VIRY.CZ

Prosím o konrolu logu, mám podezření na viry. Notebook se chová nestandartně, občas zamrzává a mění se mi datum o několik let zpětně.

Dále žádám o pomoc s přístupy na viry.cz. Od posledního přihlášení jsem změnila emailovou adresu na: holeckovaz@yahoo.com a zapoměla jsem své heslo. Nyní jsem se nalogovala tak, že po zadání svého přihlašovacího jména si můj prohlížeč doplnil heslo z posledního přihlášení. Obávám se, že se to příště nemusí podařit a vzhledem ke změně emailové adresy nemám možnost zaslat znovu heslo emailem.
Prosím o změnu emailu, popřípadě mě informujte jak postupovat dál.

Zde přikládám log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Moje cesky at 2011-12-18 15:50:52
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive F: has 6 GB (16%) free of 38 GB
Total RAM: 2037 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:51:17, on 18.12.2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
F:\Windows\system32\Dwm.exe
F:\Windows\Explorer.EXE
F:\Windows\system32\taskeng.exe
F:\Windows\System32\igfxtray.exe
F:\Windows\System32\hkcmd.exe
F:\Windows\System32\igfxpers.exe
F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
F:\Windows\system32\igfxsrvc.exe
F:\Program Files\ESET\ESET Smart Security\egui.exe
F:\Program Files\TrustPort Disk Protection\Bin\TDWatch.exe
F:\Program Files\Common Files\TrustPort\bin\tptray.exe
F:\Windows\WindowsMobile\wmdc.exe
F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
F:\Program Files\HP\HP Software Update\hpwuSchd2.exe
F:\Program Files\Windows Sidebar\sidebar.exe
F:\Windows\ehome\ehtray.exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\Program Files\Windows Media Player\wmpnscfg.exe
F:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
F:\Windows\ehome\ehmsas.exe
F:\Windows\system32\wbem\unsecapp.exe
F:\Program Files\Skype\Plugin Manager\skypePM.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
F:\Users\Moje cesky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WAZ5JR3R\RSIT[1].exe
F:\Program Files\trend micro\Moje cesky.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - F:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: MyAshampoo - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O3 - Toolbar: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] F:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] F:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] F:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [GrooveMonitor] "F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrustPortDiskProtectionWatchDog] F:\Program Files\TrustPort Disk Protection\bin\TDWatch.exe
O4 - HKLM\..\Run: [TrustPortTray] "F:\Program Files\Common Files\TrustPort\Bin\tptray.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Sidebar] F:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] F:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @F:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @F:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\Windows\system32\browseui.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - F:\Windows\System32\DreamScene.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - F:\Program Files\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - F:\Program Files\Firebird\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - F:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

--
End of file - 7321 bytes

======Scheduled tasks folder======

F:\Windows\tasks\CHYZTBSHU.job
F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
F:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT24750 ... hSource=13"
prefs.js - "extensions.enabledItems" - "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3, {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198, {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:2.5.6.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.20"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=F:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=F:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=F:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=F:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=0.9.4]
"Description"=VLC Multimedia Plugin
"Path"=F:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1]
"Description"=Yahoo! activeX Plug-in Bridge
"Path"=F:\Program Files\Yahoo!\Common\npyaxmpb.dll

F:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

F:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

F:\Program Files\Mozilla Firefox\plugins\
npnul32.dll
NPOFF12.DLL
nppdf32.dll

F:\Program Files\Mozilla Firefox\searchplugins\
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\
{707db484-2428-402d-afb5-d85b387544c7}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - F:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
MyAshampoo Toolbar - F:\Program Files\MyAshampoo\prxtbMyA0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-30 342192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - F:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll [2011-11-11 1003576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - MyAshampoo Toolbar - F:\Program Files\MyAshampoo\prxtbMyA0.dll [2011-01-17 175912]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-30 342192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=F:\Windows\system32\igfxtray.exe [2008-02-11 141848]
"HotKeysCmds"=F:\Windows\system32\hkcmd.exe [2008-02-11 166424]
"Persistence"=F:\Windows\system32\igfxpers.exe [2008-02-11 133656]
"GrooveMonitor"=F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"egui"=F:\Program Files\ESET\ESET Smart Security\egui.exe [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"=F:\Program Files\TrustPort Disk Protection\bin\TDWatch.exe [2009-06-12 155480]
"TrustPortTray"=F:\Program Files\Common Files\TrustPort\Bin\tptray.exe [2009-06-12 835416]
"Windows Mobile Device Center"=F:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"Adobe Reader Speed Launcher"=F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"HP Software Update"=F:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-10-14 49152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=F:\Program Files\Windows Sidebar\sidebar.exe [2008-01-18 1233920]
"ehTray.exe"=F:\Windows\ehome\ehTray.exe [2008-01-18 125952]
"Skype"=F:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]
"swg"=F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-06-30 39408]
"WMPNSCFG"=F:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-18 202240]

