VIRY.CZ

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-06-21 20:49:04
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 69 GB (84%) free of 82 GB
Total RAM: 1015 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:49:32, on 21.6.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eeepc.asus.com/global
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Documents and Settings\dagmar\Plocha\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SuperHybridEngine.lnk = ?
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Documents and Settings\dagmar\Plocha\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Documents and Settings\dagmar\Plocha\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Documents and Settings\dagmar\Plocha\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 6310 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Documents and Settings\dagmar\Plocha\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-07-15 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-28 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-02-28 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-09-06 1048888]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-09-24 104984]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-09-24 121368]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-09-24 100888]
"AsusTray"=C:\Program Files\EeePC\ACPI\AsTray.exe [2008-06-03 98304]
"AsusACPIServer"=C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe [2008-06-03 479232]
"AsusEPCMonitor"=C:\Program Files\EeePC\ACPI\AsEPCMon.exe [2008-05-21 94208]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-06-13 16871936]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-07-21 86016]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2006-05-04 2808832]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-02-28 149280]
"MobileConnect"=C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2008-11-04 2087424]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
SuperHybridEngine.lnk - C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2006-10-10 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Documents and Settings\dagmar\Plocha\Plugin Manager\skypePM.exe"="C:\Documents and Settings\dagmar\Plocha\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Google\Google Earth\client\googleearth.exe"="C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Documents and Settings\dagmar\Plocha\Phone\Skype.exe"="C:\Documents and Settings\dagmar\Plocha\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"

======List of files/folders created in the last 1 months======

2011-06-21 20:49:05 ----D---- C:\Program Files\trend micro
2011-06-21 20:49:04 ----D---- C:\rsit
2011-06-21 20:43:26 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-06-21 20:13:29 ----A---- C:\WINDOWS\ntbtlog.txt
2011-06-21 20:03:39 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Malwarebytes
2011-06-21 18:46:57 ----D---- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2011-06-21 18:46:57 ----D---- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
2011-06-21 18:39:17 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Macromedia
2011-06-21 18:39:17 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Adobe
2011-06-21 18:31:10 ----ASH---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\desktop.ini
2011-06-21 18:31:07 ----SD---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Microsoft
2011-06-21 18:31:07 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Template
2011-06-21 18:31:07 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Sun
2011-06-21 18:31:07 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\StarOffice8
2011-06-21 18:31:07 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\InstallShield
2011-06-21 18:31:07 ----D---- C:\Documents and Settings\Administrator.N-RVYF5H3JEKEMV\Data aplikací\Identities
2011-06-21 18:00:35 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-06-21 18:00:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2011-06-21 18:00:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-06-21 18:00:29 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-06-21 17:57:51 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-06-21 17:57:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-06-21 17:54:31 ----D---- C:\Program Files\CCleaner
2011-06-19 19:09:19 ----SHD---- C:\Config.Msi
2011-06-16 21:24:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2476490$
2011-06-16 21:24:26 ----HDC---- C:\WINDOWS\$NtUninstallKB2503665$
2011-06-16 21:24:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2535512$
2011-06-16 21:24:11 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276$
2011-06-16 21:23:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893$
2011-05-29 12:06:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\Easybits GO
2011-05-22 07:13:39 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$

