VIRY.CZ

Laguje se mi internet a celý počítač (přesněji řečeno prohlížení internetu - používám firefox, zkoušel jsem chrome - nepomohlo) přes wifi mám ntb a na tom vše jede krásně podívejte se prosím do logu, děkuju

Logfile of random's system information tool 1.09 (written by random/random)
Run by Main at 2012-02-20 13:06:24
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 1 GB (6%) free of 17 GB
Total RAM: 2047 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:09:36, on 20.2.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Main\Plocha\RSIT.exe
C:\Program Files\trend micro\Main.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=100888&tt ... 19dbc5fe67
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/pivotstickfig ... 4037425574}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss ... ffID=19404
O1 - Hosts: ::1 localhost
O2 - BHO: Complitly - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Documents and Settings\Main\Data aplikací\Complitly\Complitly.dll
O2 - BHO: ERBHOMasterObject Class - {5A15CA85-DAB9-456c-95ED-06C6E3885C2A} - C:\Program Files\ExitReality\Webspace\System\ExitRealityHelper.dll (file missing)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ESET NOD32 Antivirus.lnk = C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
O8 - Extra context menu item: Visit in &3D using ExitReality - http://3d.exitreality.com/TransmogrifyPage.htm
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 3478 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1078145449-839522115-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1078145449-839522115-1004UA.job
C:\WINDOWS\tasks\Norton Security Scan for Main.job
C:\WINDOWS\tasks\RMSchedule.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://search.babylon.com/?babsrc=HP_Prot"
prefs.js - "extensions.enabledItems" - "{AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778, testpilot@labs.mozilla.com:1.0.3, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13"
prefs.js - "keyword.URL" - "http://search.babylon.com/?AF=100888&tt ... bc5fe67&q="

"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
"{6904342A-8307-11DF-A508-4AE2DFD72085}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"support@exitreality.com"=C:\Program Files\ExitReality\WebSpace\System\Mozilla\Extension


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@exitreality.com/ExitReality3DPlayer,version=0.8.36.86]
"Description"=ExitReality Online
"Path"=C:\Program Files\ExitReality\WebSpace\System\Mozilla\nperonline.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2088]
"Description"=RealMedia Plugin
"Path"=D:\Program Files\K-Lite Codec Pack\real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1069]
"Description"=6.0.12.1069
"Path"=D:\Program Files\K-Lite Codec Pack\real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

D:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

D:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIEROnlinePlugin.xpt

D:\Program Files\Mozilla Firefox\plugins\
npPDFXCviewNPPlugin.dll

D:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default\extensions\
ffxtlbr@babylon.com
{33e0daa6-3af3-d8b5-6752-10e949c61516}

C:\Documents and Settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default\searchplugins\
askcom.xml
search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]
Complitly - C:\Documents and Settings\Main\Data aplikací\Complitly\Complitly.dll [2011-09-21 139768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5A15CA85-DAB9-456c-95ED-06C6E3885C2A}]
ERBHOMasterObject Class - C:\Program Files\ExitReality\Webspace\System\ExitRealityHelper.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-08-09 3076144]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-08-03 13892200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
D:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-05 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Main\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2012-02-19 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2012-02-07 1987976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2011-08-03 13892200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
C:\Program Files\Anti-Vibrate Oscar Editor\OscarEditor.exe Minimum []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\Program Files\Steam\Steam.exe -silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2012-02-18 740216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^GamePark klient 2.lnk]
D:\PROGRA~1\GAMEPA~1\gpcl.exe [2011-07-29 409088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
C:\PROGRA~1\MCAFEE~1\20DEB9~1.181\SSSCHE~1.EXE [2010-01-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Main^Nabídka Start^Programy^Po spuštění^Registration .LNK]
D:\PROGRA~1\Ubisoft\PETERJ~1\REGIST~1.EXE [2005-02-28 868352]

