VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Milanek at 2012-02-28 18:24:33
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (7%) free of 32 GB
Total RAM: 2047 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:24:51, on 28.2.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Milanek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Milanek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Milanek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Milanek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Milanek\Plocha\RSIT.exe
C:\Program Files\trend micro\Milanek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.gametop.com/?utm_source=Un ... dium=start
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0DBBCB3D-A807-4577-9FC0-5154F210ECF1}: NameServer = 62.84.128.6,62.84.132.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE66307A-458D-46E2-96BF-784F0D7E1A72}: NameServer = 62.77.67.2,62.84.128.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{F6A00A8E-B78D-4637-85C2-CDDD12330B7C}: NameServer = 62.77.67.2,62.84.128.6
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7679 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-1637723038-2146814731-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-1637723038-2146814731-1003UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Milanek\Data aplikací\Mozilla\Firefox\Profiles\o10r0zdx.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30, toolbar@ask.com:3.14.1.100010, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.26"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... ource=2&q="

"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
xmlfiller@software602.cz
{800b5000-a755-47e1-992b-48a1c1357f07}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIFillerPlugin.xpt
nsILegitCheckPlugin.xpt
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npfiller.dll
npLegitCheckPlugin.dll
NPOFFICE.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Milanek\Data aplikací\Mozilla\Firefox\Profiles\o10r0zdx.default\extensions\
{88c7f2aa-f93f-432c-8f0e-b7d85967a527}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-01-03 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-09 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-09 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-02-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-12-10 7311360]
"nwiz"=nwiz.exe /install []
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-12-10 86016]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-11-28 3744552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-01-03 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-02-15 738680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-08-02 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-19 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i263_32.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.I263"=I263_32.drv

======List of files/folders created in the last 1 month======

2012-02-28 18:24:34 ----D---- C:\Program Files\trend micro
2012-02-28 18:24:33 ----D---- C:\rsit
2012-02-27 06:44:48 ----SHD---- C:\Config.Msi
2012-02-21 20:15:17 ----A---- C:\WINDOWS\system32\H@tKeysH@@k.DLL
2012-02-15 12:56:20 ----D---- C:\Program Files\uTorrent
2012-02-15 12:55:32 ----D---- C:\Documents and Settings\Milanek\Data aplikací\uTorrent
2012-02-15 12:46:27 ----D---- C:\Program Files\Conduit
2012-02-13 10:33:39 ----A---- C:\WINDOWS\PhotoSnapViewer.INI
2012-02-11 22:08:38 ----A---- C:\WINDOWS\system32\pncrt.dll
2012-02-11 22:07:25 ----D---- C:\Program Files\FreeTime
2012-02-11 21:57:00 ----A---- C:\WINDOWS\system32\kbdkor.dll
2012-02-11 21:57:00 ----A---- C:\WINDOWS\system32\kbdjpn.dll
2012-02-11 21:57:00 ----A---- C:\WINDOWS\system32\kbd103.dll
2012-02-11 21:57:00 ----A---- C:\WINDOWS\system32\kbd101c.dll
2012-02-11 21:57:00 ----A---- C:\WINDOWS\system32\kbd101b.dll
2012-02-11 21:56:59 ----A---- C:\WINDOWS\system32\kbd106.dll
2012-02-10 20:11:11 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-02-10 20:11:10 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-02-10 20:11:07 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-02-10 20:11:07 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-02-10 20:11:06 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-02-10 20:11:05 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-02-10 20:11:05 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-02-10 20:11:05 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-02-10 20:10:43 ----A---- C:\WINDOWS\avastSS.scr
2012-02-10 20:10:39 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-02-10 20:10:16 ----D---- C:\Program Files\AVAST Software
2012-02-10 20:10:16 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-02-10 09:58:24 ----D---- C:\Documents and Settings\Milanek\Data aplikací\Skype
2012-02-10 09:58:12 ----D---- C:\Program Files\Common Files\Skype
2012-02-10 09:58:09 ----RD---- C:\Program Files\Skype
2012-02-10 09:58:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2012-02-10 09:11:04 ----D---- C:\Documents and Settings\Milanek\Data aplikací\Reviversoft
2012-02-10 09:09:39 ----D---- C:\Program Files\Reviversoft
2012-02-10 09:09:39 ----A---- C:\WINDOWS\system32\roboot.exe
2012-02-09 22:42:37 ----D---- C:\Documents and Settings\Milanek\Data aplikací\vlc
2012-02-09 22:40:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\Free Online TV
2012-02-09 22:40:15 ----D---- C:\Program Files\Free Online TV
2012-02-09 21:25:42 ----D---- C:\Program Files\CCleaner
2012-02-09 21:04:32 ----D---- C:\Program Files\The KMPlayer
2012-02-09 17:03:35 ----D---- C:\Documents and Settings\Milanek\Data aplikací\VitySoft
2012-02-09 17:03:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2012-02-09 17:03:11 ----D---- C:\Program Files\Common Files\Java
2012-02-09 17:02:52 ----A---- C:\WINDOWS\system32\javaws.exe
2012-02-09 17:02:52 ----A---- C:\WINDOWS\system32\javaw.exe
2012-02-09 17:02:52 ----A---- C:\WINDOWS\system32\java.exe
2012-02-09 17:02:52 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-02-09 17:02:20 ----D---- C:\Program Files\Java
2012-02-09 17:01:39 ----D---- C:\Documents and Settings\Milanek\Data aplikací\Sun
2012-02-09 15:53:29 ----A---- C:\WINDOWS\system32\drivers\loop.sys
2012-02-07 19:30:20 ----D---- C:\Program Files\Atari
2012-02-05 09:11:11 ----D---- C:\Program Files\Electronic Arts
2012-02-05 07:23:36 ----D---- C:\Documents and Settings\Milanek\Data aplikací\Activision

