještě jednou Vás žádám o pomoc, dočetla jsem se o programu LSPFix ale nevím co smazat a co tam nechat tak raději neriskuju...



Logfile of random's system information tool 1.08 (written by random/random)
Run by Markéta Kulíková at 2011-01-09 12:25:22
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 239 GB (78%) free of 305 GB
Total RAM: 2047 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:25:29, on 9.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Belkin\F5D8053\v6\BelkinWCUI.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\DOCUME~1\MARKTA~1\LOCALS~1\Temp\Rar$EX00.547\Windows Doctor 2.5.0\WindowsDoctor.exe
C:\Program Files\Windows Doctor\WindowsDoctor.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Markéta Kulíková\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Markéta Kulíková.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8210510312
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

--
End of file - 8145 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-11-12 13672448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe"="C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.1"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe"="C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Disabled:ICQ6"
"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"="C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Disabled:Sid Meier's Civilization 4"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.bat - edit -
.cmd - edit -
.inf - open -
.ini - open - notepad.exe %1
.js - edit -
.reg - edit -
.txt - open - notepad.exe %1
.vbs - edit -

======List of files/folders created in the last 1 months======

2011-01-09 12:25:22 ----D---- C:\rsit
2011-01-09 01:53:22 ----D---- C:\WINDOWS\XSxS
2011-01-08 23:56:35 ----SHD---- C:\RECYCLER
2011-01-08 23:55:27 ----A---- C:\ComboFix.txt
2011-01-08 23:42:33 ----A---- C:\WINDOWS\zip.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\SWSC.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\SWREG.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\sed.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\PEV.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\NIRCMD.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\MBR.exe
2011-01-08 23:42:33 ----A---- C:\WINDOWS\grep.exe
2011-01-08 23:07:36 ----D---- C:\Avenger
2011-01-08 23:07:35 ----A---- C:\avenger.txt
2011-01-08 21:46:37 ----D---- C:\Qoobox
2011-01-08 21:36:11 ----A---- C:\WINDOWS\system32\cmd.execf
2011-01-08 18:35:37 ----A---- C:\WINDOWS\ntbtlog.txt
2011-01-08 17:26:03 ----A---- C:\WINDOWS\ycmwfopw.txt
2011-01-08 16:26:13 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\Malwarebytes
2011-01-08 16:26:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2011-01-08 09:33:26 ----D---- C:\Program Files\Xenocode
2011-01-08 09:19:36 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\Uniblue
2011-01-08 09:19:24 ----D---- C:\Program Files\Uniblue
2011-01-08 09:02:15 ----D---- C:\Program Files\Windows Doctor2
2011-01-06 12:02:12 ----A---- C:\WINDOWS\system32\drivers\RTL8192su.sys
2011-01-02 16:09:37 ----D---- C:\Program Files\trend micro
2010-12-28 11:23:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\STOPzilla!
2010-12-27 19:39:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\eAdDa05200
2010-12-17 13:58:05 ----D---- C:\Program Files\Common Files\Skype
2010-12-15 03:05:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2296199$
2010-12-15 03:04:54 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2010-12-15 03:04:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2010-12-15 03:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2443685$
2010-12-15 03:04:41 ----HDC---- C:\WINDOWS\$NtUninstallKB2436673$
2010-12-15 03:04:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2010-12-15 03:00:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$