C:\Documents and Settings\Main\Nabídka Start\Programy\Po spuštění
ESET NOD32 Antivirus.lnk - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-10-29 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ObdikkEqwacy.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Program Files\totalcmd\TOTALCMD.EXE"="D:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Google\Google Earth\client\googleearth.exe"="C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"
"D:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe"="D:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe:*:Enabled:Media Player Classic"
"C:\WINDOWS\nc.exe"="C:\WINDOWS\nc.exe:*:Enabled:nc"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Steam\steamapps\amvvay\team fortress 2\hl2.exe"="D:\Program Files\Steam\steamapps\amvvay\team fortress 2\hl2.exe:*:Enabled:hl2"
"D:\Program Files\Steam\steamapps\amvvay\counter-strike\hl.exe"="D:\Program Files\Steam\steamapps\amvvay\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"D:\Program Files\Valve\hl.exe"="D:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"E:\EasySetupAssistant\EasySetupAssistant.exe"="E:\EasySetupAssistant\EasySetupAssistant.exe:*:Enabled:TP-LINK Easy Setup Assistant"
"D:\Teraria\TerrariaServer.exe"="D:\Teraria\TerrariaServer.exe:*:Enabled:Terraria"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\Documents and Settings\Main\Local Settings\temp\DSOClient\app.n3app"="C:\Documents and Settings\Main\Local Settings\temp\DSOClient\app.n3app:*:Enabled:app"
"D:\hry\Counter-Strike 1.6\hl.exe"="D:\hry\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Program Files\Funcom\Age of Conan\ConanPatcher.exe"="D:\Program Files\Funcom\Age of Conan\ConanPatcher.exe:*:Enabled:Age of Conan Update Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="D:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"D:\Program Files\Steam\Steam.exe"="D:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"D:\Program Files\Unreal Tournament 2004\System\UT2004.exe"="D:\Program Files\Unreal Tournament 2004\System\UT2004.exe:*:Enabled:UT2004"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\WINDOWS\system32\msiexec.exe"="C:\WINDOWS\system32\msiexec.exe:*:Enabled:Windows® installer"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Průzkumník Windows"
"D:\Program Files\Mozilla Firefox\firefox.exe"="D:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Documents and Settings\Main\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe"="C:\Documents and Settings\Main\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe:*:Enabled:Instalační program Google"
"C:\Documents and Settings\Main\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Main\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\PC Tools Registry Mechanic\Update.exe"="C:\Program Files\PC Tools Registry Mechanic\Update.exe:*:Enabled:PC Tools Smart Update"
"D:\Program Files\Mozilla Firefox\plugin-container.exe"="D:\Program Files\Mozilla Firefox\plugin-container.exe:*:Enabled:Plugin Container for Firefox"
"C:\Documents and Settings\Main\Plocha\RSIT.exe"="C:\Documents and Settings\Main\Plocha\RSIT.exe:*:Enabled:RSIT"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"vidc.XVID"=xvidvfw.dll
"msacm.lameacm"=lameACM.acm
"vidc.3iv2"=3ivxVfWCodec.dll
"VIDC.HFYU"=huffyuv.dll
"VIDC.wmv3"=wmv9vcm.dll
"VIDC.VP60"=vp6vfw.dll
"VIDC.VP61"=vp6vfw.dll
"VIDC.VP62"=vp6vfw.dll
"VIDC.VP31"=vp31vfw.dll
"vidc.MPG4"=mpg4c32.dll
"vidc.MP42"=mpg4c32.dll
"vidc.MP43"=mpg4c32.dll
"msacm.ac3acm"=AC3ACM.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.FPS1"=frapsvid.dll
"msacm.voxacm160"=vct3216.acm
"msacm.scg726"=scg726.acm
"msacm.alf2cd"=alf2cd.acm
"vidc.dvsd"=mcdvd_32.dll

======File associations======

.txt - open - notepad.exe %1

======List of files/folders created in the last 1 month======

2012-02-19 19:27:15 ----D---- C:\WINDOWS\pss
2012-02-19 17:32:16 ----D---- C:\Program Files\ESET
2012-02-19 17:32:16 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2012-02-19 17:22:06 ----ASH---- C:\WINDOWS\system32\dds_log_trash.cmd
2012-02-18 20:18:53 ----D---- C:\Documents and Settings\Main\Data aplikací\ESET
2012-02-18 19:57:38 ----D---- C:\Program Files\uTorrent
2012-02-15 10:32:27 ----D---- C:\Program Files\AVAST Software
2012-02-15 10:32:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-02-15 08:46:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2660465$
2012-02-15 08:43:20 ----HDC---- C:\WINDOWS\$NtUninstallKB2661637$
2012-02-15 07:11:43 ----N---- C:\WINDOWS\system32\iacenc.dll
2012-02-09 07:20:30 ----A---- C:\WINDOWS\system32\muweb.dll
2012-02-09 07:20:30 ----A---- C:\WINDOWS\system32\mucltui.dll
2012-02-08 09:27:17 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2012-01-25 23:41:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2585542$

