Pocitac jede pouze v nouzovem rezimu.

[dmitrijsadlo]

Ahoj, prosím vás o pomoc. Počítač lze spustit pouze v nouzovém režimu, v normálním programy nenabíhají, jakykoliv klik trva minuty misto milisekund, nejde ani vypnout. Je to pocitac jineho clena rodiny a pry se takto zacal chovat ve chvili kdy se snazil otevrit foto z prilohy emailu (duveryhodny kontakt).Dekuji predem.

RSIT:

aLogfile of random's system information tool 1.06 (written by random/random)
Run by uživatel at 2009-10-11 19:53:05
Microsoft® Windows Vista™ Home Premium
System drive C: has 52 GB (55%) free of 94 GB
Total RAM: 1022 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:11, on 11.10.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\Marek\RSIT.exe
C:\Program Files\trend micro\uživatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sanbohemia.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O1 - Hosts: ::1 localhost
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} (Active602XMLFiller Control) - https://www.mojedatovaschranka.cz/stati ... ctivex.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F680B28A-3AEE-4C88-93ED-45AE9215C128} (CryptSignX Control) - http://adisepo.mfcr.cz/adistc/adis/idpr ... tsignx.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 5463 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{D9A28F2E-C6BA-4C19-B173-9CCB15C48B44}.job
C:\Windows\tasks\User_Feed_Synchronization-{EAD53FA0-58C7-47C4-9253-6EE534845340}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - C:\PROGRA~1\ICQTOO~1\toolbaru.dll [2006-12-25 701952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-06-03 1404928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQ Toolbar - C:\PROGRA~1\ICQTOO~1\toolbaru.dll [2006-12-25 701952]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-06-16 1006264]
"StartCCC"=c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-04-10 4431872]
"SMSERIAL"=C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-05-05 1466368]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-02-26 153136]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2009-09-28 1799952]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-09 1232896]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]

C:\Users\uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\Windows\system32\guard32.dll"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2009-10-11 19:53:05 ----D---- C:\rsit
2009-10-11 19:45:42 ----A---- C:\Windows\ntbtlog.txt
2009-09-28 20:14:56 ----A---- C:\Windows\system32\javaws.exe
2009-09-28 20:14:56 ----A---- C:\Windows\system32\javaw.exe
2009-09-28 20:14:56 ----A---- C:\Windows\system32\java.exe
2009-09-16 19:57:20 ----A---- C:\Windows\system32\netiohlp.dll
2009-09-16 19:57:19 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-09-16 19:57:17 ----A---- C:\Windows\system32\netiougc.exe
2009-09-16 19:57:16 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-09-16 19:57:16 ----A---- C:\Windows\system32\ROUTE.EXE
2009-09-16 19:57:16 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-09-16 19:57:16 ----A---- C:\Windows\system32\MRINFO.EXE
2009-09-16 19:57:16 ----A---- C:\Windows\system32\finger.exe
2009-09-16 19:57:16 ----A---- C:\Windows\system32\ARP.EXE
2009-09-16 19:57:15 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-09-16 19:57:14 ----A---- C:\Windows\system32\netevent.dll
2009-09-16 19:54:50 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-09-16 19:54:49 ----A---- C:\Windows\system32\mf.dll
2009-09-16 19:54:47 ----A---- C:\Windows\system32\rrinstaller.exe
2009-09-16 19:54:47 ----A---- C:\Windows\system32\mfps.dll
2009-09-16 19:54:46 ----A---- C:\Windows\system32\mfpmp.exe
2009-09-16 19:54:46 ----A---- C:\Windows\system32\mferror.dll
2009-09-16 19:54:24 ----A---- C:\Windows\system32\wlansvc.dll
2009-09-16 19:54:24 ----A---- C:\Windows\system32\wlansec.dll
2009-09-16 19:54:24 ----A---- C:\Windows\system32\wlanmsm.dll
2009-09-16 19:54:24 ----A---- C:\Windows\system32\wlanhlp.dll
2009-09-16 19:54:24 ----A---- C:\Windows\system32\L2SecHC.dll
2009-09-16 19:54:23 ----A---- C:\Windows\system32\wlanapi.dll
2009-09-16 19:54:03 ----A---- C:\Windows\system32\gameux.dll
2009-09-16 19:53:57 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-09-16 19:53:56 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-09-16 19:47:27 ----A---- C:\Windows\system32\jscript.dll
2009-09-16 18:21:42 ----A---- C:\Windows\WTRAN32.INI

