VIRY.CZ

TAk tam zase neco je Firewall uz jsem stahnul instaloval,ale zatim jsem se nejak nepopral s nastavenim,takze jsem ho prozatim odebral,byl jsem neviditelny pro P2P ,musim najit neco v CZ pro Vistu.Takze jestli se toho nekdo ujme budu rad. Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:18:00, on 9.12.2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ESET\nod32.exe
C:\Program Files\ESET\nod32kui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Jahn\AppData\Local\Temp\mexe.com
C:\Windows\system32\Taskmgr.exe
C:\Users\Jahn\Documents\Downloads\Programs\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: + &Mass Downloader: download this file - C:\Users\Jahn\AppData\Local\Temp\Rar$EX00.968\Crack\Add_Url.htm
O8 - Extra context menu item: + Mass Downloader: download &All files - C:\Users\Jahn\AppData\Local\Temp\Rar$EX00.968\Crack\Add_All.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Stáhnout obsah FLV videa s IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout Star Downloaderem - C:\Program Files\Star Downloader\sdie.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36534E61-5E6D-478D-A790-B3B0EE6AFFF0}: NameServer = 213.235.188.145,195.146.100.99
O17 - HKLM\System\CS1\Services\Tcpip\..\{36534E61-5E6D-478D-A790-B3B0EE6AFFF0}: NameServer = 213.235.188.145,195.146.100.99
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10044 bytes

Jeste toto : Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "spyware.imfmonitor Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "saminside Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "savingbot shopper Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "smitfraud Browser Hijacker" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "whenu.desktop toolbar Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "whenu.desktop toolbar Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "savenow Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Záznam "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" odkazuje na neplatný objekt ".gpx". Provedené akce: Nic nebylo provedeno.
Záznam "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" odkazuje na neplatný objekt ".ov2". Provedené akce: Nic nebylo provedeno.
Záznam "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" odkazuje na neplatný objekt ".xht". Provedené akce: Nic nebylo provedeno.
Záznam "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" odkazuje na neplatný objekt ".xhtml". Provedené akce: Nic nebylo provedeno.

Fixněte v HijackThis:


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O20 - AppInit_DLLs:

Jen zbytečnosti, chybí firewall.

MWAV jen neškodné zbytky po dříve vyléčené infekci a neplatné klíče.

diky.Firewal uz je stazeny jenom to nastaveni musim se s nim nejak poprat

Není zač!

Dobry vecer.
Poprosil bych osazenstvo fora o kontrolu logu.
Neco jsem asi chytil . Log z Hijck je cisty.Ale porad tam neco je
Dekuji za radu





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:18:24, on 21.2.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Seznam.cz\postak.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\WindowsMobile\WmdHost.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Windows\system32\Taskmgr.exe
C:\Windows\explorer.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Users\Shrek\AppData\Local\Temp\mexe.com
C:\Program Files\WinFast\WFDTV\DVBTAP.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Shrek\Documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Shrek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.2.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files\Seznam.cz\postak.exe" -s
O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Aktualizovat ESET licenci.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: Nastavení aplikace &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} (NetCamPlayerWeb11g Control) - http://213.211.35.82/img/NetCamPlayerWeb11g.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{579AF2F3-A3F3-433F-8CF1-FD5039655866}: NameServer = 213.235.188.145,77.48.100.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Uniblue DiskRescue - Uniblue - C:\Program Files\Uniblue\DiskRescue\UBDiskRescueSrv.exe
O23 - Service: Webcamera Plus Service - Ateksoft Company Ltd. - C:\Program Files\Ateksoft\WebCamera Plus\WebCamPlusSrv.exe

