VIRY.CZ

Zdravím, rodičom sa dnes podarilo nachytať nejaký milý adware kt. sa pustí fullscreen ihneď po zapnutí PC a človeka nepustí ani na plochu. Naštastie sa mi podarilo zistiť, že pri vypnutom internete sa tento program nespúšta, tak som mohol urobiť RSIT log.

Prosím o jeho kontrolu a vopred ďakujem.
L.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Maťko at 2012-11-11 21:29:20
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (17%) free of 46 GB
Total RAM: 1023 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:29:23, on 11. 11. 2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
C:\Program Files\EIZO\ScreenSlicer\ESCSlicer.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Maťko\Desktop\RSIT.exe
C:\Documents and Settings\Maťko\Desktop\Maťko.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [ScreenManager Pro for LCD (DDCCI)] C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Startup: VNC Server.lnk = C:\Program Files\RealVNC\VNC4\winvnc4.exe
O4 - Global Startup: EIZO ScreenSlicer.lnk = ?
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Locate Spot on Map by GPS - C:\Program Files\Opanda\IExif 2.3\IExifMap.htm
O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.3\IExifCom.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe LM Service AdobeAlerter (AdobeAlerter) - Unknown owner - C:\WINDOWS\system32\wpv121238436518.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LcdctrlSvc - EIZO NANAO CORPORATION - C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8926 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk/"
prefs.js - "extensions.enabledItems" - "jqs@sun.com:1.0, {239c61a8-e55f-11db-8314-0800200c9a66}:2.1.4, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.23, kempelton_large-fx@arvidaxelsson.se:3.2.1, {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91"

"bkmrksync@nokia.com"=C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@bittorrent.com/BitTorrentDNA]
"Description"=Delivery Network Acceleration by BitTorrent™
"Path"=C:\Program Files\DNA\plugins\npbtdna.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1]
"Description"=Yahoo! activeX Plug-in Bridge
"Path"=C:\Program Files\Yahoo!\Common\npyaxmpb.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
npdeploytk.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Documents and Settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\extensions\
kempelton_large-fx@arvidaxelsson.se
{07b2a769-ed19-4483-87ce-c643914c81bb}
{1AF3FC34-0725-4485-A939-6B40EB7CA96A}
{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 853672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-03-27 53248]
"razer"=C:\Program Files\Razer\razerhid.exe [2005-05-17 147456]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-06-29 7573504]
"nwiz"=nwiz.exe /install []
"SW20"=C:\WINDOWS\system32\sw20.exe [2006-06-29 208896]
"SW24"=C:\WINDOWS\system32\sw24.exe [2006-06-29 69632]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-06-29 86016]
"PRONoMgr.exe"=C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe [2003-03-11 86016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-11-10 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-07-03 499608]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5.5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"=C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe [2010-02-18 7421952]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2012-10-23 5074384]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-03-18 630784]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Skype"=C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe [2004-08-04 45992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
C:\Program Files\FileZilla Server\FileZilla Server Interface.exe [2009-12-31 1208832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScreenManager Pro for LCD]
C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
EIZO ScreenSlicer.lnk - C:\WINDOWS\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Maťko\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe
VNC Server.lnk - C:\Program Files\RealVNC\VNC4\winvnc4.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1\Miranda IM\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\Skusobna\Miranda IM\miranda32.exe"="D:\Install\Moja Miranda\Skusobna\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\RealVNC\VNC4\winvnc4.exe"="C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:VNC Server Free Edition for Win32"
"C:\Program Files\RealVNC\VNC4\vncviewer.exe"="C:\Program Files\RealVNC\VNC4\vncviewer.exe:*:Enabled:VNC Viewer Free Edition for Win32"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\^Zaloha 8.0.0.1 - NS\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\^Zaloha 8.0.0.1 - NS\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\L3d.2008\miranda32.exe"="D:\Install\Moja Miranda\L3d.2008\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\SKINTEST\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\SKINTEST\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\Opera\Opera.exe"="C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser"
"F:\F -Moje dokumenty\Matúš\Install\Miranda 8.0\miranda32.exe"="F:\F -Moje dokumenty\Matúš\Install\Miranda 8.0\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi"
"D:\mIRC\mirc.exe"="D:\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster.exe"="F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster.exe:*:Enabled:Ratio Master"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"F:\F -Moje dokumenty\Matúš\Install\Miranda 0.9 # 1 Alfa\miranda32.exe"="F:\F -Moje dokumenty\Matúš\Install\Miranda 0.9 # 1 Alfa\miranda32.exe:*:Enabled:Miranda IM"
"F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster-vs.exe"="F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster-vs.exe:*:Enabled:Ratio Master"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"F:\F -Moje dokumenty\Miranda 0.9 # 1 Alfa\miranda32.exe"="F:\F -Moje dokumenty\Miranda 0.9 # 1 Alfa\miranda32.exe:*:Enabled:Miranda IM"
"F:\F -Moje dokumenty\Matúš\Install\Warcraft III\war3.exe"="F:\F -Moje dokumenty\Matúš\Install\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Documents and Settings\Maťko\Desktop\Lordiik\WaaaghTV\wtvClient.exe"="C:\Documents and Settings\Maťko\Desktop\Lordiik\WaaaghTV\wtvClient.exe:*:Enabled:wtvClient"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i420vfw.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.ACDV"=ACDV.dll
"VIDC.MPG4"=mpg4c32.dll
"VIDC.MP42"=mpg4c32.dll
"vidc.yv12"=yv12vfw.dll
"msacm.lhacm"=lhacm.acm