======List of files/folders modified in the last 1 month======

2012-02-20 13:06:45 ----D---- C:\WINDOWS\Prefetch
2012-02-20 13:06:35 ----D---- C:\Program Files\trend micro
2012-02-20 12:24:32 ----D---- C:\WINDOWS\temp
2012-02-20 11:27:30 ----D---- C:\WINDOWS\system32
2012-02-20 11:27:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-02-20 11:23:09 ----D---- C:\WINDOWS\system32\drivers
2012-02-20 10:24:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-02-19 19:28:39 ----D---- C:\Documents and Settings\Main\Data aplikací\uTorrent
2012-02-19 19:28:36 ----RASH---- C:\boot.ini
2012-02-19 19:28:36 ----A---- C:\WINDOWS\win.ini
2012-02-19 19:28:36 ----A---- C:\WINDOWS\system.ini
2012-02-19 19:27:15 ----D---- C:\WINDOWS
2012-02-19 19:19:26 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2012-02-19 17:39:25 ----SD---- C:\WINDOWS\Tasks
2012-02-19 17:32:58 ----D---- C:\Config.Msi
2012-02-19 17:32:57 ----SHD---- C:\WINDOWS\Installer
2012-02-19 17:32:46 ----HD---- C:\WINDOWS\inf
2012-02-19 17:32:43 ----D---- C:\WINDOWS\system32\CatRoot2
2012-02-19 17:32:16 ----RD---- C:\Program Files
2012-02-19 17:01:30 ----D---- C:\Documents and Settings\Main\Data aplikací\Skype
2012-02-19 16:12:20 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2012-02-18 20:14:29 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-02-17 15:13:20 ----HD---- C:\Program Files\InstallShield Installation Information
2012-02-16 09:44:38 ----D---- C:\WINDOWS\Minidump
2012-02-15 21:50:28 ----D---- C:\WINDOWS\Debug
2012-02-15 10:32:47 ----D---- C:\WINDOWS\WinSxS
2012-02-15 09:30:38 ----RSD---- C:\WINDOWS\assembly
2012-02-15 09:30:38 ----D---- C:\WINDOWS\Microsoft.NET
2012-02-15 08:46:19 ----A---- C:\WINDOWS\system32\MRT.exe
2012-02-15 08:46:14 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-02-15 08:46:05 ----D---- C:\Program Files\Internet Explorer
2012-02-15 08:45:50 ----HD---- C:\WINDOWS\$hf_mig$
2012-02-14 22:13:30 ----D---- C:\Documents and Settings\Main\Data aplikací\.minecraft
2012-02-06 18:37:45 ----D---- C:\WINDOWS\system32\config
2012-02-06 18:36:20 ----D---- C:\WINDOWS\system32\wbem
2012-02-06 18:36:14 ----D---- C:\WINDOWS\Registration
2012-02-06 18:31:23 ----D---- C:\Documents and Settings
2012-02-06 08:57:39 ----D---- C:\WINDOWS\system32\drivers\etc
2012-02-03 19:10:32 ----D---- C:\Program Files\PC Tools Registry Mechanic
2012-01-24 13:45:06 ----D---- C:\Program Files\Google
2012-01-24 13:18:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2012-01-23 17:42:32 ----D---- C:\Program Files\McAfee Security Scan
2012-01-21 16:53:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2012-01-21 11:12:19 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-01-09 218176]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2011-08-04 103112]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 cpuz135;cpuz135; \??\C:\WINDOWS\system32\drivers\cpuz135_x32.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2011-08-09 154136]
R2 hidusb;HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 danewFltr;NewDeathAdder Mouse; C:\WINDOWS\system32\drivers\danew.sys [2009-04-21 11136]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer; C:\WINDOWS\system32\DRIVERS\hidkmdf.sys [2010-09-25 6656]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-10-02 4878336]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MouseCap;MouseCapture Driver; C:\WINDOWS\System32\Drivers\MouseCap.sys [2005-08-08 6640]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-08-03 12542592]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 VKbms;Virtual HID Minidriver; C:\WINDOWS\system32\DRIVERS\VKbms.sys [2010-09-30 10240]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 ALSysIO;ALSysIO; \??\C:\DOCUME~1\Main\LOCALS~1\Temp\ALSysIO.sys []
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-10-29 3341824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CYUSB;Cypress Generic USB Driver; C:\WINDOWS\System32\Drivers\CYUSB.sys [2009-08-10 38528]
S3 EraserUtilDrvI13;EraserUtilDrvI13; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI13.sys []
S3 ESEADriver2;ESEADriver2; \??\C:\DOCUME~1\Main\LOCALS~1\Temp\ESEADriver2.sys []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 hamachi_oem;PlayLinc Adapter; C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 10664]
S3 Moufiltr;Mouse Test Driver; C:\WINDOWS\system32\DRIVERS\Moufiltr.sys [2005-08-06 9661]
S3 msloop;Microsoft Loopback Adapter Driver; C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 4992]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 S1TRACE;S1TRACE; \??\D:\UR\BzzZ\ProcDump 1.6.2\ProcDump 1.6.2\ProcDump 1.6.2\vxdbody.kmd []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vHidDev;Razer Gaming Device; C:\WINDOWS\system32\DRIVERS\vHidDev.sys [2009-12-21 5760]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-10-29 585728]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-08-09 974944]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; D:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2012-02-07 1373576]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-08-03 146024]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-10-25 793048]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-12-16 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2012-02-19 214520]
R2 SNMP;SNMP; C:\WINDOWS\System32\snmp.exe [2008-04-14 32768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 SNMPTRAP;Zachytávání pro službu SNMP; C:\WINDOWS\System32\snmptrap.exe [2008-04-14 8704]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-03-16 407336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 epfw;NetwareWorkstation; \\.\globalroot\SystemRoot\system32\svchost.exe [2008-04-14 14336]
S4 epfwtdi;Downloadmanagerlite; \\.\globalroot\SystemRoot\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Zdravím.