F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - F:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
F:\Windows\system32\igfxdev.dll [2008-02-11 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - F:\Windows\System32\DreamScene.dll [2008-12-13 233888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"F:\Users\Moje cesky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7NU22VQU\IMAGE464-facebook.com.JPG.jpg[2].exe"="F:\Windows\infocard.exe:*:Enabled:Firewall Admin"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=F:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2023-06-27 02:16:04 ----D---- F:\ProgramData\WindowsSearch

======List of files/folders modified in the last 1 month======

2011-12-18 15:51:03 ----D---- F:\Windows\Prefetch
2011-12-18 15:50:53 ----D---- F:\Program Files\trend micro
2011-12-18 15:50:40 ----D---- F:\Windows\temp
2011-12-18 15:49:10 ----D---- F:\Users\Moje cesky\AppData\Roaming\Skype
2011-12-18 15:10:31 ----D---- F:\Users\Moje cesky\AppData\Roaming\skypePM
2011-12-08 12:23:50 ----SHD---- F:\Windows\Installer
2011-12-08 12:11:42 ----D---- F:\Program Files\Google

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fvevol;BitLocker Drive Encryption Filter Driver; F:\Windows\System32\DRIVERS\fvevol.sys [2008-01-18 145464]
R0 MEMLOCK;Secured Memory Driver; F:\Windows\system32\drivers\memlock.sys [2009-06-12 14136]
R1 ehdrv;ehdrv; F:\Windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R2 eamon;eamon; F:\Windows\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 EncDisk;EncDisk; \??\F:\Program Files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
R2 epfw;epfw; F:\Windows\system32\DRIVERS\epfw.sys [2009-05-14 133000]
R2 epfwwfp;epfwwfp; F:\Windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
R2 rismxdp;Ricoh xD-Picture Card Driver; F:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R3 BthEnum;Služba Bluetooth Enumerator; F:\Windows\system32\DRIVERS\BthEnum.sys [2008-12-13 19456]
R3 BthPan;Zařízení Bluetooth (síť PAN); F:\Windows\system32\DRIVERS\bthpan.sys [2008-01-18 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; F:\Windows\System32\Drivers\BTHUSB.sys [2008-12-13 29184]
R3 E100B;Intel(R) PRO Adapter Driver; F:\Windows\system32\DRIVERS\e100b325.sys [2008-01-18 159744]
R3 Epfwndis;Eset Personal Firewall; F:\Windows\system32\DRIVERS\Epfwndis.sys [2009-05-14 33096]
R3 HBtnKey;HBtnKey; F:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; F:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 HSF_DPV;HSF_DPV; F:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; F:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 igfx;igfx; F:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
R3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; F:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); F:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-18 49664]
R3 rimmptsk;rimmptsk; F:\Windows\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; F:\Windows\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]
R3 sdbus;sdbus; F:\Windows\system32\DRIVERS\sdbus.sys [2008-01-18 88576]
R3 usbvideo;Zobrazovací zařízení USB (WDM); F:\Windows\System32\Drivers\usbvideo.sys [2008-01-18 134016]
R3 winachsf;winachsf; F:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 BTHPORT;Ovladač portu Bluetooth; F:\Windows\System32\Drivers\BTHport.sys [2008-12-13 220160]
S3 Dot4;Ovladač MS IEEE-1284.4; F:\Windows\system32\DRIVERS\Dot4.sys [2008-01-18 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; F:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-18 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; F:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-18 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; F:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 ialm;ialm; F:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; F:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; F:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; F:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; F:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; F:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 usb_rndisx;Adaptér USB RNDIS; F:\Windows\system32\DRIVERS\usb8023x.sys [2008-01-18 15872]
S3 usbscan;Ovladač skeneru USB; F:\Windows\system32\DRIVERS\usbscan.sys [2008-01-18 35328]
S3 WpdUsb;WpdUsb; F:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936]
S3 WUDFRd;WUDFRd; F:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 ekrn;ESET Service; F:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; F:\Program Files\Firebird\bin\fbguard.exe [2007-12-12 65536]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; F:\Program Files\Firebird\bin\fbserver.exe [2007-12-12 1531989]
S2 gupdate;Služba Google Update (gupdate); F:\Program Files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
S2 Net Driver HPZ12;Net Driver HPZ12; F:\Windows\System32\svchost.exe [2008-01-18 21504]
S2 Pml Driver HPZ12;Pml Driver HPZ12; F:\Windows\System32\svchost.exe [2008-01-18 21504]
S3 EhttpSrv;ESET HTTP Server; F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-05-14 20680]
S3 gupdatem;Služba Google Update (gupdatem); F:\Program Files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
S3 gusvc;Google Software Updater; F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-02-01 182768]
S3 hpqcxs08;hpqcxs08; F:\Windows\system32\svchost.exe [2008-01-18 21504]
S3 McComponentHostService;McAfee Security Scan Component Host Service; F:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; F:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; F:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; F:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Zdravim a pekny den preji