======List of files/folders modified in the last 1 month======

2012-02-28 18:24:39 ----D---- C:\WINDOWS\Prefetch
2012-02-28 18:24:34 ----RD---- C:\Program Files
2012-02-28 17:33:15 ----D---- C:\WINDOWS\Temp
2012-02-28 11:40:01 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-02-28 10:17:26 ----D---- C:\WINDOWS\system32\CatRoot2
2012-02-27 06:49:39 ----SHD---- C:\WINDOWS\Installer
2012-02-27 06:47:32 ----D---- C:\Program Files\Common Files\Adobe
2012-02-27 06:47:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2012-02-27 06:47:10 ----D---- C:\Program Files\Adobe
2012-02-27 06:43:51 ----D---- C:\WINDOWS\system32
2012-02-21 23:17:50 ----D---- C:\Program Files\Mozilla Firefox
2012-02-15 12:54:03 ----SD---- C:\WINDOWS\Tasks
2012-02-15 12:18:44 ----A---- C:\WINDOWS\NeroDigital.ini
2012-02-13 10:33:39 ----D---- C:\WINDOWS
2012-02-11 21:57:06 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-02-11 07:48:37 ----D---- C:\Program Files\ESET
2012-02-10 20:11:11 ----D---- C:\WINDOWS\system32\drivers
2012-02-10 20:10:56 ----D---- C:\WINDOWS\WinSxS
2012-02-10 10:21:53 ----D---- C:\WINDOWS\system32\config
2012-02-10 09:58:12 ----D---- C:\Program Files\Common Files
2012-02-09 21:27:38 ----D---- C:\WINDOWS\Minidump
2012-02-09 21:27:38 ----D---- C:\WINDOWS\Logs
2012-02-09 21:27:38 ----D---- C:\WINDOWS\Debug
2012-02-09 21:10:29 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2012-02-09 15:50:11 ----A---- C:\WINDOWS\system.ini
2012-02-07 06:25:14 ----HD---- C:\WINDOWS\inf
2012-02-07 06:24:26 ----D---- C:\WINDOWS\system32\DirectX
2012-02-07 06:21:39 ----D---- C:\Program Files\Nobilis
2012-02-05 07:21:45 ----HD---- C:\Program Files\InstallShield Installation Information
2012-02-05 07:20:25 ----D---- C:\Program Files\Activision
2012-01-30 17:15:41 ----D---- C:\Program Files\Ubisoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-06-30 639224]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-11-28 30808]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-11-28 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-11-28 435032]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-11-28 314456]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-11-28 52952]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-11-28 20568]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-11-28 111320]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2001-10-25 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2001-10-25 55936]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-07-26 247808]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-04-27 93824]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-12-10 3536768]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-07-12 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-07-12 20480]
R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2008-04-13 163584]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-18 392960]
S3 ar3yofup;ar3yofup; C:\WINDOWS\system32\drivers\ar3yofup.sys []
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-08-02 1681920]
S3 atimtai;atimtai; C:\WINDOWS\system32\DRIVERS\atimtai.sys [2001-10-24 281600]
S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
S3 msloop;Microsoft Loopback Adapter Driver; C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 4992]
S3 pohci13F;pohci13F; \??\C:\DOCUME~1\Milanek\LOCALS~1\Temp\pohci13F.sys []
S3 pwdrvio;pwdrvio; \??\C:\WINDOWS\system32\pwdrvio.sys []
S3 pwdspio;pwdspio; \??\C:\WINDOWS\system32\pwdspio.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-19 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-19 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-11-28 44768]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-04-03 20543]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-02-09 153376]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-07-13 131131]
R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-07-13 65599]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-12-10 131139]
R2 NWCWorkstation;Klient systému NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 UxTuneUp;TuneUp Design Expansion; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-08-02 401408]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-08-02 520192]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

