Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:22, on 21.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
E:\WINDOWS\Explorer.EXE
E:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\RTHDCPL.EXE
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
E:\Program Files\Logitech\MouseWare\system\em_exec.exe
E:\WINDOWS\system32\spoolsv.exe
e:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
E:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Mozilla Firefox\plugin-container.exe
E:\Documents and Settings\Owner\Dokumenty\Stažené soubory\hijackthis(2).exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: SMSender.E.ToolbarsHelper - {24BCDA96-8FCB-4D3B-0500-000000000004} - mscoree.dll (file missing)
O2 - BHO: ShoppingReport2 - {258C9770-1713-4021-8D7E-1F184A2BD754} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - (no file)
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - E:\Program Files\Seznam.cz\listicka.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: SMSender - {24BCDA96-8FCB-4D3B-0500-000000000003} - mscoree.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [avast5] E:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ICQ] "E:\Program Files\ICQ7.2\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... 2010103107
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Poslat jako MMS - res://E:\Program Files\O2\SMSender\SMSender.E.dll/1001
O8 - Extra context menu item: Poslat jako SMS - res://E:\Program Files\O2\SMSender\SMSender.E.dll/1000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - E:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - E:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Vytvořit mobilní oblíbenou položku… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - E:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - E:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - E:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - E:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - E:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - E:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O18 - Protocol: bw+0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: offline-8876480 - {65697320-3752-45AB-B410-DD3BA230F3DE} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - e:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - E:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - E:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ResultBar Service - Unknown owner - E:\Documents and Settings\All Users\Data aplikací\ResultBar\resultbar127.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - E:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TwonkyMedia - PacketVideo - E:\Program Files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe
--
End of file - 21820 bytes
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Prosím o kontrolu pc trochu zlobí
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
jjeennddaa
- Návštěvník
- Příspěvky: 71
- Registrován: 03 bře 2007 17:58
Re: Prosím o kontrolu pc trochu zlobí
Dobrý večer 
Poprosím o log ze Rsitu, viz můj podpis
Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken
NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.
Poprosím o log ze Rsitu, viz můj podpis
Stahněte MBAM z mého podpisu-Nainstalujte,dejte úplný sken
NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
-
jjeennddaa
- Návštěvník
- Příspěvky: 71
- Registrován: 03 bře 2007 17:58
Re: Prosím o kontrolu pc trochu zlobí
RSIT mi nešel vůbec stáhnout strašně pomaličku se to stahovalo. počítač vůbec nechtěl najet tak jsem projel disk z jiného počítače log z rsit ještě dopošlu. počítač se mi podařilo už spustit.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Verze databáze: 5565
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
21.1.2011 17:16:18
mbam-log-2011-01-21 (17-16-18).txt
Typ kontroly: Úplný test (D:\|)
Testované objekty: 254657
Uplynulý čas: 36 minut, 26 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 96
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
d:\documents and settings\all users\data aplikací\resultbar\resultbar113.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar117.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar125.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar127.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\Owner\local settings\Temp\nsu4.tmp\Install.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
d:\documents and settings\Owner\local settings\Temp\nsu4.tmp\Setup.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
d:\program files\bsplayer pro\bsplayer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3CJPEG.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3DTACTL.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HISTSW.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3HTMLMU.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HTTPCT.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3IMSTUB.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3POPSWT.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3PSSAVR.SCR (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3REPROX.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3RESTUB.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3SCHMON.EXE (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3SCRCTR.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSMLBTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSUABTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\resultbar\resultbar.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\program files\resultbar\resultbar.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\program files\resultbar\uninstall.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\program files\shoppingreport2\Uninst.exe (Adware.ShoppingReports) -> Quarantined and deleted successfully.
d:\program files\shoppingreport2\Bin\2.7.21\shoppingreport.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1089\A0226456.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226489.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226487.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226488.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226668.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226669.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226670.exe (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226671.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226732.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1134\A0233257.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1134\A0233258.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1137\A0233465.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1137\A0233466.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233498.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233499.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233500.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1140\A0234612.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1140\A0234611.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235050.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235051.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235059.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235060.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235061.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236439.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236440.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236468.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236470.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236415.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236469.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1155\A0236659.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1155\A0236660.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0238749.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0238750.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0239783.exe (Malware.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0239785.exe (Malware.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1081\A0225932.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\WINDOWS\system32\f3PSSavr.scr (PUP.FunWebProducts) -> Not selected for removal.