======List of files/folders modified in the last 1 months======

2011-01-09 11:44:47 ----D---- C:\WINDOWS\Prefetch
2011-01-09 02:10:06 ----D---- C:\WINDOWS\Temp
2011-01-09 01:53:22 ----D---- C:\WINDOWS
2011-01-08 23:56:07 ----D---- C:\WINDOWS\system32\drivers
2011-01-08 23:55:35 ----SD---- C:\WINDOWS\Tasks
2011-01-08 23:54:41 ----D---- C:\WINDOWS\ERDNT
2011-01-08 23:50:57 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-08 23:50:39 ----A---- C:\WINDOWS\system.ini
2011-01-08 23:50:25 ----D---- C:\WINDOWS\system32\drivers\etc
2011-01-08 23:48:44 ----D---- C:\WINDOWS\system32\config
2011-01-08 23:47:28 ----D---- C:\WINDOWS\system32
2011-01-08 23:47:28 ----D---- C:\WINDOWS\AppPatch
2011-01-08 23:47:26 ----D---- C:\Program Files\Common Files
2011-01-08 23:42:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-08 23:07:36 ----RD---- C:\Program Files
2011-01-08 23:03:53 ----D---- C:\Program Files\DivX
2011-01-08 23:00:41 ----SHD---- C:\WINDOWS\Installer
2011-01-08 22:47:27 ----SHD---- C:\System Volume Information
2011-01-08 22:47:27 ----D---- C:\WINDOWS\system32\Restore
2011-01-08 21:38:23 ----D---- C:\WINDOWS\WinSxS
2011-01-08 17:43:45 ----D---- C:\WINDOWS\system32\ReinstallBackups
2011-01-08 17:37:18 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-01-08 16:14:31 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\Winamp
2011-01-08 10:48:43 ----D---- C:\WINDOWS\Network Diagnostic
2011-01-08 10:07:59 ----D---- C:\Install
2011-01-08 09:48:06 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\Skype
2011-01-08 09:42:29 ----D---- C:\Program Files\WinRAR
2011-01-08 09:42:29 ----D---- C:\Program Files\Microsoft Works
2011-01-08 09:38:48 ----D---- C:\WINDOWS\Minidump
2011-01-08 09:38:48 ----D---- C:\WINDOWS\Debug
2011-01-08 09:07:22 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\skypePM
2011-01-06 21:10:33 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\vlc
2011-01-06 21:09:23 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\dvdcss
2011-01-06 19:26:36 ----A---- C:\WINDOWS\NeroDigital.ini
2011-01-06 16:37:34 ----A---- C:\WINDOWS\win.ini
2011-01-06 12:02:11 ----HD---- C:\WINDOWS\inf
2011-01-06 11:06:38 ----A---- C:\WINDOWS\RTacDbg.txt
2011-01-05 16:26:29 ----D---- C:\WINDOWS\twain_32
2010-12-28 17:43:06 ----SHDC---- C:\WINDOWS\system32\dllcache
2010-12-28 12:00:46 ----D---- C:\Program Files\FontLab
2010-12-28 11:52:15 ----D---- C:\Program Files\DAEMON Tools Toolbar
2010-12-28 11:03:31 ----D---- C:\Program Files\TrojanHunter 5.1
2010-12-28 08:43:59 ----D---- C:\Documents and Settings
2010-12-24 01:52:25 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\uTorrent
2010-12-17 13:58:05 ----RD---- C:\Program Files\Skype
2010-12-17 13:33:32 ----D---- C:\Program Files\PokerStars
2010-12-16 11:18:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2010-12-15 03:05:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-12-15 03:04:49 ----HD---- C:\WINDOWS\$hf_mig$
2010-12-15 03:00:47 ----A---- C:\WINDOWS\system32\MRT.exe
2010-12-15 03:00:39 ----D---- C:\Program Files\Outlook Express
2010-12-14 11:13:45 ----D---- C:\Documents and Settings\Markéta Kulíková\Data aplikací\Adobe
2010-12-14 11:13:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-12-13 10:52:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-12-11 08:01:51 ----D---- C:\Program Files\Mozilla Firefox
2010-12-10 11:53:03 ----A---- C:\WINDOWS\wincmd.ini
2010-12-10 09:44:35 ----A---- C:\WINDOWS\wcx_ftp.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-03-10 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2010-08-30 21035]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-06-13 4754944]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2009-08-05 39424]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-11-12 6188320]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter; C:\WINDOWS\system32\DRIVERS\RTL8192su.sys [2009-05-27 584832]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2004-04-14 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2004-04-14 44064]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 awtqv2uc;awtqv2uc; C:\WINDOWS\system32\drivers\awtqv2uc.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 mbr;mbr; \??\C:\DOCUME~1\MARKTA~1\LOCALS~1\Temp\mbr.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 s117bus;Sony Ericsson Device 117 driver (WDM); C:\WINDOWS\system32\DRIVERS\s117bus.sys [2007-06-25 82984]
S3 s117mdfl;Sony Ericsson Device 117 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s117mdfl.sys [2007-06-25 14888]
S3 s117mdm;Sony Ericsson Device 117 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s117mdm.sys [2007-06-25 108456]
S3 s117mgmt;Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s117mgmt.sys [2007-06-25 100264]
S3 s117nd5;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS); C:\WINDOWS\system32\DRIVERS\s117nd5.sys [2007-06-25 22952]
S3 s117obex;Sony Ericsson Device 117 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s117obex.sys [2007-06-25 98344]
S3 s117unic;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM); C:\WINDOWS\system32\DRIVERS\s117unic.sys [2007-06-25 98856]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 SPC220NC;Philips SPC220NC Webcam; C:\WINDOWS\system32\DRIVERS\SPC220NC.SYS [2007-01-09 507136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2010-09-28 41984]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WmFilter;Logitech WingMan HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2004-04-14 21280]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2004-04-14 5600]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-10-16 37664]
R2 BcmSqlStartupSvc;Služba spouštění serveru SQL Server aplikace Business Contact Manager; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-07-27 345376]
R2 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-08-02 655624]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-01 152984]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-11-12 163908]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-09-28 69632]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-11-17 820008]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Hezké odpoledne
Vy jste odborník na logy, že si troufáte něco mazat avengerem?

