VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Karel Růžička at 2012-05-11 15:25:08
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 2 GB (2%) free of 76 GB
Total RAM: 1023 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:25:39, on 11.5.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Opera\opera.exe
Q:\Tor Browser\App\vidalia.exe
Q:\Tor Browser\App\tor.exe
Q:\Tor Browser\FirefoxPortable\App\Firefox\tbb-firefox.exe
Q:\PidginPortable\PidginPortable.exe
Q:\PidginPortable\App\Pidgin\pidgin-portable.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\Eraser\Eraser.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Documents and Settings\Karel Růžička\Local Settings\Data aplikací\Opera\Opera\temporary_downloads\RSIT.exe
C:\Program Files\trend micro\Karel Růžička.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.garena.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.6\youtubedownloaderToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.6\youtubedownloaderToolbarIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.6\youtubedownloaderToolbarIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5879310140
O17 - HKLM\System\CCS\Services\Tcpip\..\{98FFBABD-DFB2-44BE-A8A5-891EF483E715}: NameServer = 94.142.233.120,94.142.233.140
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5855 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Karel Růžička\Data aplikací\Mozilla\Firefox\Profiles\2g2upvb0.default

prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, jqs@sun.com:1.0, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.7, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
prefs.js - "keyword.URL" - "http://search.yahoo.com/search?fr=green ... =937811&p="