Poslete mi do soukrome zpravy (nebo na email vyosek@forum.viry.cz) jaky email a heslo chcete tam a ja se o to postaram

Poprosim jeste i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

posílám požadovaný log: zbytek pošlu na Váš mail


info.txt logfile of random's system information tool 1.06 2010-06-30 22:50:13

======Uninstall list======

-->"F:\Program Files\TrustPort Disk Protection\unins000.exe"
Abakus-->MsiExec.exe /X{7515B06B-F8F1-4A5B-81C7-BAB02EEA9A81}
Adobe Flash Player 10 ActiveX-->F:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->F:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A91000000001}
Aktualizace ovladače pro aplikaci Centrum zařízení Windows Mobile-->MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E}
Ashampoo Burning Studio 7.10-->"F:\Program Files\Ashampoo\Ashampoo Burning Studio 7\unins000.exe"
Bullzip PDF Printer 6.0.0.865-->"F:\Program Files\Bullzip\PDF Printer\unins000.exe"
CCleaner (remove only)-->"F:\Program Files\CCleaner\uninst.exe"
Centrum zařízení Windows Mobile-->MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
Codec Pack - All In 1 6.0.3.0-->F:\Windows\iun6002.exe "F:\Program Files\Codec Pack - All In 1\irunin.ini"
Firebird 1.5.5-->"F:\Program Files\Firebird\unins000.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->"F:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_6447DDAF760F41DD.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
GPL Ghostscript Lite 8.64-->"F:\Program Files\Bullzip\PDF Printer\gs\unins000.exe"
HijackThis 2.0.2-->"F:\Program Files\trend micro\HijackThis.exe" /uninstall
Install_Simulace_2009_min-->MsiExec.exe /I{D43CDC11-B6DC-4339-8EB7-6C20C2BAB336}
Intel(R) Graphics Media Accelerator Driver-->F:\Windows\system32\igxpun.exe -uninstall
Microsoft .NET Framework 3.5-->F:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Office Access MUI (Czech) 2007-->MsiExec.exe /X{90120000-0015-0405-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"F:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Czech) 2007-->MsiExec.exe /X{90120000-0016-0405-0000-0000000FF1CE}
Microsoft Office Groove MUI (Czech) 2007-->MsiExec.exe /X{90120000-00BA-0405-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Czech) 2007-->MsiExec.exe /X{90120000-0044-0405-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Czech) 2007-->MsiExec.exe /X{90120000-00A1-0405-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Czech) 2007-->MsiExec.exe /X{90120000-001A-0405-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Czech) 2007-->MsiExec.exe /X{90120000-0018-0405-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Czech) 2007-->MsiExec.exe /X{90120000-002C-0405-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Czech) 2007-->MsiExec.exe /X{90120000-0019-0405-0000-0000000FF1CE}
Microsoft Office Shared MUI (Czech) 2007-->MsiExec.exe /X{90120000-006E-0405-0000-0000000FF1CE}
Microsoft Office Word MUI (Czech) 2007-->MsiExec.exe /X{90120000-001B-0405-0000-0000000FF1CE}
Microsoft SQL Server Compact 3.5 ENU-->MsiExec.exe /I{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}
Mozilla Firefox (3.0.19)-->F:\Program Files\Mozilla Firefox\uninstall\helper.exe
OpenOffice.org 2.3-->MsiExec.exe /I{39CDC80C-4330-4556-990D-1975211E2370}
Poradce - AWD, verze 1.25/1-->C:\GEN\uninst.exe
Simulace_2009-->MsiExec.exe /I{7B6FC9C2-C5B4-4F58-8E50-1587236285D0}
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
TrustPort PC Security (Pouze odebrat)-->F:\Program Files\Common Files\TrustPort\bin\uninst.exe
Ultimate Extras sounds from Microsoft® Tinker™-->RunDll32 advpack.dll,LaunchINFSection F:\Windows\INF\UltSound2.inf,Uninstall
Update for Office 2007 (KB934391)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
Update for Office 2007 (KB934393)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
VLC media player 0.9.4-->F:\Program Files\VideoLAN\VLC\uninstall.exe
WebEx-->F:\PROGRA~2\WebEx\atcliun.exe
WinRAR-->F:\Program Files\WinRAR\uninstall.exe
Zvuková schémata systému Windows-->RunDll32 advpack.dll,LaunchINFSection F:\Windows\INF\UltSound.inf,Uninstall