Poprosím o log z combofixu, co jste již dělala
-- C:\ComboFix.txt

Tady je ten log...


ComboFix 11-01-08.01 - Markéta Kulíková 08.01.2011 23:44:25.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1582 [GMT 0:00]
Spuštěný z: c:\documents and settings\Markéta Kulíková\Dokumenty\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Markéta Kulíková\Dokumenty\Downloads\WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Markéta Kulíková\Nabídka Start\Programy\System Tool
c:\windows\XSxS

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_glaide32


((((((((((((((((((((((((( Soubory vytvořené od 2010-12-08 do 2011-01-08 )))))))))))))))))))))))))))))))
.

2011-01-08 21:36 . 2011-01-08 21:37 390144 ----a-w- c:\windows\system32\cmd.execf
2011-01-08 16:26 . 2011-01-08 16:26 -------- d-----w- c:\documents and settings\Markéta Kulíková\Data aplikací\Malwarebytes
2011-01-08 16:26 . 2011-01-08 16:26 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-01-08 09:33 . 2011-01-08 09:33 -------- d-----w- c:\program files\Xenocode
2011-01-08 09:19 . 2011-01-08 09:19 -------- d-----w- c:\documents and settings\Markéta Kulíková\Data aplikací\Uniblue
2011-01-08 09:19 . 2011-01-08 09:19 -------- d-----w- c:\program files\Uniblue
2011-01-08 09:18 . 2011-01-08 09:18 -------- d-----w- c:\documents and settings\Markéta Kulíková\Local Settings\Data aplikací\PackageAware
2011-01-08 09:02 . 2011-01-08 10:01 -------- d-----w- c:\program files\Windows Doctor2
2011-01-08 08:59 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{5BEC09F8-A02E-4F77-97F5-6107338C09BC}\mpengine.dll
2011-01-06 12:02 . 2009-05-27 17:31 584832 ----a-w- c:\windows\system32\drivers\RTL8192su.sys
2011-01-02 16:09 . 2011-01-02 16:54 -------- d-----w- c:\program files\trend micro
2010-12-28 11:23 . 2011-01-08 23:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\STOPzilla!
2010-12-28 08:43 . 2010-12-28 08:45 -------- d-----w- c:\documents and settings\Administrator
2010-12-27 21:11 . 2010-12-27 21:11 -------- d-----w- c:\documents and settings\NetworkService\Data aplikací\Apple Computer
2010-12-27 19:39 . 2010-12-28 11:36 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eAdDa05200
2010-12-17 13:58 . 2010-12-17 13:58 -------- d-----w- c:\program files\Common Files\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:15 . 2008-12-02 07:01 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-10 04:33 . 2010-03-05 03:46 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-02 15:17 . 2008-04-13 23:27 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2008-04-14 07:37 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2008-04-14 06:45 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51 . 2010-03-03 16:07 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24654:UDP"= 24654:UDP:Enfocus Port
"20486:UDP"= 20486:UDP:Enfocus Port
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2638:TCP"= 2638:TCP:Services
"3776:TCP"= 3776:TCP:Services
"8847:TCP"= 8847:TCP:Services
"8848:TCP"= 8848:TCP:Services
"9941:TCP"= 9941:TCP:Services
"9942:TCP"= 9942:TCP:Services
"2583:TCP"= 2583:TCP:Services
"3666:TCP"= 3666:TCP:Services
"3473:TCP"= 3473:TCP:Services
"5446:TCP"= 5446:TCP:Services
"7196:TCP"= 7196:TCP:Services
"4348:TCP"= 4348:TCP:Services
"9722:TCP"= 9722:TCP:Services
"9723:TCP"= 9723:TCP:Services