d:\WINDOWS\system32\drivers\zhtginhs.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES6.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES9.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RESA.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES12.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES19.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES1A.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES1D.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES25.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Verze databáze: 5565
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
21.1.2011 17:16:18
mbam-log-2011-01-21 (17-16-18).txt
Typ kontroly: Úplný test (D:\|)
Testované objekty: 254657
Uplynulý čas: 36 minut, 26 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 96
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
d:\documents and settings\all users\data aplikací\resultbar\resultbar113.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar117.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar125.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\all users\data aplikací\resultbar\resultbar127.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\documents and settings\Owner\local settings\Temp\nsu4.tmp\Install.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
d:\documents and settings\Owner\local settings\Temp\nsu4.tmp\Setup.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
d:\program files\bsplayer pro\bsplayer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3CJPEG.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3DTACTL.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HISTSW.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3HTMLMU.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3HTTPCT.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3IMSTUB.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3POPSWT.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3PSSAVR.SCR (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\F3REPROX.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3RESTUB.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3SCHMON.EXE (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3SCRCTR.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\program files\mywebsearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSMLBTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\MWSUABTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\mywebsearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
d:\program files\resultbar\resultbar.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\program files\resultbar\resultbar.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\program files\resultbar\uninstall.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\program files\shoppingreport2\Uninst.exe (Adware.ShoppingReports) -> Quarantined and deleted successfully.
d:\program files\shoppingreport2\Bin\2.7.21\shoppingreport.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1089\A0226456.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226489.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226487.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1090\A0226488.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226668.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226669.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226670.exe (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226671.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1092\A0226732.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1134\A0233257.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1134\A0233258.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1137\A0233465.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1137\A0233466.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233498.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233499.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1138\A0233500.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1140\A0234612.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1140\A0234611.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235050.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235051.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235059.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235060.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1144\A0235061.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236439.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236440.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236468.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236470.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236415.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1152\A0236469.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1155\A0236659.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1155\A0236660.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0238749.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0238750.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0239783.exe (Malware.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1157\A0239785.exe (Malware.Gen) -> Quarantined and deleted successfully.
d:\system volume information\_restore{1a81f578-ca51-4d2e-9e99-5774c544dba2}\RP1081\A0225932.DLL (PUP.FunWebProducts) -> Not selected for removal.
d:\WINDOWS\system32\f3PSSavr.scr (PUP.FunWebProducts) -> Not selected for removal.
d:\WINDOWS\system32\drivers\zhtginhs.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES6.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES9.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RESA.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES12.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES19.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES1A.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES1D.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\Temp\RES25.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