Nejprve vyčistěte PC CCleanerem od balastu: http://forum.viry.cz/viewtopic.php?f=46&t=7478 . Máte téměř plný syst. disk. Pak dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Nechápu proč není povolena přípona txt když chci nahrát log.
Vaše zpráva obsahuje 237313 znaků. Maximální povolený počet znaků je 80000. - zrovna na tomto fóru mi přijde toto omezení hloupé.

log: http://www.scribd.com/doc/82226233/Untitled

To omezení je kvůli odezvě fóra. Mohl byste čekat i několik minut na otevření okna. Vynechte Snapshot a zbytek logu sem zkopírujte.

ok, dik za vysvětlení, ale alespoň upload *txt by se hodil, tady je log


ComboFix 12-02-19.02 - Main 25.02.2012 18:34:08.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1454 [GMT 1:00]
Spuštěný z: c:\documents and settings\Main\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý
.
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-25 do 2012-02-25 )))))))))))))))))))))))))))))))
.
.
2012-02-23 19:48 . 2012-02-23 19:48 -------- d-----w- c:\program files\PC Tools Registry Mechanic
2012-02-20 22:10 . 2011-01-09 18:34 218176 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-02-19 16:32 . 2012-02-19 16:32 -------- d-----w- c:\program files\ESET
2012-02-19 16:32 . 2012-02-19 16:32 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2012-02-19 16:26 . 2012-02-19 16:26 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2012-02-19 16:19 . 2012-02-20 16:38 -------- d-sh--w- c:\documents and settings\Main\Local Settings\Data aplikací\d4ff40c6
2012-02-18 19:18 . 2012-02-18 19:18 -------- d-----w- c:\documents and settings\Main\Data aplikací\ESET
2012-02-18 18:57 . 2012-02-18 18:57 -------- d-----w- c:\program files\uTorrent
2012-02-17 14:13 . 2005-08-11 21:30 368640 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\_ispmres.dll
2012-02-17 14:13 . 2005-08-11 21:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2012-02-17 14:13 . 2005-08-11 21:29 73728 ----a-w- c:\windows\system32\ISUSPM.cpl
2012-02-15 09:33 . 2012-02-15 09:33 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2012-02-15 09:32 . 2012-02-18 18:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-15 06:11 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-02-15 06:11 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
2012-02-10 14:03 . 2012-02-10 14:03 -------- d-----w- c:\documents and settings\Main\Games
2012-02-09 06:20 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-02-09 06:20 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2012-02-08 08:27 . 2012-01-31 12:44 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-06 17:36 . 2012-02-06 17:36 -------- d-----w- c:\windows\system32\wbem\Repository
2012-02-06 17:31 . 2012-02-06 17:34 -------- d-s---w- c:\documents and settings\Administrator
2012-02-01 13:58 . 2012-02-25 14:21 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
2012-02-01 13:58 . 2012-02-22 20:38 -------- d-----w- c:\documents and settings\Main\Local Settings\Data aplikací\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-24 14:15 . 2011-02-01 19:19 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-02-24 14:15 . 2011-01-28 12:46 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-02-24 14:15 . 2011-01-28 12:46 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-01-14 16:40 . 2011-07-31 11:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-12 17:20 . 2011-08-07 09:46 1859968 ----a-w- c:\windows\system32\win32k.sys
2011-12-17 19:42 . 2011-08-07 09:46 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-12-17 19:42 . 2011-08-07 09:46 43520 ------w- c:\windows\system32\licmgr10.dll
2011-12-17 19:42 . 2011-08-07 09:46 916992 ----a-w- c:\windows\system32\wininet.dll
2011-12-16 16:25 . 2011-01-28 12:46 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-12-16 12:23 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[7] 2006-03-02 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[7] 2006-03-02 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-08-09 3076144]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
.
c:\documents and settings\Main\Nabídka Start\Programy\Po spuštění\
ESET NOD32 Antivirus.lnk - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe [2011-8-9 3076144]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
GamePark klient 2.lnk - d:\program files\GamePark2\gpcl.exe [2011-12-16 409088]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ObdikkEqwacy.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^GamePark klient 2.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\GamePark klient 2.lnk
backup=c:\windows\pss\GamePark klient 2.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Main^Nabídka Start^Programy^Po spuštění^Registration .LNK]
path=c:\documents and settings\Main\Nabídka Start\Programy\Po spuštění\Registration .LNK