--
End of file - 8315 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore1ca5a76c95a800.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2964015881-2797028174-321826089-1000Core1ca5a765c0195de.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2964015881-2797028174-321826089-1000UA.job
C:\Windows\tasks\Launch 10118.job
C:\Windows\tasks\Launch 14601.job
C:\Windows\tasks\Launch 14699.job
C:\Windows\tasks\Launch 23009.job
C:\Windows\tasks\Launch 25318.job
C:\Windows\tasks\Launch 25409.job
C:\Windows\tasks\Launch 9772.job
C:\Windows\tasks\Uniblue DiskRescue 2009.job
C:\Windows\tasks\{D09084D1-0ECD-4EB0-B0A9-62828E47FF97}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2008-12-23 161200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll [2009-10-16 2101248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files\Seznam.cz\core.2.dll [2010-01-18 1098392]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2054360]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"WinFastDTV"=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]
"SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe [2009-10-20 111928]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2009-02-02 2745776]
"Seznam Postak"=C:\Program Files\Seznam.cz\postak.exe [2010-01-18 448664]
"WinFast Schedule"=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]
"Google Update"=C:\Users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-11 133104]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Aktualizovat ESET licenci.lnk - C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"ShutdownWithoutLogon"=1
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HideClock"=0
"NoResolveTrack"=1
"NoThumbnailCache"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoResolveTrack"=
"NoFileAssociate"=
"NoFind"=
"NoRun"=
"NoClose"=
"StartMenuLogoff"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-02-21 22:17:53 ----D---- C:\rsit
2010-02-20 17:25:04 ----HDC---- C:\ProgramData\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}
2010-02-20 16:59:03 ----D---- C:\ProgramData\DriverScanner
2010-02-20 16:55:14 ----HDC---- C:\ProgramData\{66E2F539-12B6-4870-A500-7689CDE75C5E}
2010-02-20 16:47:12 ----D---- C:\Windows\system32\ErrorLogs
2010-02-20 15:57:32 ----HDC---- C:\ProgramData\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}
2010-02-20 15:21:07 ----D---- C:\Program Files\Uniblue
2010-02-20 15:20:26 ----HDC---- C:\ProgramData\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
2010-02-20 13:55:02 ----D---- C:\Users\Shrek\AppData\Roaming\Uniblue
2010-02-20 13:47:26 ----D---- C:\Users\Shrek\AppData\Roaming\Malwarebytes
2010-02-20 13:47:13 ----D---- C:\ProgramData\Malwarebytes
2010-02-20 13:47:08 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-13 23:50:34 ----D---- C:\Program Files\Ateksoft
2010-02-13 08:20:11 ----D---- C:\Program Files\Trend Micro
2010-02-09 22:19:41 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-09 22:19:41 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-09 22:19:12 ----A---- C:\Windows\system32\quartz.dll
2010-02-09 22:19:10 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-09 22:19:09 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-09 22:19:09 ----A---- C:\Windows\system32\msyuv.dll
2010-02-09 22:19:08 ----A---- C:\Windows\system32\msrle32.dll
2010-02-09 22:19:06 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-09 22:19:04 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-09 22:19:03 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-09 22:19:02 ----A---- C:\Windows\system32\avifil32.dll
2010-02-04 23:54:06 ----D---- C:\ProgramData\SweetIM
2010-02-04 18:12:50 ----D---- C:\Users\Shrek\AppData\Roaming\DivX
2010-02-04 18:03:11 ----A---- C:\Windows\system32\pthreadGC2.dll
2010-02-04 18:03:08 ----D---- C:\Program Files\ffdshow
2010-02-04 17:51:20 ----D---- C:\Program Files\Codec Pack - All In 1
2010-02-04 13:14:16 ----D---- C:\Program Files\Free Windows Registry Cleaner
2010-02-04 13:07:27 ----D---- C:\Program Files\NirSoft
2010-02-04 12:16:40 ----N---- C:\Windows\system32\IJRMF.exe
2010-02-04 12:15:50 ----A---- C:\Windows\MAXLINK.INI
2010-02-04 12:15:34 ----D---- C:\Users\Shrek\AppData\Roaming\ScanSoft
2010-02-04 12:15:15 ----D---- C:\ProgramData\ScanSoft
2010-02-04 12:15:15 ----D---- C:\Program Files\Common Files\ScanSoft Shared
2010-02-04 12:14:23 ----D---- C:\Program Files\ScanSoft
2010-02-04 12:11:55 ----D---- C:\Program Files\ArcSoft
2010-02-04 12:11:55 ----A---- C:\Windows\PCDLIB32.DLL
2010-02-04 11:18:55 ----HD---- C:\ProgramData\CanonBJ
2010-02-03 18:26:34 ----D---- C:\Program Files\Free PDF to Word Doc Converter
2010-01-31 17:47:06 ----D---- C:\Users\Shrek\AppData\Roaming\Pathcz
2010-01-22 23:51:29 ----D---- C:\Program Files\SweetIM
2010-01-22 08:52:33 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 08:52:31 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 08:52:27 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 08:52:26 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 08:52:26 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 08:52:25 ----A---- C:\Windows\system32\occache.dll
2010-01-22 08:52:25 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 08:52:25 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 08:52:23 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 08:52:22 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 08:52:22 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 08:52:21 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-22 08:52:21 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 08:52:21 ----A---- C:\Windows\system32\iesysprep.dll
2010-01-22 08:52:20 ----A---- C:\Windows\system32\msfeedssync.exe
2010-01-22 08:52:20 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 08:52:19 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 08:52:19 ----A---- C:\Windows\system32\iernonce.dll