Re: Prosím o kontrolu pc trochu zlobí
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
-
jjeennddaa
- Návštěvník
- Příspěvky: 71
- Registrován: 03 bře 2007 17:58
Re: Prosím o kontrolu pc trochu zlobí
ComboFix 11-01-23.05 - Owner 24.01.2011 7:57.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1916.1357 [GMT 1:00]
Spuštěný z: e:\documents and settings\Owner\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
e:\documents and settings\All Users\Data aplikací\ResultBar
e:\documents and settings\All Users\Data aplikací\ResultBar\resultbar121.exe
e:\documents and settings\Owner\Data aplikací\ShoppingReport2
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\Config.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\db\Aliases.dbs
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\db\Sites.dbs
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\dwld\WhiteList.xip
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\report\aggr_storage.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\report\send_storage.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\res2\WhiteList.dbs
e:\program files\FunWebProducts
e:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
e:\program files\MyWebSearch
e:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
e:\program files\MyWebSearch\bar\1.bin\F3CJpeg.dll
e:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HTtpct.dll
e:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
e:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
e:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
e:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
e:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
e:\program files\MyWebSearch\bar\1.bin\F3SCrctr.dll
e:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
e:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
e:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
e:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
e:\program files\MyWebSearch\bar\1.bin\CHROME.MANIFEST
e:\program files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
e:\program files\MyWebSearch\bar\1.bin\INSTALL.RDF
e:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
e:\program files\MyWebSearch\bar\Cache\0070C1F7
e:\program files\MyWebSearch\bar\Cache\0070D32D
e:\program files\MyWebSearch\bar\Cache\0070D495.bin
e:\program files\MyWebSearch\bar\Cache\0070D4F2.bmp
e:\program files\MyWebSearch\bar\Cache\0070D531.bin
e:\program files\MyWebSearch\bar\Cache\0070D58F.bin
e:\program files\MyWebSearch\bar\Cache\0070D5DD.bin
e:\program files\MyWebSearch\bar\Cache\0070D60C.bin
e:\program files\MyWebSearch\bar\Cache\files.ini
e:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
e:\program files\MyWebSearch\bar\Game\CHESS.F3S
e:\program files\MyWebSearch\bar\Game\REVERSI.F3S
e:\program files\MyWebSearch\bar\History\search3
e:\program files\MyWebSearch\bar\icons\CM.ICO
e:\program files\MyWebSearch\bar\icons\MFC.ICO
e:\program files\MyWebSearch\bar\icons\PSS.ICO
e:\program files\MyWebSearch\bar\icons\SMILEY.ICO
e:\program files\MyWebSearch\bar\icons\WB.ICO
e:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
e:\program files\MyWebSearch\bar\Message\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\DOG.F3S
e:\program files\MyWebSearch\bar\Notifier\FISH.F3S
e:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
e:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
e:\program files\MyWebSearch\bar\Notifier\MAID.F3S
e:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
e:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
e:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
e:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
e:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
e:\program files\MyWebSearch\bar\Overlay\COMMON.F3S
e:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
e:\program files\MyWebSearch\bar\Settings\s_pid.dat
e:\program files\ResultBar
e:\program files\ShoppingReport2
e:\windows\daemon.dll
e:\windows\Downloaded Program Files\popcaploader.dll
e:\windows\Downloaded Program Files\popcaploader.inf
e:\windows\system32\f3PSSavr.scr
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_RESULTBAR_SERVICE
-------\Service_MyWebSearchService
-------\Service_ResultBar Service
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-24 do 2011-01-24 )))))))))))))))))))))))))))))))
.
2011-01-21 17:38 . 2011-01-21 17:38 -------- d-----w- e:\documents and settings\Owner\Local Settings\Data aplikací\Mozilla
2011-01-18 19:05 . 2011-01-18 19:05 -------- d-----w- e:\windows\system32\wbem\Repository
2011-01-12 19:51 . 2011-01-12 19:51 1409 ----a-w- e:\windows\QTFont.for
2011-01-02 17:15 . 2011-01-02 17:15 -------- d-sh--w- e:\documents and settings\Owner\PrivacIE
2011-01-02 17:14 . 2011-01-02 17:14 -------- d-sh--w- e:\documents and settings\NetworkService\IETldCache
2011-01-02 17:13 . 2011-01-02 17:13 -------- d-sh--w- e:\documents and settings\Owner\IETldCache
2011-01-02 17:11 . 2011-01-02 17:11 -------- d-----w- e:\program files\Seznam.cz
2011-01-02 17:09 . 2011-01-02 17:11 -------- dc-h--w- e:\windows\ie8
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-07-01 15:59 38848 ----a-w- e:\windows\avastSS.scr
2011-01-13 08:47 . 2010-07-01 15:59 188216 ----a-w- e:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-07-01 15:59 294608 ----a-w- e:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-07-01 15:59 47440 ----a-w- e:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-07-01 15:59 100176 ----a-w- e:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-07-01 15:59 94544 ----a-w- e:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-07-01 15:59 23632 ----a-w- e:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-07-01 15:59 29392 ----a-w- e:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-07-01 15:59 17744 ----a-w- e:\windows\system32\drivers\aswFsBlk.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"ICQ"="e:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="e:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]