backup=c:\windows\pss\Registration .LNKStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-05 09:09 1305408 ----a-w- d:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-02-19 16:39 136176 ----atw- c:\documents and settings\Main\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-07 12:18 1987976 ----a-w- d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-08-03 11:49 13892200 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-02-18 18:57 740216 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\WINDOWS\\nc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Valve\\hl.exe"=
"d:\\Teraria\\TerrariaServer.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\temp\\DSOClient\\app.n3app"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\Data aplikací\\Google\\Update\\GoogleUpdate.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"d:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Program Files\\OnLive\\OnLive.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [20.2.2012 23:10 218176]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [4.8.2011 9:20 118104]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [4.8.2011 9:20 103112]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [12.4.2011 20:18 21992]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9.8.2011 21:39 974944]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [7.2.2012 13:18 1373576]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [15.1.2012 21:19 793048]
R3 danewFltr;NewDeathAdder Mouse;c:\windows\system32\drivers\danew.sys [15.1.2011 13:44 11136]
R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer;c:\windows\system32\drivers\hidkmdf.sys [2.8.2011 22:12 6656]
R3 MouseCap;MouseCapture Driver;c:\windows\system32\drivers\MouseCap.sys [8.8.2005 14:44 6640]
R3 VKbms;Virtual HID Minidriver;c:\windows\system32\drivers\VKbms.sys [2.8.2011 22:12 10240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Main\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Main\LOCALS~1\Temp\ALSysIO.sys [?]
S3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\drivers\CYUSB.sys [15.1.2011 13:44 38528]
S3 EraserUtilDrvI13;EraserUtilDrvI13;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI13.sys [9.1.2012 10:41 106104]
S3 ESEADriver2;ESEADriver2;\??\c:\docume~1\Main\LOCALS~1\Temp\ESEADriver2.sys --> c:\docume~1\Main\LOCALS~1\Temp\ESEADriver2.sys [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [28.8.2006 22:54 10664]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe" --> c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [?]
S3 S1TRACE;S1TRACE;\??\d:\ur\BzzZ\ProcDump 1.6.2\ProcDump 1.6.2\ProcDump 1.6.2\vxdbody.kmd --> d:\ur\BzzZ\ProcDump 1.6.2\ProcDump 1.6.2\ProcDump 1.6.2\vxdbody.kmd [?]
S3 vHidDev;Razer Gaming Device;c:\windows\system32\drivers\vHidDev.sys [15.1.2011 13:44 5760]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/?AF=100888&tt=191011_bsttb&babsrc=HP_ss&mntrId=8087d4260000000000000019dbc5fe67
mStart Page = hxxp://www.bigseekpro.com/pivotstickfigure/{ED ... 4037425574}
uInternet Connection Wizard,ShellNext = iexplore
IE: Visit in &3D using ExitReality - http://3d.exitreality.com/TransmogrifyPage.htm
TCP: DhcpNameServer = 84.16.113.2 84.16.96.2
FF - ProfilePath - c:\documents and settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?babsrc=HP_Prot
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100888&tt=191011_bsttb&babsrc=adbartrp&mntrId=8087d4260000000000000019dbc5fe67&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-25 18:35
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\S1TRACE]
"ImagePath"="\??\d:\ur\BzzZ\ProcDump 1.6.2\ProcDump 1.6.2\ProcDump 1.6.2\vxdbody.kmd"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1715567821-1078145449-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:50,36,54,45,4a,ea,84,b4,78,34,77,5b,83,52,00,ab,87,7b,06,3b,e9,e1,87,
69,e9,ec,a4,26,a0,6b,13,ef,ae,cc,5a,a2,69,14,9f,7a,d0,3e,d1,be,9a,6f,b3,0a,\
"??"=hex:ec,7f,62,96,57,2c,d6,08,cc,a5,1f,55,b4,c4,7c,48
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3804)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2012-02-25 18:37:13
ComboFix-quarantined-files.txt 2012-02-25 17:36
ComboFix2.txt 2012-02-20 22:22
ComboFix3.txt 2011-08-11 12:50
.
Před spuštěním: 342 925 312
Po spuštění: 1 567 088 640
.
- - End Of File - - 97B506C29456FFF9711C0970FA362321

Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
d:\ur\BzzZ\ProcDump 1.6.2\ProcDump 1.6.2\ProcDump 1.6.2\vxdbody.kmd

Driver::
S1TRACE

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Firefox::
FF - ProfilePath - c:\documents and settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?babsrc=HP_Prot
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100888&tt ... bc5fe67&q=

Regnull::
[HKEY_USERS\S-1-5-21-1715567821-1078145449-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.



K mazání musíte stáhnout nový CF, ten váš je již po expiraci.