======List of files/folders modified in the last 1 months======

2010-02-21 22:18:05 ----D---- C:\Windows\Temp
2010-02-21 19:37:10 ----D---- C:\Windows
2010-02-21 18:49:51 ----D---- C:\Windows\system32\drivers
2010-02-21 18:49:51 ----D---- C:\Windows\AppPatch
2010-02-21 16:45:02 ----SHD---- C:\System Volume Information
2010-02-21 16:21:57 ----D---- C:\Users\Shrek\AppData\Roaming\DMCache
2010-02-21 16:19:59 ----D---- C:\Windows\Debug
2010-02-21 08:19:24 ----A---- C:\Windows\system32\bscs.ini
2010-02-20 22:30:25 ----AD---- C:\ProgramData\TEMP
2010-02-20 17:27:58 ----D---- C:\Windows\Tasks
2010-02-20 17:25:56 ----SHD---- C:\Windows\Installer
2010-02-20 17:25:04 ----HD---- C:\ProgramData
2010-02-20 16:47:28 ----D---- C:\Windows\System32
2010-02-20 16:41:27 ----D---- C:\Windows\system32\config
2010-02-20 15:21:07 ----RD---- C:\Program Files
2010-02-19 22:35:47 ----D---- C:\Program Files\rajce
2010-02-19 18:34:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-19 18:34:26 ----D---- C:\Windows\inf
2010-02-19 10:19:07 ----D---- C:\Program Files\Mozilla Firefox
2010-02-11 21:18:18 ----D---- C:\Windows\system
2010-02-10 09:04:03 ----D---- C:\Windows\winsxs
2010-02-10 08:53:49 ----D---- C:\Windows\system32\catroot
2010-02-10 08:53:45 ----D---- C:\Windows\system32\catroot2
2010-02-09 23:38:31 ----D---- C:\Program Files\Windows Mail
2010-02-04 23:41:49 ----D---- C:\Users\Shrek\AppData\Roaming\ICQ
2010-02-04 21:03:30 ----D---- C:\Windows\WindowsMobile
2010-02-04 18:43:49 ----D---- C:\Users\Shrek\AppData\Roaming\uTorrent
2010-02-04 18:19:18 ----D---- C:\Program Files\uTorrent
2010-02-04 13:16:21 ----D---- C:\Program Files\Canon
2010-02-04 13:15:40 ----D---- C:\Users\Shrek\AppData\Roaming\Canon
2010-02-04 13:04:06 ----D---- C:\Windows\twain_32
2010-02-04 12:15:15 ----D---- C:\Program Files\Common Files
2010-02-04 12:11:54 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-01 20:26:20 ----A---- C:\Windows\system32\mrt.exe
2010-01-31 17:41:00 ----D---- C:\Garmin
2010-01-27 19:26:35 ----D---- C:\Users\Shrek\AppData\Roaming\Skype
2010-01-27 18:33:26 ----D---- C:\Users\Shrek\AppData\Roaming\skypePM
2010-01-27 11:02:50 ----D---- C:\Program Files\Internet Explorer
2010-01-22 10:52:09 ----D---- C:\Windows\system32\migration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-09-11 135048]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-09-11 38240]
R2 WFCXVCAP;WinFast TV Video Capture Driver; C:\Windows\system32\drivers\wfcxvcap.sys [2006-10-23 167424]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 AteksoftAudio;WebCamera Plus Audio; C:\Windows\system32\drivers\ateksoftaudio.sys [2007-12-25 11776]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-04 4303360]
R3 BT;Bluetooth PAN Network Adapter; C:\Windows\system32\DRIVERS\btnetdrv.sys [2008-01-21 14600]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-06-19 33096]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-01-15 23848]
R3 IvtBtBUs;IVT Bluetooth Bus Service; C:\Windows\System32\Drivers\IvtBtBus.sys [2008-07-02 26248]
R3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