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.235 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@idsoftware.com/QuakeLive]
"Description"=
"Path"=C:\Documents and Settings\All Users\Data aplikací\id Software\QuakeLive\npquakezero.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-14 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-04-14 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436a-86E4-9690573BEE8A}]
YouTube Downloader Toolbar - C:\Program Files\YouTube Downloader Toolbar\IE\5.6\youtubedownloaderToolbarIE.dll [2012-04-23 1124704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-03-07 1003704]
{F3FEE66E-E034-436a-86E4-9690573BEE8A} - YouTube Downloader Toolbar - C:\Program Files\YouTube Downloader Toolbar\IE\5.6\youtubedownloaderToolbarIE.dll [2012-04-23 1124704]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-03-07 4241512]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-08-15 57344]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
""= []
"SearchSettings"=C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe [2012-04-23 983904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-04-04 35736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
C:\WINDOWS\AGRSMMSG.exe [2002-09-25 87751]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
C:\PROGRA~1\Eraser\Eraser.exe [2010-11-04 980368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2011-06-15 307200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe [2012-04-23 983904]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-01-07 253672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia]
C:\Program Files\Vidalia Bridge Bundle\Vidalia\vidalia.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VPNReactor]
;C:\Program Files\VPNReactor\VPNReactor.exe -hide []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^raid_tool.exe.lnk]
C:\PROGRA~1\VIA\RAID\RAID_T~1.EXE [2003-08-05 561152]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\OperaTor-3.5\OperaTor\Opera\opera.exe"="C:\Program Files\OperaTor-3.5\OperaTor\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Tor Browser\App\tor.exe"="C:\Program Files\Tor Browser\App\tor.exe:*:Enabled:tor"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Hry\BF1942+ex\BF1942.exe"="C:\Hry\BF1942+ex\BF1942.exe:*:Enabled:BF1942"
"C:\Program Files\Vidalia Bridge Bundle\Tor\tor.exe"="C:\Program Files\Vidalia Bridge Bundle\Tor\tor.exe:*:Enabled:tor"
"C:\Hry\Warhammer.exe"="C:\Hry\Warhammer.exe:*:Enabled:Warhammer®: Mark of Chaos™"
"C:\Program Files\Pidgin\pidgin.exe"="C:\Program Files\Pidgin\pidgin.exe:*:Enabled:Pidgin"
"C:\Program Files\mIRC 6.15\mIRC\mirc.exe"="C:\Program Files\mIRC 6.15\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Hry\Quake III Arena\quake3.exe"="C:\Hry\Quake III Arena\quake3.exe:*:Enabled:quake3"
"C:\Hry\heroes V\bin\H5_Game.exe"="C:\Hry\heroes V\bin\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\Hry\Q3 arena\quake_3_Arena\Quake3\quake3.exe"="C:\Hry\Q3 arena\quake_3_Arena\Quake3\quake3.exe:*:Enabled:quake3"
"C:\Documents and Settings\Karel Růžička\Plocha\Tor Browser\App\tor.exe"="C:\Documents and Settings\Karel Růžička\Plocha\Tor Browser\App\tor.exe:*:Enabled:tor"
"J:\Tor Browser\App\tor.exe"="J:\Tor Browser\App\tor.exe:*:Enabled:tor"
"C:\Program Files\Vidalia Relay Bundle\Tor\tor.exe"="C:\Program Files\Vidalia Relay Bundle\Tor\tor.exe:*:Enabled:tor"
"C:\Hry\TM\PC-0P-16-03 (Pc-0p-16-03) - TmNationsForever\TmForever.exe"="C:\Hry\TM\PC-0P-16-03 (Pc-0p-16-03) - TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"J:\TOR\Tor Browser\App\tor.exe"="J:\TOR\Tor Browser\App\tor.exe:*:Enabled:tor"
"C:\Hry\COD1\Call of Duty\CoDMP.exe"="C:\Hry\COD1\Call of Duty\CoDMP.exe:*:Enabled:CoDMP"
"C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\wolfcamql7.5\wolfcamql.exe"="C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\wolfcamql7.5\wolfcamql.exe:*:Enabled:wolfcamql"
"C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\baseq3\wolfcamql7.5\wolfcamql.exe"="C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\baseq3\wolfcamql7.5\wolfcamql.exe:*:Enabled:wolfcamql"
"C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\baseq3\wolfcamql7.5\wolfcamql7.5\wolfcamql.exe"="C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\baseq3\wolfcamql7.5\wolfcamql7.5\wolfcamql.exe:*:Enabled:wolfcamql"
"C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\wolfcamql7.5\wolfcamql.exe"="C:\Documents and Settings\Karel Růžička\Data aplikací\id Software\quakelive\wolfcamql7.5\wolfcamql.exe:*:Enabled:wolfcamql"
"C:\Program Files\Microsoft Games\Rise of Nations\thrones.exe"="C:\Program Files\Microsoft Games\Rise of Nations\thrones.exe:*:Enabled:Rise of Nations"
"C:\Program Files\xchat\xchat.exe"="C:\Program Files\xchat\xchat.exe:*:Enabled:XChat IRC Client"
"Q:\Tor Browser\App\tor.exe"="Q:\Tor Browser\App\tor.exe:*:Enabled:tor"
"Q:\xChat\xchat.exe"="Q:\xChat\xchat.exe:*:Enabled:XChat IRC Client"
"C:\Hry\Warcraft 3\Warcraft III.exe"="C:\Hry\Warcraft 3\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Hry\Warcraft 3\gproxy.exe"="C:\Hry\Warcraft 3\gproxy.exe:*:Enabled:gproxy Application"
"C:\Hry\Warcraft 3\war3.exe"="C:\Hry\Warcraft 3\war3.exe:*:Enabled:Warcraft III"
"C:\Hry\SSam-Second Encounter\Bin\SeriousSam.exe"="C:\Hry\SSam-Second Encounter\Bin\SeriousSam.exe:*:Enabled:SeriousSam"
"C:\Hry\SSam- First Encounter\Bin\SeriousSam.exe"="C:\Hry\SSam- First Encounter\Bin\SeriousSam.exe:*:Enabled:SeriousSam"
"C:\Hry\Warcraft 3\Garena\Garena.exe"="C:\Hry\Warcraft 3\Garena\Garena.exe:*:Enabled:Garena"
"C:\Hry\Warcraft 3\Garena plus\Room\garena_room.exe"="C:\Hry\Warcraft 3\Garena plus\Room\garena_room.exe:*:Enabled:Garena"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=serwvdrv.dll
"wave1"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-05-11 15:25:11 ----D---- C:\Program Files\trend micro
2012-05-11 15:25:08 ----D---- C:\rsit
2012-05-11 15:11:36 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\Application Updater
2012-05-02 22:26:32 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\Search Settings
2012-05-02 22:26:10 ----D---- C:\Program Files\YouTube Downloader Toolbar
2012-05-02 22:26:10 ----D---- C:\Program Files\Common Files\Spigot
2012-05-01 10:33:13 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\GarenaPlus
2012-05-01 10:30:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\GarenaMessenger
2012-04-27 17:56:16 ----A---- C:\Documents and Settings\Karel Růžička\Data aplikací\room_v3.dat
2012-04-20 12:10:34 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\CasaPortale.de
2012-04-20 11:48:39 ----D---- C:\Program Files\PosteRazor