"IgfxTray"="e:\windows\system32\igfxtray.exe" [2009-11-13 141848]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992]
"RTHDCPL"="RTHDCPL.EXE" [2010-07-28 19557480]
"QuickTime Task"="e:\program files\QuickTime\qttask.exe" [2007-05-01 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="e:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=e:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logitech Desktop Messenger.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Logitech Desktop Messenger.lnk
backup=e:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Rychlé spuštění aplikace HP Image Zone.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk
backup=e:\windows\pss\Rychlé spuštění aplikace HP Image Zone.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
e:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w- e:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44 31072 ----a-w- e:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 15:50 1289000 ----a-w- e:\program files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-11-13 05:07 173592 ----a-r- e:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2007-06-23 11:00 36864 ----a-w- e:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Home Server Manager]
2009-02-04 11:08 558080 ----a-w- e:\program files\Nokia\Nokia Home Media Server\NHSM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 17:16 2331936 ----a-w- e:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-11-13 05:07 144920 ----a-r- e:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-01 19:16 282624 ----a-w- e:\program files\QuickTime\qttask.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\Valve\\hl.exe"=
"e:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\hry\\nfs72\\speed2.exe"=
"c:\\program files\\Counter-Strike 1.6\\hl.exe"=
"e:\program files\Microsoft ActiveSync\rapimgr.exe"= e:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"e:\program files\Microsoft ActiveSync\wcescomm.exe"= e:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"e:\program files\Microsoft ActiveSync\WCESMgr.exe"= e:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"e:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymedia.exe"=
"e:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymediaserver.exe"=
"e:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"e:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"e:\\Program Files\\Graphisoft\\ArchiCAD 10\\ArchiCAD.exe"=
"e:\\Program Files\\ICQ7.2\\ICQ.exe"=
"e:\\Program Files\\ICQ7.2\\aolload.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 d347bus;d347bus;e:\windows\system32\drivers\d347bus.sys [19.8.2007 12:25 155136]
R0 d347prt;d347prt;e:\windows\system32\drivers\d347prt.sys [19.8.2007 12:25 5248]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [1.7.2010 16:59 294608]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [1.7.2010 16:59 17744]
S3 Ambfilt;Ambfilt;e:\windows\system32\drivers\Ambfilt.sys [25.9.2010 12:30 1691480]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;e:\windows\system32\drivers\nmwcdnsu.sys [19.9.2009 1:47 136704]
S3 TwonkyMedia;TwonkyMedia;e:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 --> e:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
.
Obsah adresáře 'Naplánované úlohy'
2011-01-23 e:\windows\Tasks\Norton Security Scan.job
- e:\program files\Norton Security Scan\Nss.exe [2008-01-09 17:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Poslat jako MMS - e:\program files\O2\SMSender\SMSender.E.dll/1001
IE: Poslat jako SMS - e:\program files\O2\SMSender\SMSender.E.dll/1000
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - e:\program files\Seznam.cz\listicka.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - e:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - e:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\ghip5mcp.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
Notify-AtiExtEvent - (no file)
MSConfigStartUp-ATICCC - e:\program files\ATI Technologies\ATI.ACE\cli.exe
MSConfigStartUp-FlashPlayerUpdate - e:\windows\system32\Macromed\Flash\FlashUtil10e.exe
MSConfigStartUp-ICQ - ~e:\program files\ICQ6.5\ICQ.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - e:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - e:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-SweetIM - e:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-swg - e:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-24 08:03
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@e:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="e:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'explorer.exe'(6704)
e:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
e:\program files\Logitech\MouseWare\System\LgWndHk.dll
e:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
e:\windows\system32\msi.dll
e:\windows\system32\ieframe.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
e:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
e:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng.nlr
e:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\windows\system32\browselc.dll
e:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
e:\program files\Microsoft Office\Office12\1029\GrooveIntlResource.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\program files\Alwil Software\Avast5\AvastSvc.exe
e:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
e:\program files\Logitech\MouseWare\system\em_exec.exe
e:\windows\RTHDCPL.EXE
e:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
e:\progra~1\MI3AA1~1\rapimgr.exe
e:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Celkový čas: 2011-01-24 08:07:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-24 07:07
Před spuštěním: Volných bajtů: 37 690 306 560
Po spuštění: Volných bajtů: 37 631 549 440