Zdravím, tohle fixni v HJT :

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

HJT najdeš zde :

C:\Program Files\trend micro\Milanek.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :

NBService - Nero AG

NMIndexingService - Nero AG

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.60.1.1000
www.malwarebytes.org

Verze databáze: v2012.02.29.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.11
Milanek :: MILAN1 [administrátor]

Ochrana: Povolena

29.2.2012 19:54:50
mbam-log-2012-02-29 (20-08-20).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 162392
Uplynulý čas: 7 minut, 34 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\WINDOWS\system32\H@tKeysH@@k.DLL (Trojan.Agent) -> Žádná instrukce nebyla provedena.

(konec)

To co Mbam našel nech smazat.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

ComboFix 12-03-01.01 - Milanek 01.03.2012 20:26:31.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1669 [GMT 1:00]
Spuštěný z: f:\stahnute\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Data aplikací\ReminderNextRun
c:\documents and settings\Milanek\WINDOWS
c:\program files\DaemonTools_WhenUSave_Installer
c:\program files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
c:\program files\DaemonTools_WhenUSave_Installer\vvsn.cfg
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-01 do 2012-03-01 )))))))))))))))))))))))))))))))
.
.
2012-02-29 19:06 . 2012-02-29 19:08 -------- d-----w- C:\log 2222
2012-02-29 18:50 . 2012-02-29 18:50 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Malwarebytes
2012-02-29 18:49 . 2012-02-29 18:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2012-02-29 18:49 . 2012-02-29 18:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-02-29 18:49 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-28 17:24 . 2012-02-29 18:30 -------- d-----w- c:\program files\trend micro
2012-02-28 17:24 . 2012-02-28 17:24 -------- d-----w- C:\rsit
2012-02-15 11:56 . 2012-02-16 05:45 -------- d-----w- c:\program files\uTorrent
2012-02-15 11:55 . 2012-03-01 19:04 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\uTorrent
2012-02-15 11:46 . 2012-02-15 11:46 -------- d-----w- c:\program files\Conduit
2012-02-15 11:46 . 2012-02-15 11:49 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Conduit
2012-02-15 11:46 . 2012-02-15 11:46 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Temp
2012-02-11 21:07 . 2012-02-11 21:07 -------- d-----w- c:\program files\FreeTime
2012-02-11 20:57 . 2001-08-18 05:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2012-02-11 20:57 . 2001-08-18 05:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2012-02-11 20:57 . 2001-08-18 05:36 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2012-02-11 20:57 . 2001-08-18 05:36 8192 ----a-w- c:\windows\system32\kbdkor.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2012-02-11 20:57 . 2001-08-17 21:55 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll
2012-02-11 20:57 . 2001-08-17 21:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2012-02-11 20:56 . 2008-04-14 07:48 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2012-02-11 20:56 . 2008-04-14 07:48 6144 ----a-w- c:\windows\system32\kbd106.dll
2012-02-10 19:11 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-10 19:11 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-02-10 19:11 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-02-10 19:11 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-02-10 19:11 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-02-10 19:11 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-02-10 19:11 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-02-10 19:11 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-10 19:10 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2012-02-10 19:10 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2012-02-10 19:10 . 2012-02-10 19:10 -------- d-----w- c:\program files\AVAST Software
2012-02-10 19:10 . 2012-02-10 19:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-10 10:10 . 2012-02-21 22:17 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-02-10 10:10 . 2012-02-21 22:17 97240 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-02-10 10:10 . 2012-02-21 22:17 437208 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-02-10 10:10 . 2012-02-21 22:17 1911768 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-02-10 10:10 . 2012-02-21 22:17 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-02-10 10:10 . 2012-02-21 22:17 801752 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-02-10 10:10 . 2012-02-21 22:17 45016 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-02-10 10:10 . 2012-01-29 13:35 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-02-10 10:10 . 2012-01-29 13:35 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-02-10 10:10 . 2012-01-29 13:35 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-02-10 10:10 . 2012-01-29 13:35 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-02-10 10:10 . 2012-01-29 13:35 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-02-10 08:58 . 2012-02-29 18:35 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----w- c:\program files\Common Files\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----r- c:\program files\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Skype