R3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-11-18 1040544]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
R3 VcommMgr;Bluetooth VComm Manager Service; C:\Windows\System32\Drivers\VcommMgr.sys [2008-07-02 29960]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver; C:\Windows\system32\drivers\wfcxdtun.sys [2006-10-23 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver; C:\Windows\system32\drivers\wfcxtcap.sys [2006-10-23 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver; C:\Windows\system32\drivers\wfcxxbar.sys [2006-10-23 10496]
R3 winusb;Ovladač WinUsb; C:\Windows\system32\DRIVERS\winusb.sys [2009-04-11 31616]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 a9jsr05o;a9jsr05o; C:\Windows\system32\drivers\a9jsr05o.sys []
S3 abub57qa;abub57qa; C:\Windows\system32\drivers\abub57qa.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\Windows\System32\Drivers\btcusb.sys [2008-07-02 38920]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-01-06 220160]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-01-06 29184]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 grmnusb;grmnusb; C:\Windows\system32\drivers\grmnusb.sys [2007-01-17 7296]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-04 4303360]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 SndTDriverV32;SndTDriverV32; C:\Windows\system32\drivers\SndTDriverV32.sys [2007-04-03 22528]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-04-11 15872]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 VComm;Virtual Serial port driver; C:\Windows\system32\DRIVERS\VComm.sys [2008-01-21 14856]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2009-09-28 109056]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-05 132424]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-04 729088]
R2 BlueSoleilCS;BlueSoleilCS; C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2008-07-09 775168]
R2 BsMobileCS;BsMobileCS; C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-08-01 143467]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe [2009-01-09 410976]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]
R2 O&O Defrag;O&O Defrag; C:\Windows\system32\oodag.exe [2009-02-25 1352960]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 TeamViewer4;TeamViewer 4; C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe [2009-01-22 185640]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 Uniblue DiskRescue;Uniblue DiskRescue; C:\Program Files\Uniblue\DiskRescue\UBDiskRescueSrv.exe [2008-09-10 229648]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Webcamera Plus Service;Webcamera Plus Service; C:\Program Files\Ateksoft\WebCamera Plus\WebCamPlusSrv.exe [2007-12-25 46592]
R3 BsHelpCS;BsHelpCS; C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2008-08-01 69735]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-09-04 133104]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-03-28 85096]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 20680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]