======List of files/folders modified in the last 1 month======

2012-05-11 15:25:16 ----D---- C:\WINDOWS\Prefetch
2012-05-11 15:25:11 ----RD---- C:\Program Files
2012-05-11 15:23:20 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\uTorrent
2012-05-11 13:56:05 ----D---- C:\WINDOWS\Temp
2012-05-11 09:50:03 ----D---- C:\WINDOWS
2012-05-11 09:49:51 ----D---- C:\WINDOWS\system32\LogFiles
2012-05-11 00:47:12 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-05-11 00:25:09 ----D---- C:\WINDOWS\Debug
2012-05-10 14:45:21 ----D---- C:\WINDOWS\system32\CatRoot2
2012-05-10 14:10:02 ----RSD---- C:\WINDOWS\assembly
2012-05-10 14:10:02 ----D---- C:\WINDOWS\Microsoft.NET
2012-05-10 10:00:04 ----D---- C:\WINDOWS\system32
2012-05-09 23:24:55 ----HD---- C:\WINDOWS\inf
2012-05-09 23:24:50 ----D---- C:\WINDOWS\WinSxS
2012-05-09 23:24:18 ----SHD---- C:\WINDOWS\Installer
2012-05-09 23:24:00 ----D---- C:\WINDOWS\system32\XPSViewer
2012-05-09 23:18:43 ----A---- C:\WINDOWS\system32\MRT.exe
2012-05-09 23:17:42 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-05-09 23:02:07 ----HD---- C:\WINDOWS\$hf_mig$
2012-05-09 22:47:53 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-05-09 22:32:35 ----D---- C:\Hry
2012-05-09 17:45:01 ----D---- C:\Documents and Settings\Karel Růžička\Data aplikací\TS3Client
2012-05-05 17:34:46 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-05-02 22:26:10 ----D---- C:\Program Files\Common Files
2012-05-02 14:02:51 ----D---- C:\WINDOWS\network diagnostic
2012-05-01 12:54:04 ----D---- C:\Program Files\TeamSpeak 3 Client
2012-05-01 10:03:54 ----D---- C:\WINDOWS\SxsCaPendDel

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\System32\DRIVERS\uagp35.sys [2008-04-13 44672]
R0 viasraid;viasraid; C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-08-05 77056]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-03-07 24920]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2012-03-07 35672]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-03-07 612184]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-03-07 337880]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-03-07 53848]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2011-06-15 60156]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2011-09-26 231376]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-03-07 20696]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-03-07 95704]
R3 AgereSoftModem;Microcom InPorte Home; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2002-09-25 1141248]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-08-14 404736]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-08-15 462684]
R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MouseCap;MouseCapture Driver; C:\WINDOWS\System32\Drivers\MouseCap.sys [2005-08-08 6640]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS\System32\Drivers\vulfnth.sys [2002-10-24 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS\System32\Drivers\vulfntr.sys [2003-05-24 11392]
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Hry\Warcraft 3\Garena plus\Room\safedrv.sys []
S3 Moufiltr;Mouse Test Driver; C:\WINDOWS\system32\DRIVERS\Moufiltr.sys [2005-08-06 9661]
S3 rtl8139;Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\R8139n51.SYS [2002-10-04 46976]
S3 tap0901;TAP-Win32 Adapter V9 for VPNReactor; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2010-11-08 26112]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-03-07 44768]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-04-14 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-05-29 66872]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravím, tohle fixni v HJT :