======List of files/folders modified in the last 1 months======

2011-06-21 20:49:05 ----RD---- C:\Program Files
2011-06-21 20:47:09 ----D---- C:\WINDOWS
2011-06-21 20:45:38 ----D---- C:\WINDOWS\Prefetch
2011-06-21 20:43:59 ----D---- C:\WINDOWS\Temp
2011-06-21 20:03:34 ----D---- C:\WINDOWS\system32\drivers
2011-06-21 19:53:28 ----RASH---- C:\boot.ini
2011-06-21 18:58:00 ----D---- C:\WINDOWS\system32\drivers\etc
2011-06-21 18:42:53 ----D---- C:\WINDOWS\system32
2011-06-21 18:42:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-06-21 18:31:05 ----D---- C:\Documents and Settings
2011-06-21 17:55:24 ----D---- C:\WINDOWS\SoftwareDistribution
2011-06-21 17:55:24 ----D---- C:\WINDOWS\Debug
2011-06-21 17:55:08 ----SHD---- C:\RECYCLER
2011-06-21 17:48:08 ----HD---- C:\WINDOWS\inf
2011-06-21 17:48:07 ----D---- C:\WINDOWS\system32\CatRoot2
2011-06-21 12:25:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype Extras
2011-06-19 19:37:12 ----D---- C:\WINDOWS\Microsoft.NET
2011-06-19 19:37:06 ----RSD---- C:\WINDOWS\assembly
2011-06-19 19:10:48 ----SHD---- C:\WINDOWS\Installer
2011-06-19 19:10:14 ----D---- C:\WINDOWS\WinSxS
2011-06-17 10:47:16 ----D---- C:\Program Files\Microsoft Silverlight
2011-06-16 21:26:07 ----A---- C:\WINDOWS\system32\MRT.exe
2011-06-16 21:24:36 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-06-16 21:24:24 ----HD---- C:\WINDOWS\$hf_mig$
2011-06-16 21:24:00 ----D---- C:\Program Files\Internet Explorer
2011-05-31 00:12:53 ----A---- C:\WINDOWS\system32\mshtml.dll
2011-05-22 07:14:04 ----D---- C:\WINDOWS\system32\CatRoot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-05-03 546976]
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2007-07-26 11264]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-03-11 36864]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-09-26 101376]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2006-10-10 1181824]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-06-17 4756992]
S3 Ktp;Elantech Smart-Pad; C:\WINDOWS\system32\DRIVERS\ETD.sys [2008-05-19 25088]
S3 massfilter;ZTE Mass Storage Filter Driver; C:\WINDOWS\system32\DRIVERS\massfilter.sys [2008-12-08 7680]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys [2008-12-08 104960]
S3 ZTEusbnet;ZTE USB-NDIS miniport; C:\WINDOWS\system32\DRIVERS\ZTEusbnet.sys [2008-12-08 110080]
S3 ZTEusbnmea;ZTE NMEA Port; C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys [2008-12-08 105344]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys [2008-12-08 104960]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-21 136176]
S2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
S2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-02-28 153376]
S2 VMCService;Vodafone Mobile Connect Service; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-11-04 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-21 136176]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 usnjsvc;Služba Čtení deníku USN sdílených složek programu Messenger; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dobrý večer
jaký je váš problém přesněji a proč je pc v nouzovém režimu? v logu nic neobvyklého není..

Odinstalujte ICQtoolbar a všechny nepotřebné toolbary
nevidím antivir

• Antivir + firewall
• Doporučené zabezpečení systému naleznete ZDE
  avast! Free Antivirus

Spustíte pc v normálním režimu?

Zdravim,
problem je v tom, ze kdyz PC spustim normalne vyskoci tabulka s timto virem a nabizi reseni v podobe stahnuti nejakeho internetoveho zabezpeceni.nejede internet a stejne tak kdyz kliknu na jakoukoli ikonu na plose je zle.takze nouzovy rezim je jedine reseni. spybot nasel 26 malware fraud internet security (odstranil jsem je), pote anti malware a ten nenasel nic.po restartu PC se vse zase opakovalo. Toto PC je od znameho, nemel zadny antivirus ani firewal.

Výborně proveďte výše uvedené kroky,potom spuste v Combofix v nouzovém režimu..

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!

• Stáhneme si Combofix
• Program uložíme nejlépe na Plochu
• Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
• Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
• Spustíme Combofix.exe s administrátorským oprávněním
  U Windows XP se přihlásíme pod účtem správce
  Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
• Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
• Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
• Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
• Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
• Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
• (Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )

ted tady bojuju s combofixem.v nouzovem rezimu oskenoval pocitac a restartoval se. ted pocitac normalne nabehl a combofix pise ze pripravuje log a abych nespoustel zadne aplikace, ale samo se spustilo icq, ta chybova hlaska(vir) atd...a nic se zatim nedeje.mam cekat? nebo jsem udelal neco spatne?