2012-02-10 08:11 . 2012-02-10 08:11 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Reviversoft
2012-02-10 08:09 . 2012-02-10 08:09 -------- d-----w- c:\program files\Reviversoft
2012-02-10 08:03 . 2012-02-21 22:17 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2012-02-09 21:42 . 2012-02-09 21:42 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\vlc
2012-02-09 21:40 . 2012-02-09 21:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Free Online TV
2012-02-09 21:40 . 2012-02-09 21:43 -------- d-----w- c:\program files\Free Online TV
2012-02-09 20:25 . 2012-02-09 20:25 -------- d-----w- c:\program files\CCleaner
2012-02-09 20:05 . 2012-02-09 20:05 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\APN
2012-02-09 20:04 . 2012-02-23 23:18 -------- d-----w- c:\program files\The KMPlayer
2012-02-09 16:03 . 2012-02-09 16:03 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\VitySoft
2012-02-09 16:03 . 2012-02-09 16:03 -------- d-----w- c:\program files\Common Files\Java
2012-02-09 16:02 . 2012-02-09 16:02 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2012-02-09 16:02 . 2012-02-09 16:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-09 16:02 . 2012-02-09 16:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-09 16:02 . 2012-02-09 16:02 -------- d-----w- c:\program files\Java
2012-02-09 15:48 . 2012-02-09 15:48 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-09 15:35 . 2012-02-09 15:36 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Google
2012-02-09 14:53 . 2001-08-17 20:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
2012-02-09 14:53 . 2001-08-17 20:53 4992 ----a-w- c:\windows\system32\drivers\loop.sys
2012-02-07 18:30 . 2012-02-07 18:30 -------- d-----w- c:\program files\Atari
2012-02-05 06:23 . 2012-02-05 06:23 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Activision
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-04 16:01 . 2009-09-04 16:01 525656 ----a-w- c:\program files\DXSETUP.exe
2009-09-04 16:01 . 2009-09-04 16:01 94024 ----a-w- c:\program files\DSETUP.dll
2009-09-04 16:01 . 2009-09-04 16:01 1691464 ----a-w- c:\program files\dsetup32.dll
2012-02-21 22:17 . 2012-02-10 10:10 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-05-19 . E3B22F050F840306FD522227F68046C5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"nwiz"="nwiz.exe" [2005-12-10 1519616]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"Google Update"="c:\documents and settings\Milanek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"Registry Reviver"=c:\program files\Reviversoft\Registry Reviver\RegistryReviver.exe
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" /MINIMIZED
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"DaemonTools_WhenUSave_Installer"=c:\program files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
"PWRISOVM.EXE"=c:\program files\PowerISO\PWRISOVM.EXE
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.6.2010 9:18 639224]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10.2.2012 20:11 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.2.2012 20:11 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.2.2012 20:11 20568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [29.2.2012 19:49 652360]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [29.2.2012 19:49 20464]
S3 atimtai;atimtai;c:\windows\system32\drivers\atimtai.sys [19.5.2011 12:44 281600]
S3 pohci13F;pohci13F;\??\c:\docume~1\Milanek\LOCALS~1\Temp\pohci13F.sys --> c:\docume~1\Milanek\LOCALS~1\Temp\pohci13F.sys [?]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [29.10.2010 15:36 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [29.10.2010 15:36 11104]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-24 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.gametop.com/?utm_source=UnderwaterPuzzle&utm_medium=start
TCP: Interfaces\{0DBBCB3D-A807-4577-9FC0-5154F210ECF1}: NameServer = 62.84.128.6,62.84.132.6
TCP: Interfaces\{AE66307A-458D-46E2-96BF-784F0D7E1A72}: NameServer = 62.77.67.2,62.84.128.6
TCP: Interfaces\{F6A00A8E-B78D-4637-85C2-CDDD12330B7C}: NameServer = 62.77.67.2,62.84.128.6
FF - ProfilePath - c:\documents and settings\Milanek\Data aplikací\Mozilla\Firefox\Profiles\o10r0zdx.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=2&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-01 20:33
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(892)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2012-03-01 20:38:00
ComboFix-quarantined-files.txt 2012-03-01 19:37
.
Před spuštěním: 8 857 939 968
Po spuštění: 8 815 910 912
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 78DBE1F5703B83CAD71D2D7C2C6DFDA8