======List of files/folders created in the last 3 months======

2012-11-11 17:42:46 ----D---- C:\Documents and Settings\Maťko\Application Data\ESET
2012-11-11 17:40:49 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfwtdi.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfwndis.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfw.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\ehdrv.sys
2012-10-08 08:21:06 ----A---- C:\WINDOWS\system32\drivers\eamon.sys

======List of files/folders modified in the last 3 months======

2012-11-24 14:30:11 ----D---- C:\Documents and Settings\Maťko\Application Data\Media Player Classic
2012-11-11 20:38:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-11-11 20:21:29 ----D---- C:\WINDOWS\Temp
2012-11-11 19:13:02 ----D---- C:\WINDOWS
2012-11-11 19:12:45 ----HD---- C:\WINDOWS\inf
2012-11-11 18:59:19 ----D---- C:\WINDOWS\system32
2012-11-11 18:48:24 ----D---- C:\WINDOWS\Prefetch
2012-11-11 17:42:34 ----SHD---- C:\WINDOWS\Installer
2012-11-11 17:42:04 ----D---- C:\WINDOWS\system32\drivers
2012-11-11 17:41:43 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-11 17:40:49 ----D---- C:\Program Files\ESET
2012-10-31 17:17:33 ----A---- C:\WINDOWS\NeroDigital.ini
2012-10-31 17:17:21 ----D---- C:\Documents and Settings\Maťko\Application Data\uTorrent
2012-10-28 10:53:16 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
R0 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2004-04-30 5248]
R0 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-03 42368]
R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-02-18 43872]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R1 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2012-10-08 159832]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2012-10-08 121216]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2012-10-08 62512]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-07-07 56108]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2012-10-08 149568]
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2004-08-03 87424]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver; \??\C:\WINDOWS\system32\drivers\DDCDrv.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-04-01 719052]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2012-10-08 40376]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-05-21 25280]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-06-29 3663040]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2006-11-24 10368]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RT61;RT61 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2010-04-02 520800]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-07-16 70400]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-04-19 20608]
R3 vncmirror;vncmirror; C:\WINDOWS\system32\DRIVERS\vncmirror.sys [2010-04-09 4608]
S3 catchme;catchme; \??\C:\DOCUME~1\MAKO~1\LOCALS~1\Temp\catchme.sys []
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver; C:\WINDOWS\system32\DRIVERS\CnxEtP.sys []
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver; C:\WINDOWS\system32\DRIVERS\CnxEtU.sys []
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver; C:\WINDOWS\system32\DRIVERS\CnxTgNP.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys []
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys []
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys []
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys []
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys []
S3 MSICPL;MSICPL; \??\E:\install4\MSICPL.sys []
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2004-08-03 22016]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 npkcrypt;npkcrypt; \??\F:\Instal\Lineage II\system\npkcrypt.sys []
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 Razerlow;Razerlow USB Filter Driver; C:\WINDOWS\System32\Drivers\Razerlow.sys [2005-04-24 13225]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys []
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2007-05-02 83592]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2007-05-02 15112]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2007-05-02 109704]
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:\WINDOWS\system32\DRIVERS\irstusb.sys [2001-08-17 26624]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2012-10-23 1329304]
R2 FileZilla Server;FileZilla Server FTP server; C:\Program Files\FileZilla Server\FileZilla Server.exe [2009-12-31 703488]
R2 Irmon;Infrared Monitor; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 LcdctrlSvc;LcdctrlSvc; C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [2010-02-16 90112]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-06-29 143426]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-13 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-06-17 189072]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
R3 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2010-04-09 1484152]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter; C:\WINDOWS\system32\wpv121238436518.exe run []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-11-23 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-09-22 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-07-31 720896]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [2003-03-03 143360]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

