VIRY.CZ

Už nevim co s nim zkousel sem uz combofix a dalsi a stale tam je

log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Phoenix at 2011-09-07 20:15:04
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 31 GB (89%) free of 35 GB
Total RAM: 3327 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:15:08, on 7.9.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Documents and Settings\Phoenix\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\trend micro\Phoenix.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe

--
End of file - 3627 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\One-Click Tweak.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Phoenix\Data aplikací\Mozilla\Firefox\Profiles\pypfuk52.default

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=8]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2219184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-04-27 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe"="C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm

======List of files/folders created in the last 1 month======

2011-09-07 20:15:04 ----D---- C:\rsit
2011-09-07 20:15:04 ----D---- C:\Program Files\trend micro
2011-09-07 20:14:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2011-09-07 20:10:53 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\Adobe
2011-09-07 20:10:48 ----D---- C:\Program Files\CCleaner
2011-09-07 20:10:14 ----D---- C:\Program Files\Google
2011-09-07 20:03:15 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\WinRAR
2011-09-07 20:03:13 ----D---- C:\Program Files\WinRAR
2011-09-07 19:38:11 ----D---- C:\Program Files\Advanced PC Tweaker
2011-09-07 19:36:12 ----SHD---- C:\RECYCLER
2011-09-07 19:29:07 ----D---- C:\WINDOWS\temp
2011-09-07 19:26:14 ----A---- C:\Boot.bak
2011-09-07 19:26:11 ----RASHD---- C:\cmdcons
2011-09-07 19:23:30 ----A---- C:\WINDOWS\system32\h323log.txt
2011-09-07 19:21:46 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2011-09-07 19:21:13 ----A---- C:\WINDOWS\MBR.exe
2011-09-07 19:20:58 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2011-09-07 19:20:56 ----D---- C:\Config.Msi
2011-09-07 19:20:22 ----A---- C:\WINDOWS\system32\drivers\enum1394.sys
2011-09-07 19:19:55 ----A---- C:\WINDOWS\system32\usbui.dll
2011-09-07 19:19:44 ----A---- C:\WINDOWS\system32\drivers\wmiacpi.sys
2011-09-07 19:18:59 ----SHD---- C:\WINDOWS\Installer
2011-09-07 19:18:59 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-09-07 19:18:58 ----D---- C:\Program Files\Common Files\ODBC
2011-09-07 19:18:58 ----A---- C:\WINDOWS\ODBCINST.INI
2011-09-07 19:18:55 ----D---- C:\Program Files\Common Files\SpeechEngines
2011-09-07 19:18:54 ----RD---- C:\Program Files
2011-09-07 19:18:54 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-09-07 19:18:54 ----D---- C:\Program Files\Common Files
2011-09-07 19:18:50 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2011-09-07 19:18:50 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2011-09-07 19:18:50 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdur.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdru.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2011-09-07 19:18:48 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2011-09-07 19:18:46 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2011-09-07 19:18:46 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2011-09-07 19:18:46 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2011-09-07 19:18:46 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2011-09-07 19:18:45 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2011-09-07 19:18:45 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2011-09-07 19:18:45 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2011-09-07 19:18:44 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2011-09-07 19:18:44 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2011-09-07 19:18:44 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2011-09-07 19:18:44 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2011-09-07 19:18:44 ----RA---- C:\WINDOWS\system32\kbdest.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdro.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2011-09-07 19:18:37 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2011-09-07 19:18:34 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-09-07 19:18:34 ----A---- C:\WINDOWS\system32\irclass.dll
2011-09-07 19:18:34 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2011-09-07 19:18:34 ----A---- C:\WINDOWS\system32\dgsetup.dll
2011-09-07 19:18:34 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2011-09-07 19:18:31 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2011-09-07 19:18:31 ----A---- C:\WINDOWS\TASKMAN.EXE
2011-09-07 19:18:31 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2011-09-07 19:18:31 ----A---- C:\WINDOWS\system32\batt.dll
2011-09-07 19:18:30 ----A---- C:\WINDOWS\system32\storprop.dll
2011-09-07 19:18:30 ----A---- C:\WINDOWS\NOTEPAD.EXE
2011-09-07 19:18:24 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini
2011-09-07 19:18:20 ----RA---- C:\WINDOWS\SET8.tmp
2011-09-07 19:18:18 ----RA---- C:\WINDOWS\SET4.tmp
2011-09-07 19:18:16 ----RA---- C:\WINDOWS\SET3.tmp
2011-09-07 19:18:12 ----D---- C:\WINDOWS\system32\CatRoot2
2011-09-07 19:18:12 ----D---- C:\WINDOWS\system32\CatRoot
2011-09-07 19:18:10 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\GetRightToGo
2011-09-07 19:18:06 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-09-07 19:17:44 ----SHD---- C:\System Volume Information