======List of files/folders modified in the last 1 months======

2009-10-11 19:53:06 ----D---- C:\Program Files\trend micro
2009-10-11 19:45:42 ----D---- C:\Windows
2009-10-11 19:43:45 ----D---- C:\Windows\Temp
2009-10-11 13:54:25 ----D---- C:\Windows\Prefetch
2009-10-08 10:44:26 ----D---- C:\Windows\system32\spool
2009-10-07 09:56:15 ----SHD---- C:\System Volume Information
2009-10-06 10:37:37 ----D---- C:\Windows\System32
2009-10-06 10:37:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-10-06 10:37:36 ----D---- C:\Windows\inf
2009-10-05 06:59:42 ----D---- C:\Windows\system32\catroot2
2009-09-28 22:51:36 ----D---- C:\Program Files\Mozilla Firefox
2009-09-28 20:15:06 ----SHD---- C:\Windows\Installer
2009-09-28 20:14:53 ----D---- C:\Program Files\Java
2009-09-28 17:19:05 ----A---- C:\Windows\NeroDigital.ini
2009-09-28 14:46:26 ----D---- C:\Windows\Debug
2009-09-28 14:41:14 ----D---- C:\Windows\winsxs
2009-09-28 14:39:45 ----D---- C:\Windows\system32\catroot
2009-09-28 14:37:08 ----D---- C:\Windows\AppPatch
2009-09-28 14:12:55 ----A---- C:\Windows\system32\guard32.dll
2009-09-16 20:37:54 ----D---- C:\Windows\system32\cs-CZ
2009-09-16 20:37:51 ----D---- C:\Windows\system32\migration
2009-09-16 20:37:50 ----D---- C:\Windows\system32\drivers
2009-09-16 20:00:43 ----D---- C:\ProgramData\Microsoft Help
2009-09-16 19:59:07 ----D---- C:\Windows\ehome
2009-09-16 16:40:39 ----D---- C:\Program Files\Microsoft Silverlight
2009-09-12 09:02:34 ----SD---- C:\Users\uživatel\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2009-09-28 29520]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2009-09-28 74328]
R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-04-04 46592]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2009-03-04 4232704]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-02-16 70144]
S1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2009-09-28 128888]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-04-11 2589696]
S3 Cam5603D;WebCam; C:\Windows\System32\Drivers\BisonCam.sys [2007-04-19 788400]
S3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2007-08-31 14208]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HPFXBULK;HPFXBULK; C:\Windows\system32\drivers\hpfxbulk.sys [2007-08-10 11264]
S3 HPFXFAX;HPFXFAX; C:\Windows\system32\drivers\hpfxfax.sys [2007-08-10 14336]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-04-10 1764960]
S3 KMWDFILTER;HIDUASDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2008-10-09 17408]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2006-11-02 18432]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-25 2216448]
S3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-05-05 1095808]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2006-11-02 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2007-08-31 11264]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 nvatabus;nvatabus; C:\Windows\system32\drivers\nvatabus.sys [2006-07-14 105088]
S4 viamraid;viamraid; C:\Windows\system32\drivers\viamraid.sys [2006-03-31 100992]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-04-11 593920]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2009-09-28 723632]
S2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
S2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-20 262247]
S2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler; C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 204800]
S3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-02-26 267824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[dmitrijsadlo]

ComboFix 09-10-10.02 - uživatel 11.10.2009 20:47.1.2 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.420.1029.18.1022.544 [GMT 2:00]
Spuštěný z: d:\marek\ComboFix.exe
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
SP: avast! antivirus 4.8.1335 [VPS 090417-0] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: COMODO Defense+ *enabled* (Updated) {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1293123682-419233305-1674681235-500
c:\$recycle.bin\S-1-5-21-1933546822-1088246273-3117313979-1001
c:\$recycle.bin\S-1-5-21-1933546822-1088246273-3117313979-1002
c:\$recycle.bin\S-1-5-21-1933546822-1088246273-3117313979-1003
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\users\u§ivatel\Documents\cc_20091011_193207.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-11 do 2009-10-11 )))))))))))))))))))))))))))))))
.