-----------------EOF-----------------=

Zdravim

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Zdravím, ďakujem za skorú odpoveď
Po pustení Combofixu kontrola zlyhá pri bode: "Attempting to create a new System Restore point" a vyhodí hlášku:
"This machine does not have Microsoft Windows recovery console installed....Click Yes to have ComboFix download/install it. NOTE: The requires an active internet connection". No problém je ten, že akonáhle pripojím internet. pustí sa daný AdWare a už s PC nič neurobím.

EDIT: Dal som "Nie" a vyzerá to tak, že kontrola ComboFix-om ďalej pokračuje. Keď sa ukončí, vložím sem log.

Prikladám aspoň log z RKill:

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 11/11/2012 10:00:57 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe (PID: 2016) [UP-HEUR]
* C:\WINDOWS\system32\nvsvc32.exe (PID: 984) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* System Restore Disabled

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = dword:00000001

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* System Restore Service (srservice) is not Running.
Startup Type set to: Automatic

* System Restore Filter Driver (sr) is not Running.
Startup Type set to: Disabled

* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\drivers\atapi.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\atapi.sys : 95 360 : 08/03/2004 11:59 PM : cdfe4411a69c224bd1d11b2da92dac51 [Pos Repl]
+-> C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys : 95 360 : 08/04/2004 02:00 PM : cdfe4411a69c224bd1d11b2da92dac51 [Pos Repl]

* C:\WINDOWS\System32\UxTheme.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\uxtheme.dll : 218 624 : 08/07/2004 11:36 AM : 222c0432d24b67498c62676f0eeedce2 [Pos Repl]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 11/11/2012 10:01:59 PM
Execution time: 0 hours(s), 1 minute(s), and 1 seconds(s)

Prikladám ešte log z ComboFixu, ospravedlňujem sa za Double-post, ale chcel som aby to bolo prehľadné.

ComboFix 12-11-10.01 - Maťko . 11. 2012 22:13:32.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.532 [GMT 1:00]
Running from: c:\documents and settings\MaŁko\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
c:\windows\system32\MUI\041b\tourstart.exe
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Created from 2012-10-11 to 2012-11-11 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 21:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-07-03 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WAR.3.TFT
"5900:TCP"= 5900:TCP:VNC
"21:TCP"= 21:TCP:21
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Skype - c:\documents and settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
MSConfigStartUp-ScreenManager Pro for LCD - c:\program files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
AddRemove-Money S3 - c:\program files\CIGLER SOFTWARE\Common Files\Money S3\Setup\Uninst.exe
AddRemove-Steam App 10 - c:\program files\Valve\Steam\steam.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-11 22:27
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2984)
c:\program files\RocketDock\RocketDock.dll
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\EIZO\ScreenSlicer\ESCSlicer.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Razer\razerofa.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2012-11-11 22:33:45 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-11 21:33
.
Pre-Run: 12 381 089 792 bytes free
Post-Run: 12 403 523 584 bytes free
.
- - End Of File - - 6314AC7904060215C907FCCD7397E4DB