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:
ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

ComboFix 12-03-01.01 - Milanek 02.03.2012 9:05.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1661 [GMT 1:00]
Spuštěný z: c:\documents and settings\Milanek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Milanek\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-02 do 2012-03-02 )))))))))))))))))))))))))))))))
.
.
2012-02-29 19:06 . 2012-02-29 19:08 -------- d-----w- C:\log 2222
2012-02-29 18:50 . 2012-02-29 18:50 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Malwarebytes
2012-02-29 18:49 . 2012-02-29 18:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2012-02-29 18:49 . 2012-02-29 18:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-02-29 18:49 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-28 17:24 . 2012-02-29 18:30 -------- d-----w- c:\program files\trend micro
2012-02-28 17:24 . 2012-02-28 17:24 -------- d-----w- C:\rsit
2012-02-15 11:56 . 2012-02-16 05:45 -------- d-----w- c:\program files\uTorrent
2012-02-15 11:55 . 2012-03-01 19:04 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\uTorrent
2012-02-15 11:46 . 2012-02-15 11:49 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Conduit
2012-02-15 11:46 . 2012-02-15 11:46 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Temp
2012-02-11 21:07 . 2012-02-11 21:07 -------- d-----w- c:\program files\FreeTime
2012-02-11 20:57 . 2001-08-18 05:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2012-02-11 20:57 . 2001-08-18 05:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2012-02-11 20:57 . 2001-08-18 05:36 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2012-02-11 20:57 . 2001-08-18 05:36 8192 ----a-w- c:\windows\system32\kbdkor.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2012-02-11 20:57 . 2001-08-17 21:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2012-02-11 20:57 . 2001-08-17 21:55 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll
2012-02-11 20:57 . 2001-08-17 21:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2012-02-11 20:56 . 2008-04-14 07:48 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2012-02-11 20:56 . 2008-04-14 07:48 6144 ----a-w- c:\windows\system32\kbd106.dll
2012-02-10 19:11 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-10 19:11 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-02-10 19:11 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-02-10 19:11 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-02-10 19:11 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-02-10 19:11 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-02-10 19:11 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-02-10 19:11 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-10 19:10 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2012-02-10 19:10 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2012-02-10 19:10 . 2012-02-10 19:10 -------- d-----w- c:\program files\AVAST Software
2012-02-10 19:10 . 2012-02-10 19:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-10 10:10 . 2012-02-21 22:17 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-02-10 10:10 . 2012-02-21 22:17 97240 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-02-10 10:10 . 2012-02-21 22:17 437208 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-02-10 10:10 . 2012-02-21 22:17 1911768 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-02-10 10:10 . 2012-02-21 22:17 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-02-10 10:10 . 2012-02-21 22:17 801752 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-02-10 10:10 . 2012-02-21 22:17 45016 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-02-10 10:10 . 2012-01-29 13:35 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-02-10 10:10 . 2012-01-29 13:35 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-02-10 10:10 . 2012-01-29 13:35 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-02-10 10:10 . 2012-01-29 13:35 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-02-10 10:10 . 2012-01-29 13:35 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-02-10 08:58 . 2012-02-29 18:35 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----w- c:\program files\Common Files\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----r- c:\program files\Skype
2012-02-10 08:58 . 2012-02-10 08:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Skype
2012-02-10 08:11 . 2012-02-10 08:11 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Reviversoft