2011-09-07 19:17:44 ----D---- C:\Documents and Settings
2011-09-07 19:17:43 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2011-09-07 19:17:04 ----RASH---- C:\boot.ini
2011-09-07 19:12:33 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-09-07 19:12:33 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-09-07 19:12:33 ----RSD---- C:\WINDOWS\Fonts
2011-09-07 19:12:33 ----RD---- C:\WINDOWS\Web
2011-09-07 19:12:33 ----HD---- C:\WINDOWS\inf
2011-09-07 19:12:33 ----D---- C:\WINDOWS\WinSxS
2011-09-07 19:12:33 ----D---- C:\WINDOWS\WBEM
2011-09-07 19:12:33 ----D---- C:\WINDOWS\twain_32
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\wins
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\wbem
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\usmt
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\spool
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\ShellExt
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\Setup
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\ras
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\oobe
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\npp
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\mui
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\inetsrv
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\IME
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\icsxml
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\ias
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\export
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\drivers\UMDF
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\drivers\etc
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\drivers\disdn
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\drivers
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\dhcp
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\cs-cz
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\cs
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\config
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\3com_dmi
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\3076
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\2052
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1054
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1042
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1041
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1037
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1033
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1031
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1029
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1028
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32\1025
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system32
2011-09-07 19:12:33 ----D---- C:\WINDOWS\system
2011-09-07 19:12:33 ----D---- C:\WINDOWS\security
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Resources
2011-09-07 19:12:33 ----D---- C:\WINDOWS\repair
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Provisioning
2011-09-07 19:12:33 ----D---- C:\WINDOWS\pchealth
2011-09-07 19:12:33 ----D---- C:\WINDOWS\PeerNet
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Offline Web Pages
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Network Diagnostic
2011-09-07 19:12:33 ----D---- C:\WINDOWS\mui
2011-09-07 19:12:33 ----D---- C:\WINDOWS\msapps
2011-09-07 19:12:33 ----D---- C:\WINDOWS\msagent
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Media
2011-09-07 19:12:33 ----D---- C:\WINDOWS\L2Schemas
2011-09-07 19:12:33 ----D---- C:\WINDOWS\java
2011-09-07 19:12:33 ----D---- C:\WINDOWS\ime
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Help
2011-09-07 19:12:33 ----D---- C:\WINDOWS\ehome
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Driver Cache
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Debug
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Cursors
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Connection Wizard
2011-09-07 19:12:33 ----D---- C:\WINDOWS\Config
2011-09-07 19:12:33 ----D---- C:\WINDOWS\AppPatch
2011-09-07 19:12:33 ----D---- C:\WINDOWS\addins
2011-09-07 19:12:33 ----D---- C:\WINDOWS
2011-09-07 19:12:33 ----ASH---- C:\pagefile.sys
2011-09-07 18:36:45 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\Mozilla
2011-09-07 18:36:42 ----D---- C:\Program Files\Mozilla Firefox
2011-09-07 18:33:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Innovative Solutions
2011-09-07 18:31:22 ----A---- C:\WINDOWS\MyDrivers.ini
2011-09-07 18:27:36 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\Macromedia
2011-09-07 18:08:58 ----D---- C:\Program Files\ESET
2011-09-07 17:57:50 ----A---- C:\WINDOWS\mvraidver.dat
2011-09-07 17:55:22 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2011-09-07 17:54:43 ----D---- C:\Program Files\Marvell
2011-09-07 17:54:34 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\TMP
2011-09-07 17:53:17 ----D---- C:\WINDOWS\ASUSInstAll
2011-09-07 17:36:15 ----D---- C:\Program Files\Common Files\InstallShield
2011-09-07 17:35:15 ----D---- C:\WINDOWS\system32\ReinstallBackups
2011-09-07 17:35:13 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-09-07 17:35:13 ----A---- C:\WINDOWS\system32\drivers\AmdPPM.sys
2011-09-07 17:35:11 ----HD---- C:\Program Files\InstallShield Installation Information
2011-09-07 17:35:11 ----D---- C:\Program Files\AMD
2011-09-07 17:35:08 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\InstallShield
2011-09-07 17:34:36 ----A---- C:\WINDOWS\Ascd_log.ini
2011-09-07 17:34:25 ----A---- C:\WINDOWS\Ascd_tmp.ini