2009-10-11 18:52 . 2009-10-11 18:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-11 17:53 . 2009-10-11 17:53 -------- d-----w- C:\rsit
2009-09-16 17:54 . 2009-06-10 12:07 2855424 ----a-w- c:\windows\system32\mf.dll
2009-09-16 17:54 . 2009-06-10 12:07 98816 ----a-w- c:\windows\system32\mfps.dll
2009-09-16 17:54 . 2009-06-10 10:14 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2009-09-16 17:54 . 2009-06-10 10:15 24576 ----a-w- c:\windows\system32\mfpmp.exe
2009-09-16 17:54 . 2009-06-10 08:50 2048 ----a-w- c:\windows\system32\mferror.dll
2009-09-16 17:54 . 2009-07-11 19:32 502272 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-16 17:54 . 2009-07-11 19:32 297984 ----a-w- c:\windows\system32\wlansec.dll
2009-09-16 17:54 . 2009-07-11 19:32 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-16 17:54 . 2009-07-11 19:32 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2009-09-16 17:54 . 2009-07-11 19:26 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-16 17:54 . 2009-07-11 19:32 47104 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-16 17:54 . 2009-08-29 03:41 1686528 ----a-w- c:\windows\system32\gameux.dll
2009-09-16 17:53 . 2009-08-29 03:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-16 17:53 . 2009-08-28 23:31 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 17:53 . 2009-06-10 11:52 -------- d-----w- c:\program files\trend micro
2009-10-11 17:43 . 2009-07-01 21:00 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-10-06 08:37 . 2007-06-16 14:31 82594 ----a-w- c:\windows\system32\perfc005.dat
2009-10-06 08:37 . 2007-06-16 14:31 476852 ----a-w- c:\windows\system32\perfh005.dat
2009-09-28 18:14 . 2007-11-07 18:18 -------- d-----w- c:\program files\Java
2009-09-28 12:13 . 2009-07-01 20:11 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-09-28 12:12 . 2009-07-01 20:11 179792 ----a-w- c:\windows\system32\guard32.dll
2009-09-28 12:12 . 2009-07-01 20:11 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-09-28 12:12 . 2009-07-01 20:11 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-09-16 18:00 . 2007-11-06 12:42 -------- d-----w- c:\programdata\Microsoft Help
2009-09-16 14:40 . 2009-05-31 18:21 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-04 14:46 . 2009-09-04 14:46 -------- d-----w- c:\program files\Software602
2009-08-26 08:48 . 2008-02-15 18:18 -------- d-----w- c:\program files\QIP
2009-08-25 16:16 . 2008-10-21 15:22 -------- d-----w- c:\program files\Canon
2009-08-25 15:08 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-08-25 14:53 . 2007-11-06 12:41 -------- d-----w- c:\program files\Microsoft Works
2009-08-25 14:46 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-14 17:16 . 2009-09-16 17:57 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2009-08-14 16:42 . 2009-09-16 17:57 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2009-08-14 16:40 . 2009-09-16 17:57 103936 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:40 . 2009-09-16 17:57 15360 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:25 . 2009-09-16 17:57 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:25 . 2009-09-16 17:57 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:25 . 2009-09-16 17:57 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:25 . 2009-09-16 17:57 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:25 . 2009-09-16 17:57 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:25 . 2009-09-16 17:57 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 14:25 . 2009-09-16 17:57 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:24 . 2009-09-16 17:57 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 14:23 . 2009-09-16 17:57 22016 ----a-w- c:\windows\system32\netiougc.exe
2009-07-25 03:23 . 2008-12-07 09:28 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-18 12:17 . 2009-07-29 05:47 827392 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 12:10 . 2009-07-29 05:47 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-07-18 12:10 . 2009-07-29 05:47 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 12:07 . 2009-07-29 05:47 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-18 10:00 . 2009-07-29 05:47 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 08:34 . 2009-07-29 05:47 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-07-17 14:52 . 2009-08-24 09:19 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:02 . 2009-08-19 14:39 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 13:01 . 2009-08-19 14:38 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 13:00 . 2009-08-19 14:39 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 11:11 . 2009-08-19 14:38 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2008-03-08 14:52 . 2008-03-01 11:31 608 --sha-w- c:\windows\System32\winzvprt5.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-06-16 1006264]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-28 1799952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-04-10 4431872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