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Mojecesky-PC
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.00. 6001 Service Pack 1 Multiprocessor Free.
Record Number: 42768
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 6005
Message: Služba Event Log byla spuštěna.
Record Number: 42769
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 6013
Message: Doba provozu systému je 27 sekund.
Record Number: 42770
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 4
Message: Adaptér Intel(R) PRO/100 VE Network Connection: Nefunkční spojení adaptéru
Record Number: 42771
Source Name: E100B
Time Written: 20091221133257.234126-000
Event Type: Upozornění
User:

Computer Name: Mojecesky-PC
Event Code: 18
Message: Systém Windows nemůže uložit ověřovací kódy Bluetooth (klíče linky) u místního adaptéru. Klávesnice Bluetooth nemusí být funkční v systému BIOS během spuštění.
Record Number: 42772
Source Name: BTHUSB
Time Written: 20091221133259.636541-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: Mojecesky-PC
Event Code: 1
Message: Klient Certifikační služby byl úspěšně spuštěn.
Record Number: 6569
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20100630202846.547234-000
Event Type: Informace
User: Mojecesky-PC\Moje cesky

Computer Name: Mojecesky-PC
Event Code: 1
Message: Klient Certifikační služby byl úspěšně spuštěn.
Record Number: 6570
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20100630202855.548434-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: Mojecesky-PC
Event Code: 1
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.
Record Number: 6571
Source Name: SecurityCenter
Time Written: 20100630203017.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 1001
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně odstraněny. Data záznamu obsahují nové hodnoty položek Last Counter a Last Help systémového registru.
Record Number: 6572
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100630203307.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 1000
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně načteny. Data záznamu v datové části obsahují nové indexové hodnoty přiřazené této službě.
Record Number: 6573
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100630203308.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16536
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.178434-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16537
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.194034-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16538
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.225234-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16539
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.256434-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16540
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.272034-000
Event Type: Selhání auditu
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------

Ok, pozadavek na zmenu jsem zadal nasemu administratorovi, prepokladam ze jak se prihlasi na forum, tak zmenu provede. A my pokracujem v leceni

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

i kdyz jsem vypnul antivir a ostatni ochrany, presto mi CF hlasil ze jsou zaple a ze bude pokracovat na me nasledky dal v cinnosti. po dokonceni operace jsem se jiz nedostal na net zádným prohlizecem, vsechny mi hlasi Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni. totez hlasi i kdyz poklepam na ikonu cCleaneru. Asi CF smazal cestu k temto ikonam. prohlizec jsem nakonec otevrel pomoci ulozeneho odkazu na noviny iDNES.cz kde jsem prepsal webovou adresu na toto forum