Rozdeleni do dvou postu je v poradku

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  FCopy::
  C:\WINDOWS\system32\dllcache\uxtheme.dll | C:\WINDOWS\System32\UxTheme.dll
  c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys | C:\WINDOWS\system32\dllcache\atapi.sys
  
  Collect::
  c:\windows\meta4.exe
  c:\windows\MOTA113.exe
  c:\windows\x2.64.exe
  c:\windows\system32\avisynth.dll
  c:\windows\system32\AVSredirect.dll
  c:\windows\system32\cygwin1.dll
  c:\windows\system32\cygz.dll
  c:\windows\system32\i420vfw.dll
  c:\windows\system32\Smab.dll
  c:\windows\system32\x.264.exe
  c:\windows\system32\yv12vfw.dll
  
  Registry::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NeroFilterCheck"=-
  "SunJavaUpdateSched"=-
  "QuickTime Task"=-
  "iTunesHelper"=-
  "AdobeAAMUpdater-1.0"=-
  "SwitchBoard"=-
  "AdobeCS5.5ServiceManager"=-
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "6112:TCP"=-
  "5900:TCP"=-
  "21:TCP"=-
  
  File::
  c:\documents and settings\Maťko\Start Menu\Programs\Startup\Adobe Gamma.lnk
  c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
  c:\windows\Tasks\AppleSoftwareUpdate.job
  
  Driver:
  SetupNTGLM7X
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Dobrý deň, ospravedlňujem sa za neskorú reakciu.
Tu je log z ComboFixu:

ComboFix 12-11-10.01 - Maťko . 11. 2012 16:38:34.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.537 [GMT 1:00]
Running from: c:\documents and settings\MaŁko\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\MaŁko\Desktop\CFScript.txt.txt
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2012-10-16 to 2012-11-16 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-07-03 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WAR.3.TFT
"5900:TCP"= 5900:TCP:VNC
"21:TCP"= 21:TCP:21
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-16 16:52
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1924)
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
Completion time: 2012-11-16 16:55:57
ComboFix-quarantined-files.txt 2012-11-16 15:55
ComboFix2.txt 2012-11-11 21:33
.
Pre-Run: 12 232 613 888 bytes free
Post-Run: 13 adresárov, 12 243 673 088 voľných bajtov
.
- - End Of File - - 1A586ACCC25E8C42870FD5D3EAC1DBE5

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:28 on 16/11/2012 (Maťko)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
a347bus -> Disabled (Service running -> reboot required)
a347scsi -> Disabled (Service running -> reboot required)
Unable to read atapi.sys

A jeje, zas problemy ComboFixu (diakritika v nazvu uctu)