c:\users\u§ivatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-1-15 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1EAF3F70-E596-43D4-B596-950A0420343C}"= Profile=Private|c:\program files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"{E35DB22D-F6C9-4231-B703-C6CDAC87FB96}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{FE16C0AE-64A1-4419-968E-208EF0EE09D4}d:\\marek\\qip\\qip.exe"= UDP:d:\marek\qip\qip.exe:Quiet Internet Pager
"UDP Query User{14D9443F-6686-4CD2-AE91-22BD72E51666}d:\\marek\\qip\\qip.exe"= TCP:d:\marek\qip\qip.exe:Quiet Internet Pager
"{8D9F82BD-2787-4060-B12B-37B4CE3BF8FE}"= UDP:c:\program files\HP\hp laserjet m2727\Fax Config utility0.exe:HP Networked Printer Installer
"{EE2EC9F2-B88F-421E-AFDA-C6C08CF155A6}"= TCP:c:\program files\HP\hp laserjet m2727\Fax Config utility0.exe:HP Networked Printer Installer
"TCP Query User{5B31CE86-7052-44FF-A404-E3051116AFEB}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{C7DF17A1-F02F-4481-9AF4-C7DA9C544D43}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{2D966BD5-F1FF-4DD6-829F-DE0342AB3493}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{9F87F4CD-1BB7-4C52-AB47-7866B22E6EAD}c:\\windows\\explorer.exe"= UDP:c:\windows\explorer.exe:Průzkumník Windows
"UDP Query User{FF1FD878-723E-4112-81CF-BC2B0A8AA10E}c:\\windows\\explorer.exe"= TCP:c:\windows\explorer.exe:Průzkumník Windows
"{E1BB9A0F-B878-4956-8AF0-BB52C511B03B}"= UDP:c:\windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process
"{E6BCCE07-11EA-427C-80BA-D9F6518EB385}"= TCP:c:\windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process
"{D4BB5886-6160-4D1A-BE3F-3B881C321170}"= Disabled:c:\program files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"{FA19396A-544D-4795-8F0F-F88C856306CF}"= UDP:c:\windows\System32\spoolsv.exe:HP Networked Printer Installer
"{9E0457BB-F760-4D7C-8EB1-9406A83A8F6E}"= TCP:c:\windows\System32\spoolsv.exe:HP Networked Printer Installer

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [1.7.2009 22:11 29520]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [16.6.2007 16:41 46592]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [1.4.2009 21:27 4232704]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [1.7.2009 22:11 128888]
S3 HPFXFAX;HPFXFAX;c:\windows\System32\drivers\hpfxfax.sys [1.3.2008 13:26 14336]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Obsah adresáře 'Naplánované úlohy'

2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{D9A28F2E-C6BA-4C19-B173-9CCB15C48B44}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]

2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{EAD53FA0-58C7-47C4-9253-6EE534845340}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.sanbohemia.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ctivex.cab
DPF: {F680B28A-3AEE-4C88-93ED-45AE9215C128} - hxxp://adisepo.mfcr.cz/adistc/adis/idpr_pub/hlib/bin/cryptsignx.cab
FF - ProfilePath - c:\users\uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\92ffgizp.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-RunOnce-<NO NAME> - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-11 20:52
Windows 6.0.6000 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000002e
.
Celkový čas: 2009-10-11 20:54
ComboFix-quarantined-files.txt 2009-10-11 18:54

Před spuštěním: Volných bajtů: 54 165 729 280
Po spuštění: Volných bajtů: 54 833 172 480

200 --- E O F --- 2009-09-28 12:16

Comodo bylo podle vseho vypnute, ale Combofix hlasil ze je zaple na zacatku. Co dal? Dekuji.