ComboFix 11-12-19.01 - Moje cesky 19.12.2011 19:08:27.2.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.420.1029.18.2037.1000 [GMT 1:00]
Spuštěný z: f:\users\Moje cesky\Desktop\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Enabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\program files\FunWebProducts
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-19 do 2011-12-19 )))))))))))))))))))))))))))))))
.
.
2023-06-27 01:16 . 2023-06-27 01:16 -------- d-----w- f:\programdata\WindowsSearch
2011-12-19 18:16 . 2011-12-19 18:16 -------- d-----w- f:\users\Public\AppData\Local\temp
2011-12-19 18:16 . 2011-12-19 18:16 -------- d-----w- f:\users\Default\AppData\Local\temp
2011-12-08 11:10 . 2011-12-08 11:23 414368 ----a-w- f:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- f:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
2011-01-17 14:54 175912 ----a-w- f:\program files\MyAshampoo\prxtbMyA0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="f:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="f:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"Skype"="f:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"swg"="f:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-30 39408]
"WMPNSCFG"="f:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="f:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="f:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="f:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"GrooveMonitor"="f:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"egui"="f:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"="f:\program files\TrustPort Disk Protection\bin\TDWatch.exe" [2009-06-12 155480]
"TrustPortTray"="f:\program files\Common Files\TrustPort\Bin\tptray.exe" [2009-06-12 835416]
"Windows Mobile Device Center"="f:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe Reader Speed Launcher"="f:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="f:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"HP Software Update"="f:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
.
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - f:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-237069233-1738439373-3822406637-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Služba Google Update (gupdate);f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
R3 gupdatem;Služba Google Update (gupdatem);f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;f:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S0 MEMLOCK;Secured Memory Driver;f:\windows\system32\drivers\memlock.sys [2009-06-12 14136]
S1 ehdrv;ehdrv;f:\windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
S2 ekrn;ESET Service;f:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
S2 EncDisk;EncDisk;f:\program files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
S2 epfwwfp;epfwwfp;f:\windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;f:\program files\Firebird\bin\fbguard.exe [2007-12-11 65536]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;f:\program files\Firebird\bin\fbserver.exe [2007-12-11 1531989]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 16:23 38400 ----a-w- f:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 09:50 30720 ----a-w- f:\windows\System32\soundschemes2.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2006-02-09 f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 09:05]
.
2011-12-19 f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 09:05]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - f:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - MyAshampoo Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - f:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-19 19:16
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2011-12-19 19:20:27
ComboFix-quarantined-files.txt 2011-12-19 18:20
.
Před spuštěním: 6 284 771 328
Po spuštění: 6 243 135 488
.
- - End Of File - - D78AC19B8EEDE6450180E8B5D27CDA41

Restartujte PC a napiste ci restart pomohl, ale mel by

Ano, pomohlo to, ikony jsou uz funkcni. Po restartu se kupodivu aktivovaly samy bezpecnostni ochrany antiviru aniz bych je musel rucne nastavovat.

co mam delat dal?

Super ze pomohlo, tak jeste docistime

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  File::
  f:\program files\MyAshampoo\prxtbMyA0.dll
  f:\program files\ConduitEngine\prxConduitEngine.dll
  f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Skype"=-
  "swg"=-
  "WMPNSCFG"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "HP Software Update"=-
  
  Driver::
  gupdate
  gupdatem
  
  Firefox::
  FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
  FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
  FF - prefs.js: browser.search.selectedEngine - MyAshampoo Customized Web Search
  FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT24750 ... hSource=13
  FF - Ext: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

opet se mi i po vypnuti bezpectnostnich ochran baliku Smart security ESET ozval CF, ze nejsou vypnuty a ze bude pokracovat dal na me nebezpeci.