Dejte CF primo na c:\

Primo na c:\ vytvorte skript a pretahnete jej nad CF

Tak teda pokus číslo 2

ComboFix 12-11-10.01 - Maťko . 11. 2012 19:02:10.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.513 [GMT 1:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
FILE ::
"c:\documents and settings\Maťko\Start Menu\Programs\Startup\Adobe Gamma.lnk"
"c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job"
"c:\windows\Tasks\AppleSoftwareUpdate.job"
.
file zipped: c:\windows\meta4.exe
file zipped: c:\windows\MOTA113.exe
file zipped: c:\windows\system32\avisynth.dll
file zipped: c:\windows\system32\AVSredirect.dll
file zipped: c:\windows\system32\cygwin1.dll
file zipped: c:\windows\system32\cygz.dll
file zipped: c:\windows\system32\i420vfw.dll
file zipped: c:\windows\system32\Smab.dll
file zipped: c:\windows\system32\x.264.exe
file zipped: c:\windows\system32\yv12vfw.dll
file zipped: c:\windows\x2.64.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\system32\dllcache\uxtheme.dll --> c:\windows\System32\UxTheme.dll
c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys --> c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2012-10-16 to 2012-11-16 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-16 19:16
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1188)
c:\program files\RocketDock\RocketDock.dll
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SOUNDMAN.EXE
c:\program files\EIZO\ScreenSlicer\ESCSlicer.exe
c:\program files\Razer\razerofa.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2012-11-16 19:20:50 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-16 18:20
ComboFix2.txt 2012-11-16 15:55
ComboFix3.txt 2012-11-11 21:33
.
Pre-Run: 12 754 571 264 bytes free
Post-Run: 13 adresárov, 12 737 986 560 voľných bajtov
.
- - End Of File - - 10D36151889DCD9BF2AC2918679B2053
Upload was successful

Stahnete Avenger http://forum.viry.cz//viewtopic.php?f=11&t=19832

• Pokud pouzivate Win Vista ci W7, kliknete na Avenger pravym a dejte Run As Administrator ci Spustit jako spravce
• Po spusteni Vas program upozorni, ze vse co delate, delate na vlastni riziko - Dejte OK
• Po potvrzeni uz na Vas koukne hlavni okno, kam vlozite skript, ktery mate nize

• Kód: Vybrat vše

  Files to delete:
  c:\windows\meta4.exe
  c:\windows\MOTA113.exe
  c:\windows\x2.64.exe
  c:\windows\system32\avisynth.dll
  c:\windows\system32\AVSredirect.dll
  c:\windows\system32\cygwin1.dll
  c:\windows\system32\cygz.dll
  c:\windows\system32\i420vfw.dll
  c:\windows\system32\Smab.dll
  c:\windows\system32\x.264.exe
  c:\windows\system32\yv12vfw.dll
  

• Do ctverecku u Scan for rootkits a Automatically disable any rootkits found dejte fajecku
• Nyni uz kliknete na Execute a potvrdte Yes v nasledujicim okne - timto potvrdite spusteni skriptu
• Na otazku Reboot now odpovezte opet OK - timto se PC restartuje
• Po restartu by se mel otevrit poznamkovy blok s logem a jeho obsah vlozte sem. Pokud se tak nestane, naleznete pozadovany dokument v C:\avenger.txt

nger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\meta4.exe" deleted successfully.
File "c:\windows\MOTA113.exe" deleted successfully.
File "c:\windows\x2.64.exe" deleted successfully.
File "c:\windows\system32\avisynth.dll" deleted successfully.
File "c:\windows\system32\AVSredirect.dll" deleted successfully.
File "c:\windows\system32\cygwin1.dll" deleted successfully.
File "c:\windows\system32\cygz.dll" deleted successfully.
File "c:\windows\system32\i420vfw.dll" deleted successfully.
File "c:\windows\system32\Smab.dll" deleted successfully.
File "c:\windows\system32\x.264.exe" deleted successfully.
File "c:\windows\system32\yv12vfw.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.nger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\meta4.exe" deleted successfully.
File "c:\windows\MOTA113.exe" deleted successfully.
File "c:\windows\x2.64.exe" deleted successfully.
File "c:\windows\system32\avisynth.dll" deleted successfully.
File "c:\windows\system32\AVSredirect.dll" deleted successfully.
File "c:\windows\system32\cygwin1.dll" deleted successfully.
File "c:\windows\system32\cygz.dll" deleted successfully.
File "c:\windows\system32\i420vfw.dll" deleted successfully.
File "c:\windows\system32\Smab.dll" deleted successfully.
File "c:\windows\system32\x.264.exe" deleted successfully.
File "c:\windows\system32\yv12vfw.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Fajn, jak se chova PC

Už po prvom aplikovaní ComboFixu sa všetko javilo v poriadku, takže hádam je ten bordel preč

Ďakujem za pomoc

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

Veľmi pekne ďakujem