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.4.2009 7:00 691696]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [1.2.2010 2:53 90112]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [6.1.2011 12:02 584832]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [1.2.2010 2:53 27632]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 3:46 284016]
S3 SPC220NC;Philips SPC220NC Webcam;c:\windows\system32\drivers\SPC220NC.SYS [7.2.2009 10:16 507136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2011-01-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-25 19:40]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uInternet Settings,ProxyOverride = <local>
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Backward &Links - c:\program files\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\googletoolbar.dll/cmcache.html
IE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Si&milar Pages - c:\program files\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\googletoolbar.dll/cmtrans.html
FF - ProfilePath - c:\documents and settings\Markéta Kulíková\Data aplikací\Mozilla\Firefox\Profiles\cf390ysv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=966134&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Cooliris: piclens@cooliris.com - %profile%\extensions\piclens@cooliris.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-08 23:50
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\windows\TEMP\TMP0000001B6C1E0EF25E909CB1 524288 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2936)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
.
**************************************************************************
.
Celkový čas: 2011-01-08 23:55:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-08 23:55

Před spuštěním: Volných bajtů: 251 070 070 784
Po spuštění: Volných bajtů: 251 025 989 632

- - End Of File - - 271E587FA5E620230136ADBF4E6000B4


Odborník fakt nejsem, troufla jsem si ze zoufalství...

Než se do toho uplně pustíme, zkoušela jste obnovu systému?

Ne zatim jeste ne. Nemam instal CD... Ale stahla jsem recovery console ke combofixu dle tohoto navodu: http://www.bleepingcomputer.com/combofi ... e-combofix

Momentalne nejsem u PC. zpet budu do 2-3 hodin...

Kazdopadne dekuji za ochotu pomoct!

Na obnovu systému nepotřebujete recovery conzoli ani nic jiného.
Pokud by nešla, napište, vidím tam pár věcí k odstranění.

Start - spustit
-do políčka zkopírujte -enter
-vyberte bod obnovení k datu, kdy pc bylo v pořádku


Pak napište stav pc a vložte nový log ze Rsitu

problém je v tom že nemůžu vybrat žádné jiné datum než včerejší a dnešní...

Nevadí.

Tyto porty znáte? Máte je povolené schválně?

"24654:UDP"= 24654:UDP:Enfocus Port
"20486:UDP"= 20486:UDP:Enfocus Port
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2638:TCP"= 2638:TCP:Services
"3776:TCP"= 3776:TCP:Services
"8847:TCP"= 8847:TCP:Services
"8848:TCP"= 8848:TCP:Services
"9941:TCP"= 9941:TCP:Services
"9942:TCP"= 9942:TCP:Services
"2583:TCP"= 2583:TCP:Services
"3666:TCP"= 3666:TCP:Services
"3473:TCP"= 3473:TCP:Services
"5446:TCP"= 5446:TCP:Services
"7196:TCP"= 7196:TCP:Services
"4348:TCP"= 4348:TCP:Services
"9722:TCP"= 9722:TCP:Services
"9723:TCP"= 9723:TCP:Services

Jj znam. Parti k plug-inu PitStop...

Vidíte, a já bych Vám ty services odstřelila, mě se totiž nelíbí .
Zkoušela jste přeinstalovat drivery k wifi v nouzovém režimu?


Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky

Report dnešního stravu PC:

Po zapnutí počítače nejel internet, v nouzovém režimu jsem zkusila přeinstalovat ten ovladač Wifi, ale bez úspěchu, když jsem spustila instalaci z CD tak se to zaseklo v okne: Installing Wireless Ulitility SW please wait... a stálo to tak jsem to sestřelila. Když jsem přes ovladací panely zkusila jenom změnit instalaci tak mi to vyhodilo okno: SETUP NEEDS THE NEXT DISC/ Please insert disc 1 that contains data2.cab

Tak jsem přes Windows Doctor spustila vyladění systému a čištění registů, po restartu internet funguje...