-----------------EOF-----------------

Nic nebezpečného nevidím. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Tim jsem to projel je to cisty.
Ale proste z niceho nic mi nod vyhodi hlasku
nfiltrace Win32/Injector.JH trojský kůň nelze léčit

OK. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Zdravim.


ComboFix 10-02-21.02 - Shrek 22.02.2010 18:43:57.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.1023.210 [GMT 1:00]
Spuštěný z: c:\users\Shrek\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\users\Shrek\AppData\Roaming\inst.exe
c:\windows\hklmSW.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-22 do 2010-02-22 )))))))))))))))))))))))))))))))
.

2010-02-21 21:17 . 2010-02-21 21:18 -------- d-----w- C:\rsit
2010-02-21 18:33 . 2010-02-21 18:37 4832654 ----a-w- c:\windows\REGBK11.ZIP
2010-02-20 16:25 . 2010-01-11 08:08 2644135 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\Uniblue DiskRescue.exe
2010-02-20 16:25 . 2008-09-10 15:22 836880 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\B4B74A3\3826204\UBDefrag.DLL
2010-02-20 16:25 . 2008-09-10 15:22 419088 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\F02A138C\3826204\update.dll
2010-02-20 16:25 . 2008-09-10 15:22 229648 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\C_\build\AutoBuilds\DR\Installer\Raw\UBDiskRescueSrv.exe
2010-02-20 16:25 . 2008-09-10 15:22 229648 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\49994FF1\3826204\UBDiskRescueSrv.exe
2010-02-20 16:25 . 2008-09-10 15:22 1996048 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\9C335CDE\3826204\UBResdll.dll
2010-02-20 16:25 . 2008-09-10 15:22 3211536 -c--a-w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\UniblueDiskRescue\1FDE702B\3826204\UBDiskRescue.exe
2010-02-20 16:25 . 2010-02-20 16:25 -------- dc-h--w- c:\programdata\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}
2010-02-20 15:59 . 2010-01-11 07:05 2653050 -c--a-w- c:\programdata\{66E2F539-12B6-4870-A500-7689CDE75C5E}\DriverScanner_Setup.exe
2010-02-20 15:59 . 2010-02-20 16:08 -------- d-----w- c:\programdata\DriverScanner
2010-02-20 15:55 . 2010-02-20 15:59 -------- dc-h--w- c:\programdata\{66E2F539-12B6-4870-A500-7689CDE75C5E}
2010-02-20 15:47 . 2010-02-20 15:47 -------- d-----w- c:\windows\system32\ErrorLogs
2010-02-20 14:21 . 2008-08-27 10:05 2567183 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\Uniblue RegistryBooster.exe
2010-02-20 14:21 . 2010-02-20 16:25 -------- d-----w- c:\program files\Uniblue
2010-02-20 14:20 . 2008-08-26 16:48 757760 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\2B86F085\6383BC9B\UBVarRB.dll
2010-02-20 14:20 . 2008-08-26 16:48 6676480 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\4E45A1A4\6383BC9B\RegistryBooster.dll
2010-02-20 14:20 . 2008-08-26 16:48 497496 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\AF01B0B\6383BC9B\XceedZip.dll
2010-02-20 14:20 . 2008-08-26 16:48 413696 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\52CD59C9\6383BC9B\update.dll
2010-02-20 14:20 . 2008-08-26 16:48 99624 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\7390E4F0\6383BC9B\StartRegistryBooster.exe
2010-02-20 14:20 . 2008-08-26 16:48 2019624 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\7CE1607E\6383BC9B\RegistryBooster.exe