- - End Of File - - DCA264C5F956C642335443E34A89B041
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1916.1357 [GMT 1:00]
Spuštěný z: e:\documents and settings\Owner\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
e:\documents and settings\All Users\Data aplikací\ResultBar
e:\documents and settings\All Users\Data aplikací\ResultBar\resultbar121.exe
e:\documents and settings\Owner\Data aplikací\ShoppingReport2
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\Config.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\db\Aliases.dbs
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\db\Sites.dbs
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\dwld\WhiteList.xip
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\report\aggr_storage.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\report\send_storage.xml
e:\documents and settings\Owner\Data aplikací\ShoppingReport2\cs\res2\WhiteList.dbs
e:\program files\FunWebProducts
e:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
e:\program files\MyWebSearch
e:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
e:\program files\MyWebSearch\bar\1.bin\F3CJpeg.dll
e:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
e:\program files\MyWebSearch\bar\1.bin\F3HTtpct.dll
e:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
e:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
e:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
e:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
e:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
e:\program files\MyWebSearch\bar\1.bin\F3SCrctr.dll
e:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
e:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
e:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
e:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
e:\program files\MyWebSearch\bar\1.bin\CHROME.MANIFEST
e:\program files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
e:\program files\MyWebSearch\bar\1.bin\INSTALL.RDF
e:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
e:\program files\MyWebSearch\bar\Cache\0070C1F7
e:\program files\MyWebSearch\bar\Cache\0070D32D
e:\program files\MyWebSearch\bar\Cache\0070D495.bin
e:\program files\MyWebSearch\bar\Cache\0070D4F2.bmp
e:\program files\MyWebSearch\bar\Cache\0070D531.bin
e:\program files\MyWebSearch\bar\Cache\0070D58F.bin
e:\program files\MyWebSearch\bar\Cache\0070D5DD.bin
e:\program files\MyWebSearch\bar\Cache\0070D60C.bin
e:\program files\MyWebSearch\bar\Cache\files.ini
e:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
e:\program files\MyWebSearch\bar\Game\CHESS.F3S
e:\program files\MyWebSearch\bar\Game\REVERSI.F3S
e:\program files\MyWebSearch\bar\History\search3
e:\program files\MyWebSearch\bar\icons\CM.ICO
e:\program files\MyWebSearch\bar\icons\MFC.ICO
e:\program files\MyWebSearch\bar\icons\PSS.ICO
e:\program files\MyWebSearch\bar\icons\SMILEY.ICO
e:\program files\MyWebSearch\bar\icons\WB.ICO
e:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
e:\program files\MyWebSearch\bar\Message\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\DOG.F3S
e:\program files\MyWebSearch\bar\Notifier\FISH.F3S
e:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
e:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
e:\program files\MyWebSearch\bar\Notifier\MAID.F3S
e:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
e:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
e:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
e:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
e:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
e:\program files\MyWebSearch\bar\Overlay\COMMON.F3S
e:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
e:\program files\MyWebSearch\bar\Settings\s_pid.dat
e:\program files\ResultBar
e:\program files\ShoppingReport2
e:\windows\daemon.dll
e:\windows\Downloaded Program Files\popcaploader.dll
e:\windows\Downloaded Program Files\popcaploader.inf
e:\windows\system32\f3PSSavr.scr
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_RESULTBAR_SERVICE
-------\Service_MyWebSearchService
-------\Service_ResultBar Service
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-24 do 2011-01-24 )))))))))))))))))))))))))))))))
.
2011-01-21 17:38 . 2011-01-21 17:38 -------- d-----w- e:\documents and settings\Owner\Local Settings\Data aplikací\Mozilla
2011-01-18 19:05 . 2011-01-18 19:05 -------- d-----w- e:\windows\system32\wbem\Repository
2011-01-12 19:51 . 2011-01-12 19:51 1409 ----a-w- e:\windows\QTFont.for
2011-01-02 17:15 . 2011-01-02 17:15 -------- d-sh--w- e:\documents and settings\Owner\PrivacIE
2011-01-02 17:14 . 2011-01-02 17:14 -------- d-sh--w- e:\documents and settings\NetworkService\IETldCache
2011-01-02 17:13 . 2011-01-02 17:13 -------- d-sh--w- e:\documents and settings\Owner\IETldCache
2011-01-02 17:11 . 2011-01-02 17:11 -------- d-----w- e:\program files\Seznam.cz
2011-01-02 17:09 . 2011-01-02 17:11 -------- dc-h--w- e:\windows\ie8
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-07-01 15:59 38848 ----a-w- e:\windows\avastSS.scr
2011-01-13 08:47 . 2010-07-01 15:59 188216 ----a-w- e:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-07-01 15:59 294608 ----a-w- e:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-07-01 15:59 47440 ----a-w- e:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-07-01 15:59 100176 ----a-w- e:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-07-01 15:59 94544 ----a-w- e:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-07-01 15:59 23632 ----a-w- e:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-07-01 15:59 29392 ----a-w- e:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-07-01 15:59 17744 ----a-w- e:\windows\system32\drivers\aswFsBlk.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"ICQ"="e:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="e:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]
"IgfxTray"="e:\windows\system32\igfxtray.exe" [2009-11-13 141848]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992]