ComboFix 12-03-02.01 - Main 03.03.2012 11:18:56.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1343 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\oobe\msoobe.exe
c:\windows\system32\oobe\oobebaln.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_S1TRACE
-------\Service_S1TRACE
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-03 do 2012-03-03 )))))))))))))))))))))))))))))))
.
.
2012-02-23 19:48 . 2012-02-23 19:48 -------- d-----w- c:\program files\PC Tools Registry Mechanic
2012-02-20 22:10 . 2011-01-09 18:34 218176 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-02-19 16:32 . 2012-02-19 16:32 -------- d-----w- c:\program files\ESET
2012-02-19 16:32 . 2012-02-19 16:32 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2012-02-19 16:26 . 2012-02-19 16:26 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2012-02-19 16:19 . 2012-02-20 16:38 -------- d-sh--w- c:\documents and settings\Main\Local Settings\Data aplikací\d4ff40c6
2012-02-18 19:18 . 2012-02-18 19:18 -------- d-----w- c:\documents and settings\Main\Data aplikací\ESET
2012-02-18 18:57 . 2012-02-18 18:57 -------- d-----w- c:\program files\uTorrent
2012-02-17 14:13 . 2005-08-11 21:30 368640 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\_ispmres.dll
2012-02-17 14:13 . 2005-08-11 21:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2012-02-17 14:13 . 2005-08-11 21:29 73728 ----a-w- c:\windows\system32\ISUSPM.cpl
2012-02-15 09:33 . 2012-02-15 09:33 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2012-02-15 09:32 . 2012-02-18 18:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-15 06:11 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-02-15 06:11 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
2012-02-10 14:03 . 2012-02-10 14:03 -------- d-----w- c:\documents and settings\Main\Games
2012-02-09 06:20 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-02-09 06:20 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2012-02-08 08:27 . 2012-01-31 12:44 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-06 17:36 . 2012-02-06 17:36 -------- d-----w- c:\windows\system32\wbem\Repository
2012-02-06 17:31 . 2012-02-06 17:34 -------- d-s---w- c:\documents and settings\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-01 15:48 . 2011-02-01 19:19 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-03-01 15:48 . 2011-01-28 12:46 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-03-01 15:48 . 2011-01-28 12:46 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-01-14 16:40 . 2011-07-31 11:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-12 17:20 . 2011-08-07 09:46 1859968 ----a-w- c:\windows\system32\win32k.sys
2011-12-17 19:42 . 2011-08-07 09:46 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-12-17 19:42 . 2011-08-07 09:46 43520 ------w- c:\windows\system32\licmgr10.dll
2011-12-17 19:42 . 2011-08-07 09:46 916992 ----a-w- c:\windows\system32\wininet.dll
2011-12-16 16:25 . 2011-01-28 12:46 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-12-16 12:23 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[7] 2006-03-02 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[7] 2006-03-02 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
((((((((((((((((((((((((((((( SnapShot_2012-02-20_22.19.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-03 10:24 . 2012-03-03 10:24 16384 c:\windows\temp\Perflib_Perfdata_358.dat
+ 2011-01-07 14:39 . 2011-01-07 14:39 51024 c:\windows\system32\vcomp100.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 51024 c:\windows\system32\vcomp100.dll
- 2006-03-02 12:00 . 2012-02-20 22:20 88184 c:\windows\system32\perfc009.dat
+ 2006-03-02 12:00 . 2012-03-03 10:06 88184 c:\windows\system32\perfc009.dat
- 2010-03-18 07:15 . 2010-03-18 07:15 80720 c:\windows\system32\mfcm100u.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 80720 c:\windows\system32\mfcm100u.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 80208 c:\windows\system32\mfcm100.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 80208 c:\windows\system32\mfcm100.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 60752 c:\windows\system32\mfc100rus.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 60752 c:\windows\system32\mfc100rus.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 43344 c:\windows\system32\mfc100kor.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 43344 c:\windows\system32\mfc100kor.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 43856 c:\windows\system32\mfc100jpn.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 43856 c:\windows\system32\mfc100jpn.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 62288 c:\windows\system32\mfc100ita.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 62288 c:\windows\system32\mfc100ita.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 36176 c:\windows\system32\mfc100cht.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 36176 c:\windows\system32\mfc100cht.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 36176 c:\windows\system32\mfc100chs.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 36176 c:\windows\system32\mfc100chs.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 64336 c:\windows\system32\mfc100fra.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 64336 c:\windows\system32\mfc100fra.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 63824 c:\windows\system32\mfc100esn.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 63824 c:\windows\system32\mfc100esn.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 55120 c:\windows\system32\mfc100enu.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 55120 c:\windows\system32\mfc100enu.dll