2011-09-07 17:34:23 ----RA---- C:\WINDOWS\system32\drivers\ASACPI.sys
2011-09-07 17:34:13 ----A---- C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2011-09-07 17:33:16 ----D---- C:\Documents and Settings\Phoenix\Data aplikací\Identities
2011-09-07 17:33:15 ----HD---- C:\Program Files\Uninstall Information
2011-09-07 17:33:12 ----SD---- C:\Documents and Settings\Phoenix\Data aplikací\Microsoft
2011-09-07 17:33:12 ----ASH---- C:\Documents and Settings\Phoenix\Data aplikací\desktop.ini
2011-09-07 17:32:43 ----D---- C:\WINDOWS\SoftwareDistribution
2011-09-07 17:32:42 ----SD---- C:\WINDOWS\system32\Microsoft
2011-09-07 17:32:42 ----D---- C:\WINDOWS\Prefetch
2011-09-07 17:32:41 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-09-07 17:31:36 ----AS---- C:\WINDOWS\bootstat.dat
2011-09-07 17:30:08 ----D---- C:\WINDOWS\system32\xircom
2011-09-07 17:30:08 ----D---- C:\Program Files\xerox
2011-09-07 17:30:08 ----D---- C:\Program Files\microsoft frontpage
2011-09-07 17:29:32 ----N---- C:\WINDOWS\system32\spmsg.dll
2011-09-07 17:29:31 ----HD---- C:\WINDOWS\$hf_mig$
2011-09-07 17:29:21 ----RASH---- C:\MSDOS.SYS
2011-09-07 17:29:21 ----RASH---- C:\IO.SYS
2011-09-07 17:29:21 ----A---- C:\WINDOWS\control.ini
2011-09-07 17:29:21 ----A---- C:\CONFIG.SYS
2011-09-07 17:29:09 ----A---- C:\WINDOWS\system32\mapi32.dll
2011-09-07 17:28:27 ----HD---- C:\Program Files\WindowsUpdate
2011-09-07 17:28:24 ----D---- C:\Program Files\Online Services
2011-09-07 17:28:07 ----D---- C:\WINDOWS\system32\DirectX
2011-09-07 17:27:58 ----A---- C:\WINDOWS\system32\atrace.dll
2011-09-07 17:27:55 ----A---- C:\WINDOWS\system32\desktop.ini
2011-09-07 17:27:55 ----A---- C:\WINDOWS\desktop.ini
2011-09-07 17:27:47 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2011-09-07 17:27:46 ----A---- C:\WINDOWS\system32\acctres.dll
2011-09-07 17:27:45 ----D---- C:\Program Files\Common Files\Services
2011-09-07 17:27:42 ----SD---- C:\WINDOWS\Tasks
2011-09-07 17:27:42 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2011-09-07 17:27:41 ----D---- C:\Program Files\Common Files\MSSoap
2011-09-07 17:27:36 ----D---- C:\WINDOWS\srchasst
2011-09-07 17:27:35 ----D---- C:\WINDOWS\system32\Macromed
2011-09-07 17:27:33 ----A---- C:\WINDOWS\system32\wuweb.dll
2011-09-07 17:27:33 ----A---- C:\WINDOWS\system32\wucltui.dll
2011-09-07 17:27:33 ----A---- C:\WINDOWS\system32\wuauserv.dll
2011-09-07 17:27:33 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\wups.dll
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\wuaueng.dll
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\wuauclt.exe
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\wuapi.dll
2011-09-07 17:27:32 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2011-09-07 17:27:31 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2011-09-07 17:27:31 ----A---- C:\WINDOWS\system32\qmgr.dll
2011-09-07 17:27:31 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2011-09-07 17:27:31 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2011-09-07 17:27:27 ----D---- C:\Program Files\Movie Maker
2011-09-07 17:27:06 ----A---- C:\WINDOWS\system32\safrslv.dll
2011-09-07 17:27:06 ----A---- C:\WINDOWS\system32\safrdm.dll
2011-09-07 17:27:06 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2011-09-07 17:27:06 ----A---- C:\WINDOWS\system32\racpldlg.dll
2011-09-07 17:27:01 ----A---- C:\WINDOWS\system32\fltMc.exe
2011-09-07 17:27:01 ----A---- C:\WINDOWS\system32\fltlib.dll
2011-09-07 17:27:01 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2011-09-07 17:27:00 ----D---- C:\WINDOWS\system32\Restore
2011-09-07 17:27:00 ----A---- C:\WINDOWS\system32\srsvc.dll
2011-09-07 17:27:00 ----A---- C:\WINDOWS\system32\srrstr.dll
2011-09-07 17:27:00 ----A---- C:\WINDOWS\system32\srclient.dll
2011-09-07 17:27:00 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2011-09-07 17:26:59 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2011-09-07 17:26:59 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2011-09-07 17:26:59 ----A---- C:\WINDOWS\system32\mnmdd.dll
2011-09-07 17:26:59 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2011-09-07 17:26:59 ----A---- C:\WINDOWS\system32\ils.dll
2011-09-07 17:26:58 ----A---- C:\WINDOWS\system32\msconf.dll
2011-09-07 17:26:55 ----D---- C:\Program Files\NetMeeting
2011-09-07 17:26:55 ----A---- C:\WINDOWS\system32\msoert2.dll
2011-09-07 17:26:55 ----A---- C:\WINDOWS\system32\msoeacct.dll
2011-09-07 17:26:54 ----A---- C:\WINDOWS\system32\inetres.dll
2011-09-07 17:26:53 ----A---- C:\WINDOWS\system32\inetcomm.dll
2011-09-07 17:26:51 ----D---- C:\Program Files\Outlook Express
2011-09-07 17:26:51 ----A---- C:\WINDOWS\system32\schedsvc.dll
2011-09-07 17:26:51 ----A---- C:\WINDOWS\system32\mstinit.exe
2011-09-07 17:26:51 ----A---- C:\WINDOWS\system32\mstask.dll
2011-09-07 17:26:50 ----A---- C:\WINDOWS\system32\isign32.dll
2011-09-07 17:26:50 ----A---- C:\WINDOWS\system32\inetcfg.dll
2011-09-07 17:26:50 ----A---- C:\WINDOWS\system32\icwphbk.dll
2011-09-07 17:26:50 ----A---- C:\WINDOWS\system32\icwdial.dll
2011-09-07 17:26:43 ----D---- C:\Program Files\Common Files\System
2011-09-07 17:26:42 ----D---- C:\Program Files\Internet Explorer
2011-09-07 17:26:20 ----A---- C:\WINDOWS\system32\emptyregdb.dat
2011-09-07 17:26:12 ----D---- C:\Program Files\ComPlus Applications
2011-09-07 17:26:10 ----A---- C:\WINDOWS\vbaddin.ini
2011-09-07 17:26:10 ----A---- C:\WINDOWS\vb.ini
2011-09-07 17:26:07 ----D---- C:\WINDOWS\Registration
2011-09-07 17:25:51 ----D---- C:\Program Files\Windows Media Connect 2
2011-09-07 17:25:50 ----D---- C:\Program Files\Windows Media Player