ComboFix 11-12-19.03 - Moje cesky 20.12.2011 7:51.3.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.420.1029.18.2037.1185 [GMT 1:00]
Spuštěný z: f:\users\Moje cesky\Desktop\ComboFix.exe
Použité ovládací přepínače :: f:\users\Moje cesky\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Enabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"f:\program files\ConduitEngine\prxConduitEngine.dll"
"f:\program files\MyAshampoo\prxtbMyA0.dll"
"f:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"f:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\program files\ConduitEngine\prxConduitEngine.dll
f:\program files\MyAshampoo\prxtbMyA0.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitAutoCompleteSearch.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitAutoCompleteSearch.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.idl
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults\default_radio_skin.xml
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults\fbAlert.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome.manifest
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome\myashampoo.jar
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\install.rdf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\lib\xpcom.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\manifest.mf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\zigbert.rsa
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\zigbert.sf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.gif
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.ico
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.PNG
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.src
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.xml
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\setup.ini
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\version.txt
f:\windows\iun6002.exe
f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-20 do 2011-12-20 )))))))))))))))))))))))))))))))
.
.
2023-06-27 01:16 . 2023-06-27 01:16 -------- d-----w- f:\programdata\WindowsSearch
2011-12-20 06:57 . 2011-12-20 07:00 -------- d-----w- f:\users\Moje cesky\AppData\Local\temp
2011-12-08 11:10 . 2011-12-08 11:23 414368 ----a-w- f:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="f:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="f:\windows\ehome\ehTray.exe" [2008-01-18 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="f:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="f:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="f:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"GrooveMonitor"="f:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"egui"="f:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"="f:\program files\TrustPort Disk Protection\bin\TDWatch.exe" [2009-06-12 155480]
"TrustPortTray"="f:\program files\Common Files\TrustPort\Bin\tptray.exe" [2009-06-12 835416]
"Windows Mobile Device Center"="f:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
.
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - f:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-237069233-1738439373-3822406637-1000]
"EnableNotificationsRef"=dword:00000001
.
R3 McComponentHostService;McAfee Security Scan Component Host Service;f:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S0 MEMLOCK;Secured Memory Driver;f:\windows\system32\drivers\memlock.sys [2009-06-12 14136]
S1 ehdrv;ehdrv;f:\windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
S2 ekrn;ESET Service;f:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
S2 EncDisk;EncDisk;f:\program files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
S2 epfwwfp;epfwwfp;f:\windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;f:\program files\Firebird\bin\fbguard.exe [2007-12-11 65536]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;f:\program files\Firebird\bin\fbserver.exe [2007-12-11 1531989]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 16:23 38400 ----a-w- f:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 09:50 30720 ----a-w- f:\windows\System32\soundschemes2.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - f:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - f:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Cool's_Codec_pack_4.12 - f:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-20 08:01
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
f:\program files\Google\Update\GoogleUpdate.exe
f:\windows\system32\conime.exe
f:\windows\system32\igfxsrvc.exe
f:\windows\ehome\ehmsas.exe
f:\windows\system32\wbem\unsecapp.exe
f:\\?\f:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2011-12-20 08:06:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-20 07:06
ComboFix2.txt 2011-12-19 18:20
.
Před spuštěním: 6 258 376 704
Po spuštění: 6 085 566 464
.
- - End Of File - - 5FC9A744FEEEE0E7B1EC4CBAD40661C6

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ehTray.exe"=-
  
  :files
  f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

behem dne notebook stale zamrzal


All processes killed
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ehTray.exe deleted successfully.
========== FILES ==========
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk moved successfully.
File/Folder F:\Windows\system32\*.tmp.dll not found.
File/Folder F:\Windows\system32\SET*.tmp not found.
File/Folder F:\Windows\*.tmp not found.
========== COMMANDS ==========
F:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Moje cesky
->Temp folder emptied: 60532 bytes
->Temporary Internet Files folder emptied: 12658633 bytes
->FireFox cache emptied: 42428036 bytes
->Google Chrome cache emptied: 34123417 bytes
->Flash cache emptied: 1013 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 296612 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 85,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Moje cesky
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 12202011_232855

Otestujte HD pomoci HD Tune http://www.stahuj.centrum.cz/utility_a_ ... g/hd-tune/

• Udelejte testy Benchmark a Error Scan - dejte screeny
• Dejte screen ze zalozky Health
• Scree udelate kdyz klilknete na tu modrou disketku a pak jej sem dejte dle tohoto navdou http://www.viry.cz/forum/viewtopic.php?f=15&t=14114 - zajima Vas jen cast "zaslani na forum" samozrejme

Zdravím, byl jsem teď nějakou dobu mimo počítač, můžeme prosím pokračovat?