2012-02-10 08:09 . 2012-02-10 08:09 -------- d-----w- c:\program files\Reviversoft
2012-02-10 08:03 . 2012-02-21 22:17 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2012-02-09 21:42 . 2012-02-09 21:42 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\vlc
2012-02-09 21:40 . 2012-02-09 21:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Free Online TV
2012-02-09 21:40 . 2012-02-09 21:43 -------- d-----w- c:\program files\Free Online TV
2012-02-09 20:25 . 2012-02-09 20:25 -------- d-----w- c:\program files\CCleaner
2012-02-09 20:05 . 2012-02-09 20:05 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\APN
2012-02-09 20:04 . 2012-02-23 23:18 -------- d-----w- c:\program files\The KMPlayer
2012-02-09 16:03 . 2012-02-09 16:03 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\VitySoft
2012-02-09 16:03 . 2012-02-09 16:03 -------- d-----w- c:\program files\Common Files\Java
2012-02-09 16:02 . 2012-02-09 16:02 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2012-02-09 16:02 . 2012-02-09 16:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-09 16:02 . 2012-02-09 16:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-09 16:02 . 2012-02-09 16:02 -------- d-----w- c:\program files\Java
2012-02-09 15:48 . 2012-02-09 15:48 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-09 15:35 . 2012-02-09 15:36 -------- d-----w- c:\documents and settings\Milanek\Local Settings\Data aplikací\Google
2012-02-09 14:53 . 2001-08-17 20:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
2012-02-09 14:53 . 2001-08-17 20:53 4992 ----a-w- c:\windows\system32\drivers\loop.sys
2012-02-07 18:30 . 2012-02-07 18:30 -------- d-----w- c:\program files\Atari
2012-02-05 06:23 . 2012-02-05 06:23 -------- d-----w- c:\documents and settings\Milanek\Data aplikací\Activision
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-04 16:01 . 2009-09-04 16:01 525656 ----a-w- c:\program files\DXSETUP.exe
2009-09-04 16:01 . 2009-09-04 16:01 94024 ----a-w- c:\program files\DSETUP.dll
2009-09-04 16:01 . 2009-09-04 16:01 1691464 ----a-w- c:\program files\dsetup32.dll
2012-02-21 22:17 . 2012-02-10 10:10 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-05-19 . E3B22F050F840306FD522227F68046C5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-03-01_19.34.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-02 07:32 . 2012-03-02 07:32 16384 c:\windows\Temp\Perflib_Perfdata_47c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"nwiz"="nwiz.exe" [2005-12-10 1519616]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"Google Update"="c:\documents and settings\Milanek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"Registry Reviver"=c:\program files\Reviversoft\Registry Reviver\RegistryReviver.exe
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" /MINIMIZED
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"PWRISOVM.EXE"=c:\program files\PowerISO\PWRISOVM.EXE
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.6.2010 9:18 639224]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10.2.2012 20:11 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.2.2012 20:11 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.2.2012 20:11 20568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [29.2.2012 19:49 652360]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [29.2.2012 19:49 20464]
S3 atimtai;atimtai;c:\windows\system32\drivers\atimtai.sys [19.5.2011 12:44 281600]
S3 pohci13F;pohci13F;\??\c:\docume~1\Milanek\LOCALS~1\Temp\pohci13F.sys --> c:\docume~1\Milanek\LOCALS~1\Temp\pohci13F.sys [?]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [29.10.2010 15:36 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [29.10.2010 15:36 11104]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-24 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.gametop.com/?utm_source=UnderwaterPuzzle&utm_medium=start
TCP: Interfaces\{0DBBCB3D-A807-4577-9FC0-5154F210ECF1}: NameServer = 62.84.128.6,62.84.132.6
TCP: Interfaces\{AE66307A-458D-46E2-96BF-784F0D7E1A72}: NameServer = 62.77.67.2,62.84.128.6
TCP: Interfaces\{F6A00A8E-B78D-4637-85C2-CDDD12330B7C}: NameServer = 62.77.67.2,62.84.128.6
FF - ProfilePath - c:\documents and settings\Milanek\Data aplikací\Mozilla\Firefox\Profiles\o10r0zdx.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-02 09:13
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2012-03-02 09:16:25
ComboFix-quarantined-files.txt 2012-03-02 08:16
ComboFix2.txt 2012-03-01 19:38
.
Před spuštěním: 8 937 238 528
Po spuštění: 9 321 738 240
.
- - End Of File - - 63A1595CD76F4EDD347D52BD74321E09