ICQ bylo asi nastavené po startu..nic nedělejte čekejte na výsledný log

ComboFix 11-06-21.08 - Administrator 22.06.2011 12:58:46.1.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.793 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator.N-RVYF5H3JEKEMV\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Data aplikací\Plocha
c:\documents and settings\All Users\Data aplikací\Plocha\ECap.ini
c:\documents and settings\All Users\Data aplikací\Plocha\GenePccMon.ini
c:\windows\system32\Thumbs.db
D:\Autorun.inf
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-22 do 2011-06-22 )))))))))))))))))))))))))))))))
.
.
2011-06-21 18:49 . 2011-06-21 18:58 -------- d-----w- c:\program files\trend micro
2011-06-21 18:49 . 2011-06-21 18:49 -------- d-----w- C:\rsit
2011-06-21 16:46 . 2011-06-21 16:46 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2011-06-21 16:46 . 2011-06-21 16:46 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2011-06-21 16:00 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-21 16:00 . 2011-06-21 16:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-06-21 16:00 . 2011-06-21 18:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-21 16:00 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-21 15:57 . 2011-06-21 18:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-06-21 15:57 . 2011-06-21 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-06-21 15:54 . 2011-06-21 15:54 -------- d-----w- c:\program files\CCleaner
2011-06-21 15:52 . 2011-06-21 15:55 -------- d-----w- c:\documents and settings\Administrator
2011-05-29 10:06 . 2011-06-22 11:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Easybits GO
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-02 15:32 . 2008-07-02 09:21 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2008-07-02 11:07 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:06 . 2008-07-02 11:07 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:06 . 2008-07-02 11:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:06 . 2008-07-02 11:06 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2008-07-02 11:06 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-07-02 11:07 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2008-05-07 14:34 . 2008-07-03 09:25 15523560 ----a-w- c:\program files\U1 Setup.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\documents and settings\dagmar\Plocha\Phone\Skype.exe" [2011-04-18 15146376]
"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-04-09 119608]
"3585279370"="c:\documents and settings\dagmar\Local Settings\Data aplikací\lrj.exe" [2011-06-21 331776]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 121368]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-06-03 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-06-03 479232]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-20 94208]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-13 16871936]
"SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-28 149280]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
SuperHybridEngine.lnk - c:\program files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2008-7-2 294912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 09:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\dagmar\\Plocha\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Documents and Settings\\dagmar\\Plocha\\Phone\\Skype.exe"=
.
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [4.11.2008 11:39 14336]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21.7.2010 7:57 136176]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [21.7.2010 7:57 136176]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [17.5.2011 19:57 7680]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [17.5.2011 19:57 110080]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WUAUSERV
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249a2b58-8b70-11de-a984-00224374c886}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249a2b5b-8b70-11de-a984-00224374c886}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ee0b0e-80ae-11e0-ad43-00224374c886}]
\Shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ee0b0f-80ae-11e0-ad43-00224374c886}]
\Shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-21 05:57]
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-21 05:57]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-22 13:05
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3520)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\igfxext.exe
c:\documents and settings\dagmar\Plocha\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2011-06-22 13:13:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-22 11:13
.
Před spuštěním: Volných bajtů: 71 760 912 384
Po spuštění: Volných bajtů: 71 827 714 048
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30
.
- - End Of File - - 4E0093C4B67984C8C8CA2EFE3127C110

Takže opět stejné pravidla Comofixu,spuste v nouzovém režimu..poté mi sem vložte log a falešný antivir by měl být pryč

Otevřeme si Poznámkový blok

• (stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)
• Vložíme do něj následující script:

  Kód: Vybrat vše

  KillAll::
  
  Collect::
  c:\documents and settings\dagmar\Local Settings\Data aplikací\lrj.exe
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "3585279370"="-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249a2b58-8b70-11de-a984-00224374c886}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249a2b5b-8b70-11de-a984-00224374c886}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ee0b0e-80ae-11e0-ad43-00224374c886}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ee0b0f-80ae-11e0-ad43-00224374c886}]
  
  Driver::
  gupdate
  gupdatem
  
  Firefox::
  FF - ProfilePath - c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\
  FF - prefs.js: browser.search.selectedEngine - ICQ Search
  FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
  FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.7&q=
  FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
  
  Reboot::
  

• Soubor uložíme na Plochu jako CFScript.txt
• Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme
  
  
• Poté Combofix provede všechny operace a udělá nový log,který sem vložte

dobre provedu .... a mam to nechat po restartu jit do normalniho spusteni nebo do nouzoveho rezimu?

zkuste do normálního uvidíme

a jen nez se to udela, ten skript ste ted sestrojil vy? nebo kde se tehle tematice da porozumet? nemam slov klobouk dolu

Ano script jsem napsal já,byl jsem zde na forum ve škole takže školení,učení a učení..a pak závěrečné testy atd...Script píši na základě výpisu z Combofixu..a mimo havět,jsem dal opravit i otravný ICQ Search ve firefoxu