zde posílám odkaz: http://imageshack.us/g/832/hdtunebenchmarkwdcwd120.png/

No vypada to, ze disk nam sel do kyticek, jeste na to mrknem

motji píše: stáhněte
http://www.slunecnice.cz/sw/crystaldiskinfo/
- spusťte ho a v nabídce zvolte Kopírovat.
-Data ze schránky sem pak vložte pomocí Ctrl+V

----------------------------------------------------------------------------
CrystalDiskInfo 4.1.3 (C) 2008-2011 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows Vista Ultimate Edition SP1 [6.0 Build 6001] (x86)
Date : 2012/01/08 12:58:00

-- Controller Map ----------------------------------------------------------
- Ricoh MMC Host Controller [ATA]
- Ricoh Memory Stick Host Controller [ATA]
- Ricoh xD-Picture Card Controller [ATA]
+ Řadiče úložiště Intel(R) 82801G (řada ICH7) v režimu Ultra ATA - 27DF [ATA]
+ Kanál IDE (0)
- Slimtype DVD A DS8AZH ATA Device
+ Standardní řadič AHCI 1.0 s rozhraním Serial ATA [ATA]
+ Kanál IDE (0)
- WDC WD1200BEVS-60LAT0 ATA Device
- Kanál IDE (2)
- Iniciátor iSCSI společnosti Microsoft [SCSI]

-- Disk List ---------------------------------------------------------------
(1) WDC WD1200BEVS-60LAT0 : 120.0 GB [0-1-0, pd1]

----------------------------------------------------------------------------
(1) WDC WD1200BEVS-60LAT0
----------------------------------------------------------------------------
Model : WDC WD1200BEVS-60LAT0
Firmware : 01.06M01
Serial Number : WD-WXE406684421
Disk Size : 120.0 GB (8.4/120.0/120.0)
Buffer Size : 8192 KB
Queue Depth : 1
# of Sectors : 234441648
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA/ATAPI-7
Minor Version : ----
Transfer Mode : SATA/150
Power On Hours : 10354 hod.
Power On Count : 4278 krát
Temparature : 44 C (111 F)
Health Status : Pozor
Features : S.M.A.R.T., APM, 48bit LBA
APM Level : 0080h [ON]
AAM Level : ----

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 198 194 _51 000000003294 Počet chyb čtení
03 192 184 _21 000000000556 Čas na roztočení ploten
04 _95 _95 __0 0000000013C6 Počet spuštění/zastavení
05 169 169 140 0000000000F2 Počet přemapovaných sektorů
07 100 253 _51 000000000000 Počet chybných hledání
09 _86 _86 __0 000000002872 Hodin v činnosti
0A 100 100 _51 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 _51 000000000000 Počet pokusů o překalibrování
0C _96 _96 __0 0000000010B6 Počet cyklů zapnutí zařízení
C0 195 195 __0 000000001088 Počet vypnutí disku
C1 110 110 __0 000000041FB1 Počet cyklů načítání/vymazání
C2 103 _61 __0 00000000002C Teplota
C4 165 165 __0 000000000023 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000001 Počet podezřelých sektorů
C6 100 253 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 100 253 _51 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 42 7A 3F FF C8 37 00 10 00 00 00 00 00 3F 00 00
010: 00 00 00 00 20 20 20 20 20 57 44 2D 57 58 45 34
020: 30 36 36 38 34 34 32 31 00 00 40 00 00 32 30 31
030: 2E 30 36 4D 30 31 57 44 43 20 57 44 31 32 30 30
040: 42 45 56 53 2D 36 30 4C 41 54 30 20 20 20 20 20
050: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 80 10
060: 00 00 2F 00 40 01 00 00 00 00 00 07 3F FF 00 10
070: 00 3F FC 10 00 FB 01 10 4B B0 0D F9 00 00 00 07
080: 00 03 00 78 00 78 00 78 00 78 00 00 00 00 00 00
090: 00 00 00 00 00 00 00 00 04 02 00 00 00 48 00 40
0A0: 00 FE 00 00 70 69 7C 09 60 23 70 69 3C 09 60 23
0B0: 20 3F 00 00 00 00 00 80 FF FE 00 00 00 00 00 00
0C0: 00 00 00 00 00 00 00 00 4B B0 0D F9 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 16 73 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 10 3F 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E1 A5