2011-09-07 17:25:48 ----D---- C:\Program Files\Messenger
2011-09-07 17:25:44 ----D---- C:\Program Files\MSN Gaming Zone
2011-09-07 17:25:44 ----A---- C:\WINDOWS\system32\write.exe
2011-09-07 17:25:33 ----A---- C:\WINDOWS\system32\sndvol32.exe
2011-09-07 17:25:33 ----A---- C:\WINDOWS\system32\hticons.dll
2011-09-07 17:25:33 ----A---- C:\WINDOWS\system32\avwav.dll
2011-09-07 17:25:33 ----A---- C:\WINDOWS\system32\avtapi.dll
2011-09-07 17:25:33 ----A---- C:\WINDOWS\system32\avmeter.dll
2011-09-07 17:25:32 ----A---- C:\WINDOWS\system32\winchat.exe
2011-09-07 17:25:25 ----A---- C:\WINDOWS\system32\getuname.dll
2011-09-07 17:25:24 ----A---- C:\WINDOWS\system32\sol.exe
2011-09-07 17:25:24 ----A---- C:\WINDOWS\system32\charmap.exe
2011-09-07 17:25:24 ----A---- C:\WINDOWS\system32\calc.exe
2011-09-07 17:25:23 ----A---- C:\WINDOWS\system32\winmine.exe
2011-09-07 17:25:23 ----A---- C:\WINDOWS\system32\reset.exe
2011-09-07 17:25:23 ----A---- C:\WINDOWS\system32\mshearts.exe
2011-09-07 17:25:23 ----A---- C:\WINDOWS\system32\freecell.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\tslabels.ini
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\tskill.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\tscon.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\shadow.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\rwinsta.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\regini.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\qwinsta.exe
2011-09-07 17:25:22 ----A---- C:\WINDOWS\system32\qappsrv.exe
2011-09-07 17:25:21 ----A---- C:\WINDOWS\system32\msg.exe
2011-09-07 17:25:21 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2011-09-07 17:25:21 ----A---- C:\WINDOWS\system32\logoff.exe
2011-09-07 17:25:21 ----A---- C:\WINDOWS\system32\cdmodem.dll
2011-09-07 17:25:15 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2011-09-07 17:25:14 ----A---- C:\WINDOWS\system32\accwiz.exe
2011-09-07 17:25:13 ----A---- C:\WINDOWS\system32\sndrec32.exe
2011-09-07 17:25:13 ----A---- C:\WINDOWS\system32\mplay32.exe
2011-09-07 17:25:13 ----A---- C:\WINDOWS\system32\hypertrm.dll
2011-09-07 17:25:12 ----D---- C:\Program Files\Windows NT
2011-09-07 17:25:12 ----A---- C:\WINDOWS\system32\spider.exe
2011-09-07 17:25:12 ----A---- C:\WINDOWS\system32\mspaint.exe
2011-09-07 17:25:12 ----A---- C:\WINDOWS\system32\clipbrd.exe
2011-09-07 17:25:11 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2011-09-07 17:25:11 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2011-09-07 17:25:11 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2011-09-07 17:25:10 ----A---- C:\WINDOWS\system32\tsgqec.dll
2011-09-07 17:25:10 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2011-09-07 17:25:10 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2011-09-07 17:25:10 ----A---- C:\WINDOWS\system32\aaclient.dll
2011-09-07 17:25:09 ----A---- C:\WINDOWS\system32\remotepg.dll
2011-09-07 17:25:09 ----A---- C:\WINDOWS\system32\rdshost.exe
2011-09-07 17:25:09 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2011-09-07 17:25:09 ----A---- C:\WINDOWS\system32\mstscax.dll
2011-09-07 17:25:09 ----A---- C:\WINDOWS\system32\mstsc.exe
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\termsrv.dll
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\sessmgr.exe
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\rdpclip.exe
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\rdchost.dll
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\qprocess.exe
2011-09-07 17:25:08 ----A---- C:\WINDOWS\system32\icaapi.dll
2011-09-07 17:25:07 ----D---- C:\WINDOWS\system32\MsDtc
2011-09-07 17:25:07 ----A---- C:\WINDOWS\system32\mtxoci.dll
2011-09-07 17:25:07 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2011-09-07 17:25:07 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2011-09-07 17:25:07 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2011-09-07 17:25:06 ----A---- C:\WINDOWS\system32\xolehlp.dll
2011-09-07 17:25:06 ----A---- C:\WINDOWS\system32\msdtctm.dll
2011-09-07 17:25:06 ----A---- C:\WINDOWS\system32\msdtclog.dll
2011-09-07 17:25:06 ----A---- C:\WINDOWS\system32\msdtc.exe
2011-09-07 17:25:05 ----D---- C:\WINDOWS\system32\Com
2011-09-07 17:25:05 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2011-09-07 17:25:05 ----A---- C:\WINDOWS\system32\mtxex.dll
2011-09-07 17:25:05 ----A---- C:\WINDOWS\system32\mtxdm.dll
2011-09-07 17:25:05 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2011-09-07 17:25:05 ----A---- C:\WINDOWS\system32\colbact.dll
2011-09-07 17:25:04 ----A---- C:\WINDOWS\system32\stclient.dll
2011-09-07 17:25:04 ----A---- C:\WINDOWS\system32\comrepl.dll
2011-09-07 17:25:04 ----A---- C:\WINDOWS\system32\comaddin.dll
2011-09-07 17:25:04 ----A---- C:\WINDOWS\system32\clbcatex.dll
2011-09-07 17:25:04 ----A---- C:\WINDOWS\system32\catsrvps.dll
2011-09-07 17:25:03 ----A---- C:\WINDOWS\system32\comsvcs.dll
2011-09-07 17:25:03 ----A---- C:\WINDOWS\system32\catsrvut.dll
2011-09-07 17:25:03 ----A---- C:\WINDOWS\system32\catsrv.dll
2011-09-07 17:25:02 ----A---- C:\WINDOWS\system32\comuid.dll
2011-09-07 17:25:02 ----A---- C:\WINDOWS\system32\comsnap.dll
2011-09-07 17:25:02 ----A---- C:\WINDOWS\system32\clbcatq.dll
2011-09-07 17:24:55 ----A---- C:\WINDOWS\system32\servdeps.dll
2011-09-07 17:24:55 ----A---- C:\WINDOWS\system32\mmfutil.dll
2011-09-07 17:24:55 ----A---- C:\WINDOWS\system32\licwmi.dll
2011-09-07 17:24:54 ----A---- C:\WINDOWS\system32\cmprops.dll
2011-09-07 17:24:51 ----A---- C:\WINDOWS\system32\drivers\termdd.sys
2011-09-07 17:24:51 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys

======List of files/folders modified in the last 1 month======

2011-09-07 19:28:32 ----A---- C:\WINDOWS\system.ini
2011-09-07 17:57:50 ----A---- C:\WINDOWS\zraidtray.ini
2011-09-07 17:57:46 ----A---- C:\WINDOWS\php.ini
2011-09-07 17:29:20 ----A---- C:\WINDOWS\win.ini
2011-09-07 17:29:00 ----ASH---- C:\WINDOWS\fonts\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mv61xx;mv61xx; C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-06-15 143256]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-27 60800]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-27 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-14 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-27 61824]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2007-06-08 262912]
S3 catchme;catchme; \??\C:\DOCUME~1\Phoenix\LOCALS~1\Temp\catchme.sys []
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-04-27 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-04-27 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MRUWebService;MRU Web Service; C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe [2007-05-23 20539]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-01-12 810144]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-07 136176]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 33584]
S3 Marvell RAID;Marvell RAID Event Agent; C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2007-06-12 61440]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

Dejte log z ComboFix. Najdete ho v C:\combofix.txt .

Tady je
trosku to trvalo PC je zasekane

ComboFix 11-09-07.04 - Phoenix 07.09.2011 20:36:48.2.4 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2833 [GMT 2:00]
Spuštěný z: c:\documents and settings\Phoenix\Dokumenty\Stažené soubory\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-07 do 2011-09-07 )))))))))))))))))))))))))))))))
.
.
2011-09-07 18:15 . 2011-09-07 18:15 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 06:15 . 2011-09-07 16:36 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
c:\windows\System32\ksuser.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2009-01-13 864256]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
.
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [15.6.2007 9:52 143256]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [23.5.2007 2:17 20539]
R4 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys --> c:\windows\system32\drivers\PCTCore.sys [?]
R4 pctgntdi;pctgntdi;\??\c:\windows\system32\drivers\pctgntdi.sys --> c:\windows\system32\drivers\pctgntdi.sys [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7.9.2011 20:10 136176]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7.9.2011 20:10 136176]
S3 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [12.6.2007 20:54 61440]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - mchInjDrv
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 18:10]
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 18:10]
.
2011-09-07 c:\windows\Tasks\One-Click Tweak.job
- c:\program files\Advanced PC Tweaker\OneClick.exe [2011-09-07 09:14]
.
.
------- Doplňkový sken -------
.
uStart Page = go.microsoft.com/fwlink/?LinkId=69157
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\Phoenix\Data aplikací\Mozilla\Firefox\Profiles\pypfuk52.default\
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-07 20:38
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(812)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
- - - - - - - > 'explorer.exe'(3948)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Celkový čas: 2011-09-07 20:39:22
ComboFix-quarantined-files.txt 2011-09-07 18:39
.
Před spuštěním: Volných bajtů: 32 383 545 344
Po spuštění: Volných bajtů: 32 541 442 048
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 720627D706741FBE5BA3516A3F6AC386

1. Stáhněte knihovnu ksuser.dll odtud: http://www.dll-files.com/dllindex/dll-f ... tml?ksuser a rozbalte ji na plochu. CF přesuňte na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Driver::
mchInjDrv

FCopy::
c:\documents and settings\Phoenix\plocha\ksuser.dll | c:\windows\System32\ksuser.dll