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

HJT najdeš zde :

C:\Program Files\trend micro\Karel Růžička.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:
klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder C:\*.tmp not found.
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
File/Folder C:\Program Files\Common Files\Spigot not found.
File/Folder C:\Documents and Settings\Karel Růžička\Data aplikací\Search Settings not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Karel Růžička
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 19807618 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 32072869 bytes
->Opera cache emptied: 955958 bytes
->Flash cache emptied: 521 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 81989442 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33728 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 129,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 05122012_235439

Files moved on Reboot...
File C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

Registry entries deleted on Reboot...

Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

ComboFix 12-05-14.02 - Karel Růžička 15.05.2012 23:34:09.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.632 [GMT 2:00]
Spuštěný z: c:\documents and settings\Karel R¨×iŔka\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\YouTube Downloader Toolbar\IE\5.6\yoUTubedownloadertoolbarie.dll
c:\windows\system32\auto.exe
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\dllcache\wmpvis.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-15 do 2012-05-15 )))))))))))))))))))))))))))))))
.
.
2012-05-15 21:02 . 2012-05-15 21:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Sony Corporation
2012-05-15 21:02 . 2012-05-15 21:02 -------- d-----w- c:\documents and settings\Karel Růžička\Data aplikací\Sony Corporation
2012-05-15 21:01 . 2012-05-15 21:01 -------- d-----w- c:\documents and settings\Karel Růžička\Local Settings\Data aplikací\kinoma
2012-05-15 20:57 . 2012-05-15 20:58 -------- d-----w- c:\documents and settings\Karel Růžička\Local Settings\Data aplikací\Sony Corporation
2012-05-15 20:57 . 2012-05-15 20:57 -------- d-----w- c:\program files\Sony
2012-05-15 20:57 . 2012-05-15 20:57 -------- d-----w- c:\program files\Common Files\Sony Shared
2012-05-11 13:25 . 2012-05-12 21:41 -------- d-----w- c:\program files\trend micro
2012-05-11 13:11 . 2012-05-11 13:11 -------- d-----w- c:\documents and settings\Karel Růžička\Data aplikací\Application Updater
2012-05-02 20:26 . 2012-05-02 20:26 -------- d-----w- c:\program files\YouTube Downloader Toolbar
2012-05-01 08:33 . 2012-05-14 14:30 -------- d-----w- c:\documents and settings\Karel Růžička\Data aplikací\GarenaPlus
2012-05-01 08:30 . 2012-05-14 14:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\GarenaMessenger
2012-04-20 10:10 . 2012-04-20 10:10 -------- d-----w- c:\documents and settings\Karel Růžička\Data aplikací\CasaPortale.de
2012-04-20 09:48 . 2012-04-20 09:48 -------- d-----w- c:\program files\PosteRazor
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 15:34 . 2012-04-06 08:20 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 15:34 . 2011-05-20 10:43 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:55 . 2002-09-20 17:12 2071296 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:55 . 2002-09-20 17:41 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:55 . 2002-09-20 17:12 2194816 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-07 00:15 . 2011-05-20 12:02 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:15 . 2011-05-20 12:02 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-07 00:03 . 2011-05-20 12:02 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:03 . 2011-05-20 12:02 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2011-05-20 12:02 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-07 00:01 . 2011-05-20 12:02 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2011-05-20 12:02 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-03-07 00:01 . 2011-05-20 12:02 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-03-07 00:01 . 2011-05-20 12:02 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-06 23:58 . 2011-05-20 12:02 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-03-01 10:59 . 2002-09-20 18:05 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-03-01 10:59 . 2002-09-20 18:05 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 10:59 . 2002-09-20 18:04 43520 ------w- c:\windows\system32\licmgr10.dll