[Rudy]

Několik položek bylo smazáno, zbytek logu vypadá čistý. Pokud jste si jist, že jste fw vypnul, hlášku ignorujte. Jak se nyní PC chová?

[dmitrijsadlo]

Stale stejne. Je silene zpomaleny. Jsem s nim schopen pracovat pouze v nouzovem rezimu.

[Rudy]

Zkuste ještě dát log z MBAM: http://www.malwarebytes.org/mbam.php . Předem nic nemažte. Obávám se ale, že virus poškodil systém.

[dmitrijsadlo]

MBAM nasel trojana.Snad se s tim jeste bude dat neco delat.

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2775
Windows 6.0.6000 (Safe Mode)

12.10.2009 8:28:05
mbam-log-2009-10-12 (08-27-53).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 228169
Uplynulý čas: 37 minute(s), 52 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> No action taken.

[dmitrijsadlo]

Pokusil jsem se opravit, s tim ze infikovany soubor ze slozky ICQ Toolbar se mel odstranit na Rebootu. Pocitac pri nabihani do plneho rezimu (ne nouzoveho) zamrzl. Vypada ze bude potreba odstranit sofistikovanejsi metodou. Poradite?

[dmitrijsadlo]

Pripada mi to analogicke s http://viry.cz/forum/viewtopic.php?f=13 ... l&start=30

Novy log z Combofixu, po projeti Mbamem.