"RTHDCPL"="RTHDCPL.EXE" [2010-07-28 19557480]
"QuickTime Task"="e:\program files\QuickTime\qttask.exe" [2007-05-01 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="e:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=e:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logitech Desktop Messenger.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Logitech Desktop Messenger.lnk
backup=e:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Rychlé spuštění aplikace HP Image Zone.lnk]
path=e:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk
backup=e:\windows\pss\Rychlé spuštění aplikace HP Image Zone.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
e:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w- e:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44 31072 ----a-w- e:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 15:50 1289000 ----a-w- e:\program files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-11-13 05:07 173592 ----a-r- e:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2007-06-23 11:00 36864 ----a-w- e:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Home Server Manager]
2009-02-04 11:08 558080 ----a-w- e:\program files\Nokia\Nokia Home Media Server\NHSM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 17:16 2331936 ----a-w- e:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-11-13 05:07 144920 ----a-r- e:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-01 19:16 282624 ----a-w- e:\program files\QuickTime\qttask.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\Valve\\hl.exe"=
"e:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\hry\\nfs72\\speed2.exe"=
"c:\\program files\\Counter-Strike 1.6\\hl.exe"=
"e:\program files\Microsoft ActiveSync\rapimgr.exe"= e:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"e:\program files\Microsoft ActiveSync\wcescomm.exe"= e:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"e:\program files\Microsoft ActiveSync\WCESMgr.exe"= e:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"e:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymedia.exe"=
"e:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymediaserver.exe"=
"e:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"e:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"e:\\Program Files\\Graphisoft\\ArchiCAD 10\\ArchiCAD.exe"=
"e:\\Program Files\\ICQ7.2\\ICQ.exe"=
"e:\\Program Files\\ICQ7.2\\aolload.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 d347bus;d347bus;e:\windows\system32\drivers\d347bus.sys [19.8.2007 12:25 155136]
R0 d347prt;d347prt;e:\windows\system32\drivers\d347prt.sys [19.8.2007 12:25 5248]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [1.7.2010 16:59 294608]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [1.7.2010 16:59 17744]
S3 Ambfilt;Ambfilt;e:\windows\system32\drivers\Ambfilt.sys [25.9.2010 12:30 1691480]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;e:\windows\system32\drivers\nmwcdnsu.sys [19.9.2009 1:47 136704]
S3 TwonkyMedia;TwonkyMedia;e:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 --> e:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
.
Obsah adresáře 'Naplánované úlohy'
2011-01-23 e:\windows\Tasks\Norton Security Scan.job
- e:\program files\Norton Security Scan\Nss.exe [2008-01-09 17:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Poslat jako MMS - e:\program files\O2\SMSender\SMSender.E.dll/1001
IE: Poslat jako SMS - e:\program files\O2\SMSender\SMSender.E.dll/1000
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - e:\program files\Seznam.cz\listicka.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - e:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - e:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\ghip5mcp.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
Notify-AtiExtEvent - (no file)
MSConfigStartUp-ATICCC - e:\program files\ATI Technologies\ATI.ACE\cli.exe
MSConfigStartUp-FlashPlayerUpdate - e:\windows\system32\Macromed\Flash\FlashUtil10e.exe
MSConfigStartUp-ICQ - ~e:\program files\ICQ6.5\ICQ.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - e:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - e:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-SweetIM - e:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-swg - e:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-24 08:03
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@e:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="e:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'explorer.exe'(6704)
e:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
e:\program files\Logitech\MouseWare\System\LgWndHk.dll
e:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
e:\windows\system32\msi.dll
e:\windows\system32\ieframe.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
e:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
e:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng.nlr
e:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\windows\system32\browselc.dll
e:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
e:\program files\Microsoft Office\Office12\1029\GrooveIntlResource.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\program files\Alwil Software\Avast5\AvastSvc.exe
e:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
e:\program files\Logitech\MouseWare\system\em_exec.exe
e:\windows\RTHDCPL.EXE
e:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
e:\progra~1\MI3AA1~1\rapimgr.exe
e:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Celkový čas: 2011-01-24 08:07:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-24 07:07
Před spuštěním: Volných bajtů: 37 690 306 560
Po spuštění: Volných bajtů: 37 631 549 440
- - End Of File - - DCA264C5F956C642335443E34A89B041
Re: Prosím o kontrolu pc trochu zlobí
Stahněte MBAM z mého podpisu-Nainstalujte,dejte úplný sken
NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Přispějete na provoz fóra?