Poté jsem postupovala dle vašeho návodu takže tady je log z ComboFixu:


ComboFix 11-01-09.02 - Markéta Kulíková 10.01.2011 10:28:05.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1549 [GMT 0:00]
Spuštěný z: c:\documents and settings\Markéta Kulíková\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Markéta Kulíková\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FILE ::
"c:\windows\TEMP\TMP0000001B6C1E0EF25E909CB1"
"c:\windows\ycmwfopw.txt"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\_DTLite.xml
c:\program files\TrojanHunter 5.1
c:\program files\TrojanHunter 5.1\contmenu.dll
c:\program files\TrojanHunter 5.1\Debug.log
c:\program files\TrojanHunter 5.1\IL.ini
c:\program files\TrojanHunter 5.1\Scan Reports\2009-06-21_1156.txt
c:\program files\TrojanHunter 5.1\Scan Reports\2009-06-21_1946.txt
c:\program files\TrojanHunter 5.1\THGuard.exe
c:\windows\XSxS
c:\windows\ycmwfopw.txt

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-10 do 2011-01-10 )))))))))))))))))))))))))))))))
.

2011-01-10 10:24 . 2011-01-10 10:24 -------- d-----w- c:\documents and settings\Markéta Kulíková\Data aplikací\GetRightToGo
2011-01-09 14:32 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{117FA8CB-F062-4D32-8FEF-73C5FC6383DB}\mpengine.dll
2011-01-09 12:25 . 2011-01-09 12:25 -------- d-----w- C:\rsit
2011-01-08 21:36 . 2011-01-08 21:37 390144 ----a-w- c:\windows\system32\cmd.execf
2011-01-08 16:26 . 2011-01-08 16:26 -------- d-----w- c:\documents and settings\Markéta Kulíková\Data aplikací\Malwarebytes
2011-01-08 16:26 . 2011-01-08 16:26 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-01-08 09:33 . 2011-01-08 09:33 -------- d-----w- c:\program files\Xenocode
2011-01-08 09:19 . 2011-01-08 09:19 -------- d-----w- c:\documents and settings\Markéta Kulíková\Data aplikací\Uniblue
2011-01-08 09:19 . 2011-01-08 09:19 -------- d-----w- c:\program files\Uniblue
2011-01-08 09:18 . 2011-01-08 09:18 -------- d-----w- c:\documents and settings\Markéta Kulíková\Local Settings\Data aplikací\PackageAware
2011-01-08 09:02 . 2011-01-08 10:01 -------- d-----w- c:\program files\Windows Doctor2
2011-01-06 12:02 . 2009-05-27 17:31 584832 ----a-w- c:\windows\system32\drivers\RTL8192su.sys
2011-01-02 16:09 . 2011-01-09 12:25 -------- d-----w- c:\program files\trend micro
2010-12-28 11:23 . 2011-01-08 23:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\STOPzilla!
2010-12-28 08:43 . 2010-12-28 08:45 -------- d-----w- c:\documents and settings\Administrator
2010-12-27 21:11 . 2010-12-27 21:11 -------- d-----w- c:\documents and settings\NetworkService\Data aplikací\Apple Computer
2010-12-27 19:39 . 2010-12-28 11:36 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eAdDa05200
2010-12-17 13:58 . 2010-12-17 13:58 -------- d-----w- c:\program files\Common Files\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:15 . 2008-12-02 07:01 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-10 04:33 . 2010-03-05 03:46 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-02 15:17 . 2008-04-13 23:27 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2008-04-14 07:37 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2008-04-14 06:45 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51 . 2010-03-03 16:07 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Data aplikací\eAdDa05200 ----

2010-12-27 19:39 . 2010-12-28 11:07 94 ----a-w- c:\documents and settings\All Users\Data aplikací\eAdDa05200\eAdDa05200


(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24654:UDP"= 24654:UDP:Enfocus Port
"20486:UDP"= 20486:UDP:Enfocus Port
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2638:TCP"= 2638:TCP:Services
"3776:TCP"= 3776:TCP:Services
"8847:TCP"= 8847:TCP:Services
"8848:TCP"= 8848:TCP:Services
"9941:TCP"= 9941:TCP:Services
"9942:TCP"= 9942:TCP:Services
"2583:TCP"= 2583:TCP:Services
"3666:TCP"= 3666:TCP:Services
"3473:TCP"= 3473:TCP:Services
"5446:TCP"= 5446:TCP:Services
"7196:TCP"= 7196:TCP:Services
"4348:TCP"= 4348:TCP:Services
"9722:TCP"= 9722:TCP:Services
"9723:TCP"= 9723:TCP:Services
"7644:TCP"= 7644:TCP:Services
"7645:TCP"= 7645:TCP:Services