- 2010-03-18 07:15 . 2010-03-18 07:15 64336 c:\windows\system32\mfc100deu.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 64336 c:\windows\system32\mfc100deu.dll
+ 2011-01-11 15:20 . 2012-02-23 17:44 87942 c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
- 2011-12-15 10:45 . 2011-12-15 10:45 86016 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2012-02-21 14:03 . 2012-02-21 14:03 86016 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46 73408 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
- 2011-12-15 10:29 . 2011-12-15 10:29 73408 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46 64512 c:\windows\system32\Adobe\Shockwave 11\gcapi_dll.dll
- 2011-12-15 10:29 . 2011-12-15 10:29 64512 c:\windows\system32\Adobe\Shockwave 11\gcapi_dll.dll
+ 2012-02-21 14:04 . 2012-02-21 14:04 12800 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
- 2011-12-15 10:46 . 2011-12-15 10:46 12800 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
- 2006-03-02 12:00 . 2012-02-20 22:20 502278 c:\windows\system32\perfh009.dat
+ 2006-03-02 12:00 . 2012-03-03 10:06 502278 c:\windows\system32\perfh009.dat
+ 2006-03-02 12:00 . 2012-03-03 10:06 497018 c:\windows\system32\perfh005.dat
- 2006-03-02 12:00 . 2012-02-20 22:20 497018 c:\windows\system32\perfh005.dat
- 2006-03-02 12:00 . 2012-02-20 22:20 102884 c:\windows\system32\perfc005.dat
+ 2006-03-02 12:00 . 2012-03-03 10:06 102884 c:\windows\system32\perfc005.dat
+ 2011-01-07 14:39 . 2011-01-07 14:39 137544 c:\windows\system32\atl100.dll
- 2011-12-15 10:29 . 2011-12-15 10:29 279992 c:\windows\system32\Adobe\Shockwave 11\SymCCIS.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46 279992 c:\windows\system32\Adobe\Shockwave 11\SymCCIS.dll
- 2011-12-15 10:45 . 2011-12-15 10:45 114176 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2012-02-21 14:03 . 2012-02-21 14:03 114176 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2012-02-21 14:04 . 2012-02-21 14:04 434176 c:\windows\system32\Adobe\Shockwave 11\Proj.dll
- 2011-12-15 10:47 . 2011-12-15 10:47 434176 c:\windows\system32\Adobe\Shockwave 11\Proj.dll
+ 2012-02-21 14:03 . 2012-02-21 14:03 365056 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
- 2011-12-15 10:45 . 2011-12-15 10:45 365056 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
- 2011-12-15 10:33 . 2011-12-15 10:33 990208 c:\windows\system32\Adobe\Shockwave 11\iml32.dll
+ 2012-02-21 13:50 . 2012-02-21 13:50 990208 c:\windows\system32\Adobe\Shockwave 11\iml32.dll
- 2011-12-15 10:44 . 2011-12-15 10:44 543232 c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2012-02-21 14:03 . 2012-02-21 14:03 543232 c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2012-02-21 14:10 . 2012-02-21 14:10 113592 c:\windows\system32\Adobe\Director\SWDNLD.EXE
- 2011-12-15 10:53 . 2011-12-15 10:53 113592 c:\windows\system32\Adobe\Director\SWDNLD.EXE
- 2011-12-15 10:53 . 2011-12-15 10:53 281016 c:\windows\system32\Adobe\Director\SwDir.dll
+ 2012-02-21 14:10 . 2012-02-21 14:10 281016 c:\windows\system32\Adobe\Director\SwDir.dll
+ 2012-02-21 14:04 . 2012-02-21 14:04 145920 c:\windows\system32\Adobe\Director\np32dsw.dll
- 2011-12-15 10:46 . 2011-12-15 10:46 145920 c:\windows\system32\Adobe\Director\np32dsw.dll
+ 2012-02-29 18:28 . 2012-02-29 18:28 890880 c:\windows\Installer\c546.msi
+ 2012-03-01 19:34 . 2012-03-01 19:34 371272 c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe
- 2010-03-18 07:15 . 2010-03-18 07:15 4368720 c:\windows\system32\mfc100u.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 4368720 c:\windows\system32\mfc100u.dll
+ 2011-01-07 14:39 . 2011-01-07 14:39 4342600 c:\windows\system32\mfc100.dll
+ 2012-02-21 14:10 . 2012-02-21 14:10 1041848 c:\windows\system32\Adobe\Shockwave 11\SwHelper_1164634.exe
+ 2012-02-21 13:46 . 2012-02-21 13:46 2376368 c:\windows\system32\Adobe\Shockwave 11\gt.exe
+ 2012-02-21 13:46 . 2012-02-21 13:46 1225216 c:\windows\system32\Adobe\Shockwave 11\gi.dll
- 2011-12-15 10:35 . 2011-12-15 10:35 1742336 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
+ 2012-02-21 13:52 . 2012-02-21 13:52 1742336 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
+ 2012-03-01 19:34 . 2012-03-01 19:34 1252864 c:\windows\Installer\9f3c80.msi
+ 2012-03-01 19:34 . 2012-03-01 19:34 1605120 c:\windows\Installer\9f3c73.msi
+ 2011-01-07 19:10 . 2011-01-07 19:10 3991040 c:\windows\Installer\1e499f.msp
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-08-09 3076144]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"LogMeIn Hamachi Ui"="d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-28 1987976]