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

to to je vysledek
ComboFix 11-09-07.04 - Phoenix 07.09.2011 21:29:50.3.4 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2776 [GMT 2:00]
Spuštěný z: c:\documents and settings\Phoenix\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Phoenix\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Spyware Doctor with AntiVirus *Disabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\documents and settings\Phoenix\plocha\ksuser.dll --> c:\windows\System32\ksuser.dll
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MCHINJDRV
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-07 do 2011-09-07 )))))))))))))))))))))))))))))))
.
.
2011-09-07 18:50 . 2011-09-07 18:59 -------- d-----w- C:\sh4ldr
2011-09-07 18:15 . 2011-09-07 18:15 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 06:15 . 2011-09-07 16:36 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_18.38.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 1601-01-01 00:00 . 1601-01-01 00:00 0 c:\windows\LastGood.Tmp\system32\ksuser.dll
+ 2011-09-07 19:25 . 2011-03-25 16:03 15592 c:\windows\system32\roboot.exe
- 2001-10-25 16:00 . 2011-09-07 18:38 39992 c:\windows\system32\perfc009.dat
+ 2001-10-25 16:00 . 2011-09-07 19:25 39992 c:\windows\system32\perfc009.dat
- 2001-10-25 16:00 . 2011-09-07 18:38 46016 c:\windows\system32\perfc005.dat
+ 2001-10-25 16:00 . 2011-09-07 19:25 46016 c:\windows\system32\perfc005.dat
+ 2011-09-07 19:00 . 2011-01-20 11:27 69392 c:\windows\system32\drivers\TfSysMon.sys
+ 2011-09-07 19:00 . 2011-01-20 11:27 33552 c:\windows\system32\drivers\TfNetMon.sys
+ 2011-09-07 19:00 . 2011-01-20 11:27 51984 c:\windows\system32\drivers\TfFsMon.sys
+ 2011-09-07 18:53 . 2011-07-11 07:07 70664 c:\windows\system32\drivers\pctplsg.sys
+ 2011-09-07 18:58 . 2011-09-07 18:58 27499 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCall.dll
+ 2011-09-07 19:25 . 2008-04-14 04:51 4096 c:\windows\system32\dllcache\ksuser.dll
+ 2001-10-25 16:00 . 2011-09-07 19:25 311604 c:\windows\system32\perfh009.dat
- 2001-10-25 16:00 . 2011-09-07 18:38 311604 c:\windows\system32\perfh009.dat
- 2001-10-25 16:00 . 2011-09-07 18:38 309716 c:\windows\system32\perfh005.dat
+ 2001-10-25 16:00 . 2011-09-07 19:25 309716 c:\windows\system32\perfh005.dat
+ 2011-09-07 18:47 . 2011-09-07 18:47 243360 c:\windows\system32\Macromed\Flash\FlashUtil10w_Plugin.exe
+ 2011-09-07 18:53 . 2011-03-10 07:08 233976 c:\windows\system32\drivers\PCTSD.sys
+ 2011-09-07 18:53 . 2010-07-16 12:59 656320 c:\windows\system32\drivers\pctEFA.sys
+ 2011-09-07 18:53 . 2010-07-16 12:59 338880 c:\windows\system32\drivers\pctDS.sys
+ 2011-09-07 18:54 . 2011-07-01 13:36 149456 c:\windows\SGDetectionTool.dll
+ 2011-09-07 18:54 . 2011-07-01 13:36 767952 c:\windows\BDTSupport.dll
+ 2011-09-07 18:49 . 2011-09-07 18:49 180356 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla21.exe
+ 2011-09-07 18:58 . 2011-09-07 18:58 180356 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla21.dll
+ 2011-09-07 18:58 . 2011-09-07 18:58 175992 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla20.dll
+ 2011-09-07 18:58 . 2011-09-07 18:58 176035 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla2.dll
+ 2011-09-07 18:58 . 2011-09-07 18:58 176035 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla19.dll
+ 2011-09-07 18:58 . 2011-09-07 18:58 179340 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla18.exe
+ 2011-09-07 18:58 . 2011-09-07 18:58 176545 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla17.dll
+ 2011-09-07 18:58 . 2011-09-07 18:58 179340 c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP\WiseCustomCalla.dll
+ 2011-09-07 18:47 . 2011-09-07 18:47 6277280 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-09-07 18:54 . 2011-07-01 13:36 1533904 c:\windows\PCTBDRes.dll
+ 2011-09-07 18:54 . 2011-07-01 13:36 2029520 c:\windows\PCTBDCore.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RDReminder"="c:\program files\Dll-Files.com Fixer\DLLFixer.exe" [2011-03-25 1461480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-07-01 247760]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
.
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [15.6.2007 9:52 143256]
R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [7.9.2011 20:53 338880]
R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [7.9.2011 20:53 656320]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [7.9.2011 21:00 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [7.9.2011 21:00 69392]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [7.9.2011 20:54 337872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [23.5.2007 2:17 20539]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [7.9.2011 20:53 233976]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7.9.2011 20:10 136176]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7.9.2011 20:10 136176]
S3 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [12.6.2007 20:54 61440]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [7.9.2011 20:53 371472]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [7.9.2011 21:00 33552]
S3 ThreatFire;ThreatFire;c:\program files\PC Tools Security\TFEngine\TFService.exe service --> c:\program files\PC Tools Security\TFEngine\TFService.exe service [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-07 c:\windows\Tasks\DLL-files.com Fixer_MONTHLY.job
- c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2011-09-07 16:03]
.
2011-09-07 c:\windows\Tasks\DLL-files.com Fixer_UPDATES.job
- c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2011-09-07 16:03]
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 18:10]
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 18:10]
.
2011-09-07 c:\windows\Tasks\One-Click Tweak.job
- c:\program files\Advanced PC Tweaker\OneClick.exe [2011-09-07 09:14]
.
.
------- Doplňkový sken -------
.
uStart Page = go.microsoft.com/fwlink/?LinkId=69157
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\Phoenix\Data aplikací\Mozilla\Firefox\Profiles\pypfuk52.default\
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-07 21:33
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(784)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
- - - - - - - > 'explorer.exe'(3656)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\wscntfy.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Celkový čas: 2011-09-07 21:34:06 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-07 19:34
ComboFix2.txt 2011-09-07 18:39
.
Před spuštěním: Volných bajtů: 32 144 592 896
Po spuštění: Volných bajtů: 32 108 204 032
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - E33E1FED6D86B85971C51946A34BB4D1

Smazáno, log již vypadá čistý. Nastala nějaká změna?

Po restartu to virus jeste nahlasilo ale ted hlaska zmizela
skusim jeste jeden restart

tak bohuzel stale tam je
pripojuji obrazek

Ani se nedivím, i bez něho byl komp náramně zasviněný. Stáhněte a spusťte TDSSKiller a postupujte podle kolegova návodu:

Utilitu spustte a prikazte ji, at skenuje - klik na Start Scan
Pokud utilita najde infikekci, bude ji chtit lecit (Cure), povolte leceni kliknutim na Continue
Pokud utilita najde podezrely soubor (suspicious), bude jej chtit preskocit (Skip), povolte preskoceni kliknutim na Continue
Po dokonceni skenu bude mozna nutny restart PC, povolte jej kliknutim na Reboot now
Po restartu na Vas vyskoci log, pokud se tak nestane, najdete jej primo na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt - jeho obsah sem vlozte
Pokud restart nebude vyzadovan, kliknete na Close a nasledne na Report - vytvori se log - jeho obsah sem vlozte