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.4.2009 7:00 691696]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [6.1.2011 12:02 584832]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [1.2.2010 2:53 27632]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [1.2.2010 2:53 90112]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 3:46 284016]
S3 SPC220NC;Philips SPC220NC Webcam;c:\windows\system32\drivers\SPC220NC.SYS [7.2.2009 10:16 507136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2011-01-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-25 19:40]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uInternet Settings,ProxyOverride = <local>
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Backward &Links - c:\program files\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\googletoolbar.dll/cmcache.html
IE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Si&milar Pages - c:\program files\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\googletoolbar.dll/cmtrans.html
FF - ProfilePath - c:\documents and settings\Markéta Kulíková\Data aplikací\Mozilla\Firefox\Profiles\cf390ysv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=966134&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Cooliris: piclens@cooliris.com - %profile%\extensions\piclens@cooliris.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-10 10:32
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(872)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Celkový čas: 2011-01-10 10:33:17
ComboFix-quarantined-files.txt 2011-01-10 10:33
ComboFix2.txt 2011-01-08 23:55

Před spuštěním: Volných bajtů: 250 711 257 088
Po spuštění: Volných bajtů: 250 703 007 744

- - End Of File - - 5CC9B345E3F9D0D1ACC82B6975CE1C2C

Ted jede ten Kaspersky Removal Tool a už 4x řval o trojských koních...

Ted musím do práce a Kaspersky pořád jede. Log vložím večer....

Ještě Vám můžu driver od wifi smazat přes combofix, ale zrovna tento způsob není moc bezpečný .

Otestujte na www.virustotal.com
c:\documents and settings\All Users\Data aplikací\eAdDa05200\eAdDa05200

tady je ten log:


Automatická kontrola: dokončeno před 9 hod. (události: 16, objekty: 422653, čas: 01:31:49)
10.1.2011 10:51:43 Úloha byla spuštěna
10.1.2011 11:03:45 Zjištěno: Trojan.Win32.Agent2.cgjm C:\Documents and Settings\Markéta Kulíková\Data aplikací\Thinstall\InDesign CS3 Data\300000003400002i\dwwin.exe
10.1.2011 11:03:48 Zjištěno: Trojan.Win32.Agent2.cgih C:\Documents and Settings\Markéta Kulíková\Data aplikací\Thinstall\InDesign CS3 Data\40000039400002i\InDesign.exe
10.1.2011 11:03:57 Odstraněno: Trojan.Win32.Agent2.cgjm C:\Documents and Settings\Markéta Kulíková\Data aplikací\Thinstall\InDesign CS3 Data\300000003400002i\dwwin.exe
10.1.2011 11:03:57 Odstraněno: Trojan.Win32.Agent2.cgih C:\Documents and Settings\Markéta Kulíková\Data aplikací\Thinstall\InDesign CS3 Data\40000039400002i\InDesign.exe
10.1.2011 11:05:17 Zjištěno: Trojan.Win32.Rettesser.fe C:\Documents and Settings\Markéta Kulíková\Dokumenty\Downloads\WindowsDoctor25.exe/data0012
10.1.2011 11:05:29 Odstraněno: Trojan.Win32.Rettesser.fe C:\Documents and Settings\Markéta Kulíková\Dokumenty\Downloads\WindowsDoctor25.exe
10.1.2011 12:11:57 Zjištěno: Trojan.HTML.Fraud.di C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP3\A0001380.exe
10.1.2011 12:11:57 Zjištěno: Trojan.HTML.Fraud.di C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP3\A0001379.exe
10.1.2011 12:12:14 Odstraněno: Trojan.HTML.Fraud.di C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP3\A0001380.exe
10.1.2011 12:12:15 Odstraněno: Trojan.HTML.Fraud.di C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP3\A0001379.exe
10.1.2011 12:12:19 Zjištěno: Trojan.Win32.Agent2.cgjm C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP4\A0004547.exe
10.1.2011 12:12:19 Zjištěno: Trojan.Win32.Agent2.cgih C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP4\A0004548.exe
10.1.2011 12:12:20 Odstraněno: Trojan.Win32.Agent2.cgjm C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP4\A0004547.exe
10.1.2011 12:12:20 Odstraněno: Trojan.Win32.Agent2.cgih C:\System Volume Information\_restore{8E9DFAAA-78B3-4470-A312-15FFE87971BA}\RP4\A0004548.exe
10.1.2011 12:23:33 Úloha byla dokončena

Koukám že se mu nějak nelíbí Váš windows doktor .
Změnilo se něco?