2010-02-20 14:20 . 2008-08-26 16:48 111912 -c--a-w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\registrybooster2\65B92A91\6383BC9B\KillRBProcess.exe
2010-02-20 14:20 . 2010-02-20 14:21 -------- dc-h--w- c:\programdata\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
2010-02-20 13:37 . 2010-02-20 13:36 57344 ---h--w- c:\users\Shrek\gyiop.exe
2010-02-20 12:55 . 2010-02-20 16:29 -------- d-----w- c:\users\Shrek\AppData\Roaming\Uniblue
2010-02-20 12:47 . 2010-02-20 12:47 -------- d-----w- c:\users\Shrek\AppData\Roaming\Malwarebytes
2010-02-20 12:47 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-20 12:47 . 2010-02-20 12:47 -------- d-----w- c:\programdata\Malwarebytes
2010-02-20 12:47 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 12:47 . 2010-02-20 12:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-13 22:50 . 2007-12-25 10:06 11776 ----a-w- c:\windows\system32\drivers\ateksoftaudio.sys
2010-02-13 22:50 . 2010-02-13 22:50 -------- d-----w- c:\program files\Ateksoft
2010-02-13 07:20 . 2010-02-13 07:20 -------- d-----w- c:\program files\Trend Micro
2010-02-12 19:44 . 2010-02-12 19:47 13774194 ----a-w- c:\windows\REGBK10.ZIP
2010-02-11 20:17 . 2009-10-25 07:14 73728 ----a-w- c:\windows\system\vdremote.dll
2010-02-11 20:17 . 2009-10-25 07:13 61440 ----a-w- c:\windows\system\vdsvrlnk.dll
2010-02-09 21:18 . 2009-12-04 15:56 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-09 21:18 . 2009-12-04 15:56 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\programdata\SweetIM
2010-02-04 18:43 . 2010-02-04 18:43 -------- d-----w- c:\users\Shrek\dwhelper
2010-02-04 17:12 . 2010-02-04 17:12 -------- d-----w- c:\users\Shrek\AppData\Roaming\DivX
2010-02-04 17:03 . 2007-04-24 06:15 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2010-02-04 17:03 . 2010-02-04 17:03 -------- d-----w- c:\program files\ffdshow
2010-02-04 16:51 . 2010-02-04 16:51 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-02-04 15:58 . 2010-02-04 15:58 -------- d-----w- c:\users\Shrek\AppData\Local\Scansoft
2010-02-04 12:14 . 2010-02-04 12:14 -------- d-----w- c:\program files\Free Windows Registry Cleaner
2010-02-04 12:13 . 2006-11-14 10:14 954184 ----a-w- c:\users\Shrek\AppData\Roaming\IDM\DwnlData\Shrek\rc-setup_4539\FREE-WRC.exe
2010-02-04 12:12 . 2007-02-14 16:01 1335224 ----a-w- c:\users\Shrek\AppData\Roaming\IDM\DwnlData\Shrek\rc-setup_4539\PRO-setup.exe
2010-02-04 12:07 . 2010-02-04 12:07 -------- d-----w- c:\program files\NirSoft
2010-02-04 11:16 . 2006-09-05 10:28 38480 ------w- c:\windows\system32\IJRMF.exe
2010-02-04 11:15 . 2010-02-04 11:15 -------- d-----w- c:\users\Shrek\AppData\Roaming\ScanSoft
2010-02-04 11:15 . 2010-02-04 11:15 -------- d-----w- c:\programdata\ScanSoft
2010-02-04 11:15 . 2010-02-04 11:15 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2010-02-04 11:14 . 2010-02-04 11:14 -------- d-----w- c:\program files\ScanSoft
2010-02-04 11:11 . 2010-02-04 11:11 -------- d-----w- c:\program files\ArcSoft
2010-02-04 11:11 . 1995-07-31 12:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2010-02-04 10:18 . 2010-02-04 10:18 -------- d--h--w- c:\programdata\CanonBJ
2010-02-03 17:26 . 2010-02-03 17:26 -------- d-----w- c:\program files\Free PDF to Word Doc Converter
2010-01-31 16:47 . 2010-01-31 16:47 -------- d-----w- c:\users\Shrek\AppData\Roaming\Pathcz