.
c:\documents and settings\Main\Nabídka Start\Programy\Po spuštění\
ESET NOD32 Antivirus.lnk - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe [2011-8-9 3076144]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
GamePark klient 2.lnk - d:\program files\GamePark2\gpcl.exe [2011-12-16 409088]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ObdikkEqwacy.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^GamePark klient 2.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\GamePark klient 2.lnk
backup=c:\windows\pss\GamePark klient 2.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Main^Nabídka Start^Programy^Po spuštění^Registration .LNK]
path=c:\documents and settings\Main\Nabídka Start\Programy\Po spuštění\Registration .LNK
backup=c:\windows\pss\Registration .LNKStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-05 09:09 1305408 ----a-w- d:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-02-19 16:39 136176 ----atw- c:\documents and settings\Main\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-28 16:38 1987976 ----a-w- d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-08-03 11:49 13892200 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-02-18 18:57 740216 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\WINDOWS\\nc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Valve\\hl.exe"=
"d:\\Teraria\\TerrariaServer.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\temp\\DSOClient\\app.n3app"=
"d:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\Data aplikací\\Google\\Update\\GoogleUpdate.exe"=
"c:\\Documents and Settings\\Main\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"d:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Program Files\\OnLive\\OnLive.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [20.2.2012 23:10 218176]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [4.8.2011 9:20 118104]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [4.8.2011 9:20 103112]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [12.4.2011 20:18 21992]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9.8.2011 21:39 974944]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [28.2.2012 17:38 1373576]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [15.1.2012 21:19 793048]
R3 danewFltr;NewDeathAdder Mouse;c:\windows\system32\drivers\danew.sys [15.1.2011 13:44 11136]
R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer;c:\windows\system32\drivers\hidkmdf.sys [2.8.2011 22:12 6656]
R3 MouseCap;MouseCapture Driver;c:\windows\system32\drivers\MouseCap.sys [8.8.2005 14:44 6640]
R3 VKbms;Virtual HID Minidriver;c:\windows\system32\drivers\VKbms.sys [2.8.2011 22:12 10240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [15.2.2012 13:30 158856]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Main\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Main\LOCALS~1\Temp\ALSysIO.sys [?]
S3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\drivers\CYUSB.sys [15.1.2011 13:44 38528]
S3 EraserUtilDrvI13;EraserUtilDrvI13;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI13.sys [9.1.2012 10:41 106104]
S3 ESEADriver2;ESEADriver2;\??\c:\docume~1\Main\LOCALS~1\Temp\ESEADriver2.sys --> c:\docume~1\Main\LOCALS~1\Temp\ESEADriver2.sys [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [28.8.2006 22:54 10664]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe" --> c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [?]
S3 vHidDev;Razer Gaming Device;c:\windows\system32\drivers\vHidDev.sys [15.1.2011 13:44 5760]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/?AF=100888&tt=191011_bsttb&babsrc=HP_ss&mntrId=8087d4260000000000000019dbc5fe67
mStart Page = hxxp://www.bigseekpro.com/pivotstickfigure/{ED ... 4037425574}
uInternet Connection Wizard,ShellNext = iexplore
IE: Visit in &3D using ExitReality - http://3d.exitreality.com/TransmogrifyPage.htm
TCP: DhcpNameServer = 84.16.113.2 84.16.96.2
FF - ProfilePath - c:\documents and settings\Main\Data aplikací\Mozilla\Firefox\Profiles\87mzwclp.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-03 11:24
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3792)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\System32\snmp.exe
.
**************************************************************************
.
Celkový čas: 2012-03-03 11:27:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-03 10:27
ComboFix2.txt 2012-02-25 17:37
ComboFix3.txt 2012-02-20 22:22
ComboFix4.txt 2011-08-11 12:50
.
Před spuštěním: 1 402 523 648
Po spuštění: 1 678 991 360
.
- - End Of File - - 2B2ED1A558AC5DB6BDBFC41D87326490

Smazáno. Nyní otevřte znovu poznámkový blok a zkopírujte do něj:

Regedit4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Uložte na plochu jako oprava.reg. Dvouklikem ji rozbalte. Nakonec restartujte PC.

Zkuste to takto:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ObdikkEqwacy.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Spusťte stejným způsobem, jako před tím.

Hotovo. Děkuji mnohokrát.

Nemáte zač!