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:
klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\*.tmp not found.
c:\WINDOWS\System32\CONFIG.TMP moved successfully.
c:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP folder moved successfully.
c:\WINDOWS\A5B5A16D277A476B8F621029A2F23072.TMP folder moved successfully.
c:\WINDOWS\DXT5.tmp moved successfully.
c:\WINDOWS\DXT6.tmp moved successfully.
c:\WINDOWS\DXT7.tmp moved successfully.
c:\WINDOWS\DXT8.tmp moved successfully.
c:\WINDOWS\DXT9.tmp moved successfully.
c:\WINDOWS\DXTA.tmp moved successfully.
c:\WINDOWS\DXTB.tmp moved successfully.
c:\WINDOWS\DXTC.tmp moved successfully.
c:\WINDOWS\DXTD.tmp moved successfully.
c:\WINDOWS\NV29882992.TMP folder moved successfully.
c:\WINDOWS\SET3.tmp moved successfully.
c:\WINDOWS\SET4.tmp moved successfully.
c:\WINDOWS\SET8.tmp moved successfully.
c:\documents and settings\Milanek\Local Settings\Data aplikací\Conduit\Community Alerts\Log folder moved successfully.
c:\documents and settings\Milanek\Local Settings\Data aplikací\Conduit\Community Alerts folder moved successfully.
c:\documents and settings\Milanek\Local Settings\Data aplikací\Conduit folder moved successfully.
File/Folder c:\docume~1\Milanek\LOCALS~1\Temp\pohci13F.sys not found.
========== SERVICES/DRIVERS ==========
Service pohci13F stopped successfully!
Service pohci13F deleted successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Milanek
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 246095 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 257377221 bytes
->Google Chrome cache emptied: 229307883 bytes
->Flash cache emptied: 16961 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 465,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 03032012_083127

Files moved on Reboot...

Registry entries deleted on Reboot...

Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Pak dej vědět jaký je stav PC.

pc se zda byt v poradku,jen vcera trvalo vypinani cca hodinu,pak jsem musel odejit tak jsem pc vypl hlavnim vypinacem....stale byla modra obrazovka z hlaskou "vypinani".dekuji moc za vasi pomoc.

tutamilan píše:pc se zda byt v poradku,jen vcera trvalo vypinani cca hodinu,pak jsem musel odejit tak jsem pc vypl hlavnim vypinacem....stale byla modra obrazovka z hlaskou "vypinani"

a další vypnutí už bylo v pořádku ?

dalsi bylo v poradku,ale pred par minutama jsem chtel opet vypnout pc a opet dlouhe cekani a vypinani se opet nedovyplo.muze to byt problem s nejakym previtem?

Spusť skener Cure It podle TOHOTO návodu

po skončení skenu chci sem výsledky.

(Upozornění je úchylně pomalý a je zapotřebí ho sledovat občas se na něco ptá)

omlouvam se za zdrzeni,byl jsem mimo domov.

vysledny log z CureIT mi sem nejde vlozit,jelikoz ma pres pul milionu znaku a povoleny pocet znaku tady na foru je 80000.muzu vam zkopirovat treba jen nekterou cast?zkusim zatim zaverecne statistiky:


Statistika prohledávání
-----------------------------------------------------------------------------
Zkontrolováno: 8017
Infikovano: 0
Modifikaci: 0
Podezřelé: 0
Adware: 0
Dialery: 0
Joke: 0
Riskware: 0
Hacktool: 0
Vyléčen: 0
Smazán: 0
Přejmenován: 0
Přesunut: 0
Vynechán: 0
Rychlost prohledávání: 2915 Kb/s
Doba prohledávání: 0:21:30
-----------------------------------------------------------------------------

=============================================================================
Celková statistika sezení
=============================================================================
Zkontrolováno: 8018
Infikovano: 0
Modifikaci: 0
Podezřelé: 0
Adware: 0
Dialery: 0
Joke: 0
Riskware: 0
Hacktool: 0
Vyléčen: 0
Smazán: 0
Přejmenován: 0
Přesunut: 0
Vynechán: 0
Rychlost prohledávání: 2856 Kb/s
Doba prohledávání: 0:21:57
=============================================================================