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-22 17:39 . 2009-01-06 18:12 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-22 17:35 . 2009-01-07 20:27 -------- d-----w- c:\users\Shrek\AppData\Roaming\DMCache
2010-02-22 05:57 . 2009-01-06 19:49 -------- d-----w- c:\users\Shrek\AppData\Roaming\ICQ
2010-02-21 07:25 . 2010-01-07 08:35 680 ----a-w- c:\users\Shrek\AppData\Local\d3d9caps.dat
2010-02-20 14:58 . 2010-02-20 14:57 -------- dc-h--w- c:\programdata\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}
2010-02-19 21:35 . 2009-01-07 22:00 -------- d-----w- c:\program files\rajce
2010-02-19 17:34 . 2007-01-08 21:10 598600 ----a-w- c:\windows\system32\perfh005.dat
2010-02-19 17:34 . 2007-01-08 21:10 114808 ----a-w- c:\windows\system32\perfc005.dat
2010-02-16 07:00 . 2010-02-20 14:58 2838478 -c--a-w- c:\programdata\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}\speedupmypc2009.exe
2010-02-09 22:38 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-04 22:54 . 2010-01-22 22:51 -------- d-----w- c:\program files\SweetIM
2010-02-04 17:43 . 2009-01-16 21:19 -------- d-----w- c:\users\Shrek\AppData\Roaming\uTorrent
2010-02-04 17:19 . 2009-01-16 21:20 -------- d-----w- c:\program files\uTorrent
2010-02-04 12:16 . 2009-01-07 17:16 -------- d-----w- c:\program files\Canon
2010-02-04 12:15 . 2009-01-21 19:50 -------- d-----w- c:\users\Shrek\AppData\Roaming\Canon
2010-02-04 11:11 . 2009-01-06 20:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-27 18:26 . 2009-01-19 22:38 -------- d-----w- c:\users\Shrek\AppData\Roaming\Skype
2010-01-27 17:33 . 2009-01-19 22:41 -------- d-----w- c:\users\Shrek\AppData\Roaming\skypePM
2010-01-21 08:10 . 2009-09-14 17:26 -------- d-----w- c:\program files\Seznam.cz
2010-01-18 18:02 . 2010-01-11 20:00 -------- d-----w- c:\program files\Astro Avenger 2
2010-01-17 18:43 . 2009-03-30 19:25 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-17 18:06 . 2010-01-17 18:06 -------- d-----w- c:\program files\Buka
2010-01-14 10:12 . 2009-10-03 07:33 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-12 09:12 . 2009-01-23 22:03 -------- d-----w- c:\users\Shrek\AppData\Roaming\Thinstall
2010-01-11 20:07 . 2010-01-08 15:34 -------- d-----w- c:\users\Shrek\AppData\Roaming\Sahmon Games
2010-01-11 20:00 . 2010-01-11 20:00 -------- d-----w- c:\program files\ReflexiveArcade
2010-01-09 11:06 . 2010-01-09 11:03 13588483 ----a-w- c:\windows\REGBK09.ZIP
2010-01-07 22:04 . 2010-01-07 21:51 -------- d-----w- c:\program files\PDFCreator
2010-01-04 17:58 . 2009-10-27 14:10 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-01-04 17:58 . 2009-10-27 13:43 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-03 15:51 . 2009-12-29 19:41 -------- d-----w- c:\users\Shrek\AppData\Roaming\Winamp
2010-01-03 15:48 . 2009-09-08 12:50 -------- d-----w- c:\program files\Winamp
2010-01-03 15:47 . 2009-12-29 19:41 -------- d-----w- c:\program files\Winamp Detect
2010-01-02 06:38 . 2010-01-22 07:52 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 07:52 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-01-22 07:52 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-01-22 07:52 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-31 17:52 . 2009-10-08 08:22 -------- d-----w- c:\users\Shrek\AppData\Roaming\MOBILedit
2009-12-30 19:51 . 2009-01-06 19:48 -------- d-----w- c:\program files\ICQ6.5
2009-12-11 11:43 . 2010-02-09 21:19 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-11 11:43 . 2010-02-09 21:19 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-12-08 20:01 . 2010-02-09 21:19 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-09 21:19 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-09 21:19 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-09 21:19 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-04 18:30 . 2010-02-09 21:19 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-09 21:19 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-09 21:19 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-09 21:19 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-09 21:19 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-09 21:19 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-09 21:19 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-09 21:19 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-09 21:19 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-02-02 2745776]
"Seznam Postak"="c:\program files\Seznam.cz\postak.exe" [2010-01-18 448664]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-03-11 2912256]
"Google Update"="c:\users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-05-11 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-10-02 90112]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-10-20 111928]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Aktualizovat ESET licenci.lnk - c:\program files\ESET\MiNODLogin\MiNODLogin.exe [2009-12-10 125952]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):f2,5c,9c,5d,10,fe,c9,01