ComboFix 11-06-21.08 - Administrator 22.06.2011 13:35:11.2.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1015.804 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator.N-RVYF5H3JEKEMV\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator.N-RVYF5H3JEKEMV\Plocha\CFScript.txt
.
file zipped: c:\documents and settings\dagmar\Local Settings\Data aplikací\lrj.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components\ITB_History.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences\prefs.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences\user.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome.manifest
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\about.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\about.xul
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\autocomplete.xml
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\exitobserver.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\globals.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\highlight.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\icqtabs.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\icqtabs.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\icqtoolbar.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\icqtoolbar.xul
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img\bgLarge.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img\bgSmall.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img\buttonBlue.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img\buttonGreen.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img\searchLogo.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\localfileupdate.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\menu-button.xml
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_bg.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_cz.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_de.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_en.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_es.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_fr.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_he.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_it.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_ru.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_sk.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_tr.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\newTab_uk.html
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\options.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\options.xul
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\parsegamesxml.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\parsemenuxml.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\peoplesearch.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\peoplesearch.xul
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\prefutils.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\search.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\splitter.xml
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\statistics.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\tabcontext.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\utilities.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\voucher.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\zoom.js
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr\icq_locale.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr\itb.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr\itb_options.dtd
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr\options.properties
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\about.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\abt.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\ain.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\ang.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\default.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\dis.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\dropmarker.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\hide.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\icons.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\logo_small.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\more_vouchers_r.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\more_vouchers_y.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\options.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\peoplesearch.css
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\voucher_bg.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin\voucher_bg_y.png
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\install.rdf
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF\manifest.mf
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF\zigbert.rsa
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF\zigbert.sf
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine\icqplugin.gif
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine\icqplugin.src
c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine\icqplugin.xml
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GUPDATE
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-22 do 2011-06-22 )))))))))))))))))))))))))))))))
.
.
2011-06-21 18:49 . 2011-06-21 18:58 -------- d-----w- c:\program files\trend micro
2011-06-21 18:49 . 2011-06-21 18:49 -------- d-----w- C:\rsit
2011-06-21 16:46 . 2011-06-21 16:46 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2011-06-21 16:46 . 2011-06-21 16:46 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2011-06-21 16:00 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-21 16:00 . 2011-06-21 16:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-06-21 16:00 . 2011-06-21 18:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-21 16:00 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-21 15:57 . 2011-06-21 18:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-06-21 15:57 . 2011-06-21 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-06-21 15:54 . 2011-06-21 15:54 -------- d-----w- c:\program files\CCleaner
2011-06-21 15:52 . 2011-06-21 15:55 -------- d-----w- c:\documents and settings\Administrator
2011-05-29 10:06 . 2011-06-22 11:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Easybits GO
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-02 15:32 . 2008-07-02 09:21 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2008-07-02 11:07 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:06 . 2008-07-02 11:07 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:06 . 2008-07-02 11:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:06 . 2008-07-02 11:06 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2008-07-02 11:06 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-07-02 11:07 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2008-05-07 14:34 . 2008-07-03 09:25 15523560 ----a-w- c:\program files\U1 Setup.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\documents and settings\dagmar\Plocha\Phone\Skype.exe" [2011-04-18 15146376]
"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-04-09 119608]
"3585279370"="c:\documents and settings\dagmar\Local Settings\Data aplikací\lrj.exe" [2011-06-21 331776]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 121368]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-06-03 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-06-03 479232]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-20 94208]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-13 16871936]
"SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-28 149280]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
SuperHybridEngine.lnk - c:\program files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2008-7-2 294912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 09:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\dagmar\\Plocha\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Documents and Settings\\dagmar\\Plocha\\Phone\\Skype.exe"=
.
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [4.11.2008 11:39 14336]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [17.5.2011 19:57 7680]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [17.5.2011 19:57 110080]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-21 05:57]
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-21 05:57]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\dagmar\Data aplikací\Mozilla\Firefox\Profiles\0iekf2ug.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-22 13:45
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\SOUNDMAN.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\documents and settings\dagmar\Plocha\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2011-06-22 13:51:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-22 11:51
ComboFix2.txt 2011-06-22 11:13
.
Před spuštěním: Volných bajtů: 71 829 897 216
Po spuštění: Volných bajtů: 71 818 190 848
.
- - End Of File - - 70940C692A6A5D055F5CC3D39B4E3C46
Nahr nˇ probŘhlo ŁspŘçnŘ

Potvora se nesmazala..tak znovu

Otevřeme si Poznámkový blok

• (stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)
• Vložíme do něj následující script:

  Kód: Vybrat vše

  KillAll::
  
  Files::
  c:\documents and settings\dagmar\Local Settings\Data aplikací\lrj.exe
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "3585279370"="-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
  
  Reboot::
  
  
  
  

• Soubor uložíme na Plochu jako CFScript.txt
• Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme
  
  
• Poté Combofix provede všechny operace a udělá nový log,který sem vložte

no uz se tady neobjevila a vypada to ze to funguje normalne. v normalnim rezimu. mam udelat znovu log nebo spustit ten skript?