2012-02-29 14:10 . 2002-09-20 18:03 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2001-10-25 13:00 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-08-17 22:44 385024 ------w- c:\windows\system32\html.iec
2011-10-04 17:00 . 2011-06-28 15:00 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 57344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"Reader Application Helper"="c:\program files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-01-31 892928]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^raid_tool.exe.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\raid_tool.exe.lnk
backup=c:\windows\pss\raid_tool.exe.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-04-04 05:53 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2002-09-25 10:44 87751 ----a-w- c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2010-11-04 20:09 980368 ----a-w- c:\progra~1\Eraser\Eraser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaMessenger]
2012-04-11 02:53 6241624 ----a-w- c:\hry\Warcraft 3\Garena plus\GarenaMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-03 03:46 1630208 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2011-06-15 06:19 307200 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-01-07 11:12 253672 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Hry\\BF1942+ex\\BF1942.exe"=
"c:\\Hry\\Quake III Arena\\quake3.exe"=
"c:\\Hry\\heroes V\\bin\\H5_Game.exe"=
"c:\\Hry\\Q3 arena\\quake_3_Arena\\Quake3\\quake3.exe"=
"c:\\Program Files\\Vidalia Relay Bundle\\Tor\\tor.exe"=
"c:\\Hry\\TM\\PC-0P-16-03 (Pc-0p-16-03) - TmNationsForever\\TmForever.exe"=
"c:\\Documents and Settings\\Karel Růžička\\Data aplikací\\id Software\\quakelive\\wolfcamql7.5\\wolfcamql.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Hry\\Warcraft 3\\Warcraft III.exe"=
"c:\\Hry\\Warcraft 3\\gproxy.exe"=
"c:\\Hry\\Warcraft 3\\war3.exe"=
"c:\\Hry\\SSam-Second Encounter\\Bin\\SeriousSam.exe"=
"c:\\Hry\\SSam- First Encounter\\Bin\\SeriousSam.exe"=
"c:\\Hry\\Warcraft 3\\Garena\\Garena.exe"=
"c:\\Hry\\Warcraft 3\\Garena plus\\Room\\garena_room.exe"=
.
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [20.5.2011 14:38 77056]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [20.5.2011 14:02 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [20.5.2011 14:02 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [20.5.2011 14:02 20696]
R3 MouseCap;MouseCapture Driver;c:\windows\system32\drivers\MouseCap.sys [8.8.2005 14:44 6640]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6.4.2012 10:20 257696]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\hry\Warcraft 3\Garena plus\Room\safedrv.sys --> c:\hry\Warcraft 3\Garena plus\Room\safedrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 15:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.garena.com/
TCP: Interfaces\{98FFBABD-DFB2-44BE-A8A5-891EF483E715}: NameServer = 94.142.233.120,94.142.233.140
FF - ProfilePath - c:\documents and settings\Karel Růžička\Data aplikací\Mozilla\Firefox\Profiles\2g2upvb0.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-Vidalia - c:\program files\Vidalia Bridge Bundle\Vidalia\vidalia.exe
MSConfigStartUp-VPNReactor - c:\program files\VPNReactor\VPNReactor.exe
AddRemove-Adobe Photoshop 7.0 - R:\Klíče
AddRemove-xchat - q:\xchat\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-15 23:46
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2012-05-15 23:51:28
ComboFix-quarantined-files.txt 2012-05-15 21:51
.
Před spuštěním: 1 501 532 160
Po spuštění: 1 457 872 896
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 3CE47B38C232F7AF9471CF9875F9C07D

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

šlape v pohodě, ale ze začátku mi to nechtělo odinstalovat ComboFix, až když jsem ho notmálně spustil, řekl mi že už je neplatná verze a zavřel se a až pak příkaz fungoval.

heges píše:šlape v pohodě

V tom případě je to z mé strany vše.