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\drivers\BtHidBus.sys [31.7.2008 20:45 20616]
R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [11.9.2009 6:23 108792]
R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [1.8.2008 15:55 143467]
R2 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [8.9.2009 15:42 410976]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11.9.2009 7:24 735960]
R2 epfwwfp;epfwwfp;c:\windows\System32\drivers\epfwwfp.sys [11.9.2009 6:26 38240]
R2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\System32\drivers\wfcxvcap.sys [25.10.2009 20:54 167424]
R3 AteksoftAudio;WebCamera Plus Audio;c:\windows\System32\drivers\ateksoftaudio.sys [13.2.2010 23:50 11776]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\System32\drivers\IvtBtBus.sys [2.7.2008 14:58 26248]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\System32\drivers\wfcxdtun.sys [25.10.2009 20:54 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\System32\drivers\wfcxtcap.sys [25.10.2009 20:54 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\System32\drivers\wfcxxbar.sys [25.10.2009 20:54 10496]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [27.10.2009 14:43 691696]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4.9.2009 21:35 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ca5a76c95a800.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-04 20:34]

2009-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-04 20:34]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2964015881-2797028174-321826089-1000Core1ca5a765c0195de.job
- c:\users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-11 13:36]

2009-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2964015881-2797028174-321826089-1000UA.job
- c:\users\Shrek\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-11 13:36]

2010-01-31 c:\windows\Tasks\Launch 10118.job
- c:\garmin\MapSource.exe [2009-09-21 14:47]

2010-01-31 c:\windows\Tasks\Launch 14699.job
- c:\garmin\MapSource.exe [2009-09-21 14:47]

2009-12-14 c:\windows\Tasks\Launch 23009.job
- c:\garmin\WebUpdater\WebUpdater.exe [2009-04-14 07:31]

2009-12-14 c:\windows\Tasks\Launch 25318.job
- c:\garmin\WebUpdater\WebUpdater.exe [2009-04-14 07:31]

2009-12-14 c:\windows\Tasks\Launch 25409.job
- c:\garmin\WebUpdater\WebUpdater.exe [2009-04-14 07:31]

2010-02-20 c:\windows\Tasks\Uniblue DiskRescue 2009.job
- c:\program files\Uniblue\DiskRescue\UBDiskRescue.exe [2008-09-10 15:22]

2009-12-21 c:\windows\Tasks\{D09084D1-0ECD-4EB0-B0A9-62828E47FF97}.job
- c:\program files\Skype\Phone\Skype.exe [2009-10-09 12:11]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send by Bluetooth
IE: Send via &Message...
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
TCP: {579AF2F3-A3F3-433F-8CF1-FD5039655866} = 213.235.188.145,77.48.100.254
DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} - hxxp://213.211.35.82/img/NetCamPlayerWeb11g.ocx
FF - ProfilePath - c:\users\Shrek\AppData\Roaming\Mozilla\Firefox\Profiles\4tdpjwdm.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\users\Shrek\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\users\Shrek\AppData\Roaming\Mozilla\Firefox\Profiles\4tdpjwdm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\users\Shrek\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
FF - user.js: network.proxy.http_port - 0
FF - user.js: network.proxy.ssl -
FF - user.js: network.proxy.ssl_port - 0
FF - user.js: network.proxy.ftp -
FF - user.js: network.proxy.ftp_port - 0
FF - user.js: network.proxy.gopher -
FF - user.js: network.proxy.gopher_port - 0
FF - user.js: network.proxy.socks_version - 5
FF - user.js: network.proxy.socks -
FF - user.js: network.proxy.socks_port - 0
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-22 18:52
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2964015881-2797028174-321826089-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):c6,07,8f,8c,3a,97,40,e5,07,b0,fe,40,9b,b3,b5,c6,1a,ca,1c,ea,68,
5a,e3,4d,15,7c,c9,ee,f2,35,02,b0,09,4c,7e,8e,c1,72,23,70,00,00,00,00,00,00,\

[HKEY_USERS\S-1-5-21-2964015881-2797028174-321826089-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):8d,dc,fd,f1,a2,44,0f,c8,e3,0b,88,f3,a1,b8,5f,79,f5,e0,a0,df,df,
97,c4,7c,48,ef,69,48,54,7c,f1,5c,5b,c0,94,d0,0b,fb,79,8e,00,00,00,00,00,00,\

[HKEY_USERS\S-1-5-21-2964015881-2797028174-321826089-1000_Classes\CLSID\{d974af8a-313e-4f53-b77a-ca0a64e91058}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000020
"Therad"=dword:0000001b

[HKEY_USERS\S-1-5-21-2964015881-2797028174-321826089-1000_Classes\CLSID\{e02fcf24-f5b1-4142-8eef-5e8dad1d1501}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000060
"Therad"=dword:00000015
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-02-22 18:55:38
ComboFix-quarantined-files.txt 2010-02-22 17:55

Před spuštěním: Volných bajtů: 37 775 622 144
Po spuštění: Volných bajtů: 37 871 304 704

- - End Of File - - F20CE5E4F6C7497A52DA58931BD848C2

Několik položek bylo smazáno, zbytek logu vypadá čistý.

jj
Uz se docela orientuji.ale tohle me zaskocilo taxem se radeji zeptal.
Thx za Vas cas

Nemáte zač!