2011/09/07 21:53:23.0687 3492 TDSS rootkit removing tool 2.5.19.0 Sep 6 2011 19:23:56
2011/09/07 21:53:23.0890 3492 ================================================================================
2011/09/07 21:53:23.0890 3492 SystemInfo:
2011/09/07 21:53:23.0890 3492
2011/09/07 21:53:23.0890 3492 OS Version: 5.1.2600 ServicePack: 3.0
2011/09/07 21:53:23.0890 3492 Product type: Workstation
2011/09/07 21:53:23.0890 3492 ComputerName: PC-9BD1011A4529
2011/09/07 21:53:23.0890 3492 UserName: Phoenix
2011/09/07 21:53:23.0890 3492 Windows directory: C:\WINDOWS
2011/09/07 21:53:23.0890 3492 System windows directory: C:\WINDOWS
2011/09/07 21:53:23.0890 3492 Processor architecture: Intel x86
2011/09/07 21:53:23.0890 3492 Number of processors: 4
2011/09/07 21:53:23.0890 3492 Page size: 0x1000
2011/09/07 21:53:23.0890 3492 Boot type: Normal boot
2011/09/07 21:53:23.0890 3492 ================================================================================
2011/09/07 21:53:25.0765 3492 Initialize success
2011/09/07 21:53:27.0093 3776 ================================================================================
2011/09/07 21:53:27.0093 3776 Scan started
2011/09/07 21:53:27.0093 3776 Mode: Manual;
2011/09/07 21:53:27.0093 3776 ================================================================================
2011/09/07 21:53:27.0796 3776 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/09/07 21:53:27.0828 3776 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/09/07 21:53:27.0875 3776 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys
2011/09/07 21:53:27.0953 3776 AmdPPM (033448d435e65c4bd72e70521fd05c76) C:\WINDOWS\system32\DRIVERS\AmdPPM.sys
2011/09/07 21:53:28.0000 3776 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/09/07 21:53:28.0062 3776 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/09/07 21:53:28.0093 3776 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/09/07 21:53:28.0125 3776 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/09/07 21:53:28.0171 3776 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/09/07 21:53:28.0218 3776 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/09/07 21:53:28.0265 3776 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/09/07 21:53:28.0312 3776 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/09/07 21:53:28.0343 3776 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/09/07 21:53:28.0375 3776 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/09/07 21:53:28.0484 3776 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/09/07 21:53:28.0531 3776 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
2011/09/07 21:53:28.0578 3776 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
2011/09/07 21:53:28.0625 3776 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/09/07 21:53:28.0687 3776 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
2011/09/07 21:53:28.0718 3776 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
2011/09/07 21:53:28.0765 3776 epfwtdir (aa0667eb9a92414abb784c101a6c7fec) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
2011/09/07 21:53:28.0812 3776 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/09/07 21:53:28.0828 3776 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/09/07 21:53:28.0859 3776 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
2011/09/07 21:53:28.0875 3776 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/09/07 21:53:28.0921 3776 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/09/07 21:53:28.0953 3776 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/09/07 21:53:28.0968 3776 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/09/07 21:53:29.0000 3776 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/09/07 21:53:29.0046 3776 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/09/07 21:53:29.0078 3776 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/09/07 21:53:29.0125 3776 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/09/07 21:53:29.0171 3776 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/09/07 21:53:29.0203 3776 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/09/07 21:53:29.0265 3776 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/09/07 21:53:29.0296 3776 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/09/07 21:53:29.0328 3776 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/09/07 21:53:29.0359 3776 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/09/07 21:53:29.0375 3776 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/09/07 21:53:29.0406 3776 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/09/07 21:53:29.0437 3776 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/09/07 21:53:29.0468 3776 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/09/07 21:53:29.0484 3776 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/09/07 21:53:29.0562 3776 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/09/07 21:53:29.0578 3776 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
2011/09/07 21:53:29.0609 3776 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/09/07 21:53:29.0640 3776 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/09/07 21:53:29.0687 3776 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/09/07 21:53:29.0968 3776 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/09/07 21:53:30.0015 3776 MRxSmb (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/09/07 21:53:30.0046 3776 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/09/07 21:53:30.0093 3776 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/09/07 21:53:30.0093 3776 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
2011/09/07 21:53:30.0125 3776 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/09/07 21:53:30.0156 3776 mv61xx (86944f540289e16298af4f5b1c45fa4e) C:\WINDOWS\system32\DRIVERS\mv61xx.sys
2011/09/07 21:53:30.0234 3776 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/09/07 21:53:30.0250 3776 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/09/07 21:53:30.0281 3776 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/09/07 21:53:30.0296 3776 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/09/07 21:53:30.0328 3776 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/09/07 21:53:30.0359 3776 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/09/07 21:53:30.0390 3776 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/09/07 21:53:30.0421 3776 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/09/07 21:53:30.0437 3776 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/09/07 21:53:30.0468 3776 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/09/07 21:53:30.0531 3776 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/09/07 21:53:30.0562 3776 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/09/07 21:53:30.0578 3776 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/09/07 21:53:30.0609 3776 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/09/07 21:53:30.0625 3776 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\drivers\Parport.sys
2011/09/07 21:53:30.0656 3776 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/09/07 21:53:30.0687 3776 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/09/07 21:53:30.0703 3776 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/09/07 21:53:30.0750 3776 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/09/07 21:53:30.0765 3776 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/09/07 21:53:30.0828 3776 pctDS (f820b4c61d1e591325b679d479d4eea4) C:\WINDOWS\system32\drivers\pctDS.sys
2011/09/07 21:53:30.0890 3776 pctEFA (acc8c15f3d59f17c5d903ff1de3b43d3) C:\WINDOWS\system32\drivers\pctEFA.sys
2011/09/07 21:53:30.0953 3776 PCTSD (83ddd552f7f1043f764e8cc88ff41232) C:\WINDOWS\system32\Drivers\PCTSD.sys
2011/09/07 21:53:31.0062 3776 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/09/07 21:53:31.0093 3776 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/09/07 21:53:31.0125 3776 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/09/07 21:53:31.0171 3776 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/09/07 21:53:31.0265 3776 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/09/07 21:53:31.0296 3776 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/09/07 21:53:31.0328 3776 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/09/07 21:53:31.0343 3776 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/09/07 21:53:31.0375 3776 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/09/07 21:53:31.0437 3776 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/09/07 21:53:31.0468 3776 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/09/07 21:53:31.0531 3776 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/09/07 21:53:31.0593 3776 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/09/07 21:53:31.0656 3776 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/09/07 21:53:31.0703 3776 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/09/07 21:53:31.0718 3776 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/09/07 21:53:31.0765 3776 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/09/07 21:53:31.0828 3776 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/09/07 21:53:31.0875 3776 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/09/07 21:53:31.0921 3776 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/09/07 21:53:32.0015 3776 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/09/07 21:53:32.0046 3776 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/09/07 21:53:32.0078 3776 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/09/07 21:53:32.0093 3776 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/09/07 21:53:32.0171 3776 TfFsMon (5dcf578c5e1ed53f9f6cc3296d9914de) C:\WINDOWS\system32\drivers\TfFsMon.sys
2011/09/07 21:53:32.0218 3776 TfNetMon (8d18700c1ca06d7e6a9993d1935e595b) C:\WINDOWS\system32\drivers\TfNetMon.sys
2011/09/07 21:53:32.0250 3776 TfSysMon (f14140979ecd43179cab1a4d31fe8ecd) C:\WINDOWS\system32\drivers\TfSysMon.sys
2011/09/07 21:53:32.0328 3776 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/09/07 21:53:32.0375 3776 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/09/07 21:53:32.0421 3776 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/09/07 21:53:32.0453 3776 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/09/07 21:53:32.0484 3776 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/09/07 21:53:32.0515 3776 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/09/07 21:53:32.0546 3776 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/09/07 21:53:32.0578 3776 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/09/07 21:53:32.0625 3776 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/09/07 21:53:32.0703 3776 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/09/07 21:53:32.0734 3776 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/09/07 21:53:32.0781 3776 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/09/07 21:53:32.0796 3776 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/09/07 21:53:32.0843 3776 yukonwxp (9278a9870d9e919b20ebc17299fbb107) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/09/07 21:53:32.0859 3776 MBR (0x1B8) (9c603bc3977968c891de319283e1e7af) \Device\Harddisk0\DR0
2011/09/07 21:53:32.0968 3776 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk1\DR1
2011/09/07 21:53:33.0062 3776 MBR (0x1B8) (9c603bc3977968c891de319283e1e7af) \Device\Harddisk2\DR2
2011/09/07 21:53:33.0093 3776 \Device\Harddisk2\DR2 - detected Trojan-Clicker.Win32.Wistler.c (0)
2011/09/07 21:53:33.0093 3776 MBR (0x1B8) (9c603bc3977968c891de319283e1e7af) \Device\Harddisk3\DR6
2011/09/07 21:53:33.0203 3776 Boot (0x1200) (8ec6057be73d6334cb5d46ac8e567317) \Device\Harddisk0\DR0\Partition0
2011/09/07 21:53:33.0218 3776 Boot (0x1200) (cf46b50f76b4f9d6f8ce6aab7559b23d) \Device\Harddisk1\DR1\Partition0
2011/09/07 21:53:33.0234 3776 Boot (0x1200) (03ce0e9e2ef6dd4409964fa2ef4141ae) \Device\Harddisk2\DR2\Partition0
2011/09/07 21:53:33.0250 3776 Boot (0x1200) (ac4ffe93b71f728450523626a6500cf9) \Device\Harddisk3\DR6\Partition0
2011/09/07 21:53:33.0265 3776 ================================================================================
2011/09/07 21:53:33.0265 3776 Scan finished
2011/09/07 21:53:33.0265 3776 ================================================================================
2011/09/07 21:53:33.0281 1368 Detected object count: 1
2011/09/07 21:53:33.0281 1368 Actual detected object count: 1
2011/09/07 21:53:51.0234 1368 \Device\Harddisk2\DR2 (Trojan-Clicker.Win32.Wistler.c) - will be cured after reboot
2011/09/07 21:53:51.0234 1368 \Device\Harddisk2\DR2 - ok
2011/09/07 21:53:51.0234 1368 Trojan-Clicker.Win32.Wistler.c(\Device\Harddisk2\DR2) - User select action: Cure
2011/09/07 21:53:58.0515 3424 Deinitialize success

stale tu mam tu hlasku

ja Vam za dnesek velice dekuji ale bohuzel rano vstava tak ten boj pro dnesek musim vzdat

TDSS ho ale smazal. ještě zkuste toto. Nabootujte z instal. média WinXP. Sleduijte dolní lištu a až se objeví "R-opravit", stiskněte "R". Přihlašte se k systému. Budete se pohybovat v příkazovém řádku. Zadejte postupně:

cd C:\ --> stiskněte ENTER

fixmbr --> stiskněte ENTER

exit --> stiskněte ENTER

Po posledním příkazu bude PC restartován. Příkaz obnoví MBR ze zálohy, která by měla být čistá.

OK. Já tu budu zase večer.

Tak bohuzel hlaska tam je stale zkousel sem i format disku ale po preinstalovani je tam zpet
Ted zkousim co udelaji sedmicky a zatim cekam na dokonceni kontroly ale zatim nic

Pouhý format byla chyba. Měl jste zrušit celou systémovou partition, pak ji znovu vytvořit a disk zformátovat.