ComboFix 09-10-10.02 - uživatel 12.10.2009 10:32.2.2 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.420.1029.18.1022.595 [GMT 2:00]
Spuštěný z: c:\users\uživatel\Desktop\ComboFix.exe
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
SP: avast! antivirus 4.8.1335 [VPS 090417-0] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: COMODO Defense+ *enabled* (Updated) {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\u§ivatel\Documents\cc_20091011_193207.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-12 do 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-12 08:37 . 2009-10-12 08:37 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-12 08:37 . 2009-10-12 08:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-12 05:45 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-12 05:45 . 2009-10-12 05:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-12 05:45 . 2009-10-12 05:45 -------- d-----w- c:\programdata\Malwarebytes
2009-10-12 05:45 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-11 17:53 . 2009-10-11 17:53 -------- d-----w- C:\rsit
2009-09-16 17:54 . 2009-06-10 12:07 2855424 ----a-w- c:\windows\system32\mf.dll
2009-09-16 17:54 . 2009-06-10 12:07 98816 ----a-w- c:\windows\system32\mfps.dll
2009-09-16 17:54 . 2009-06-10 10:14 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2009-09-16 17:54 . 2009-06-10 10:15 24576 ----a-w- c:\windows\system32\mfpmp.exe
2009-09-16 17:54 . 2009-06-10 08:50 2048 ----a-w- c:\windows\system32\mferror.dll
2009-09-16 17:54 . 2009-07-11 19:32 502272 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-16 17:54 . 2009-07-11 19:32 297984 ----a-w- c:\windows\system32\wlansec.dll
2009-09-16 17:54 . 2009-07-11 19:32 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-16 17:54 . 2009-07-11 19:32 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2009-09-16 17:54 . 2009-07-11 19:26 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-16 17:54 . 2009-07-11 19:32 47104 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-16 17:54 . 2009-08-29 03:41 1686528 ----a-w- c:\windows\system32\gameux.dll
2009-09-16 17:53 . 2009-08-29 03:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-16 17:53 . 2009-08-28 23:31 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-12 06:26 . 2007-06-16 14:31 82010 ----a-w- c:\windows\system32\perfc005.dat
2009-10-12 06:26 . 2007-06-16 14:31 475866 ----a-w- c:\windows\system32\perfh005.dat
2009-10-11 19:07 . 2009-07-01 21:00 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-10-11 17:53 . 2009-06-10 11:52 -------- d-----w- c:\program files\trend micro
2009-09-28 18:14 . 2007-11-07 18:18 -------- d-----w- c:\program files\Java
2009-09-28 12:13 . 2009-07-01 20:11 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-09-28 12:12 . 2009-07-01 20:11 179792 ----a-w- c:\windows\system32\guard32.dll
2009-09-28 12:12 . 2009-07-01 20:11 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-09-28 12:12 . 2009-07-01 20:11 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-09-16 18:00 . 2007-11-06 12:42 -------- d-----w- c:\programdata\Microsoft Help
2009-09-16 14:40 . 2009-05-31 18:21 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-04 14:46 . 2009-09-04 14:46 -------- d-----w- c:\program files\Software602
2009-08-26 08:48 . 2008-02-15 18:18 -------- d-----w- c:\program files\QIP
2009-08-25 16:16 . 2008-10-21 15:22 -------- d-----w- c:\program files\Canon
2009-08-25 15:08 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-08-25 14:53 . 2007-11-06 12:41 -------- d-----w- c:\program files\Microsoft Works
2009-08-25 14:46 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-14 17:16 . 2009-09-16 17:57 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2009-08-14 16:42 . 2009-09-16 17:57 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2009-08-14 16:40 . 2009-09-16 17:57 103936 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:40 . 2009-09-16 17:57 15360 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:25 . 2009-09-16 17:57 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:25 . 2009-09-16 17:57 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:25 . 2009-09-16 17:57 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:25 . 2009-09-16 17:57 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:25 . 2009-09-16 17:57 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:25 . 2009-09-16 17:57 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 14:25 . 2009-09-16 17:57 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:24 . 2009-09-16 17:57 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 14:23 . 2009-09-16 17:57 22016 ----a-w- c:\windows\system32\netiougc.exe
2009-07-25 03:23 . 2008-12-07 09:28 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-18 12:17 . 2009-07-29 05:47 827392 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 12:10 . 2009-07-29 05:47 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-07-18 12:10 . 2009-07-29 05:47 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 12:07 . 2009-07-29 05:47 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-18 10:00 . 2009-07-29 05:47 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 08:34 . 2009-07-29 05:47 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-07-17 14:52 . 2009-08-24 09:19 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:02 . 2009-08-19 14:39 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 13:01 . 2009-08-19 14:38 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 13:00 . 2009-08-19 14:39 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 11:11 . 2009-08-19 14:38 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2008-03-08 14:52 . 2008-03-01 11:31 608 --sha-w- c:\windows\System32\winzvprt5.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-10-11_18.52.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-06-16 14:31 . 2009-10-11 17:37 51336 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-06-16 14:31 . 2009-10-11 19:02 51336 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-11 19:03 73006 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2007-11-06 12:38 . 2009-10-11 17:38 16008 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1933546822-1088246273-3117313979-1000_UserData.bin
+ 2007-11-06 12:38 . 2009-10-11 19:03 16008 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1933546822-1088246273-3117313979-1000_UserData.bin
+ 2007-11-06 12:32 . 2009-10-11 18:57 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-11-06 12:32 . 2009-10-11 17:33 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-11-06 12:32 . 2009-10-11 18:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-11-06 12:32 . 2009-10-11 17:33 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-11-06 12:32 . 2009-10-11 17:33 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-11-06 12:32 . 2009-10-11 18:57 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-12 08:29 . 2009-10-12 08:29 9560 c:\windows\System32\networklist\icons\{D98E401F-38B0-48EA-99D5-469DFAB5F230}_48.bin
+ 2009-10-12 08:29 . 2009-10-12 08:29 4280 c:\windows\System32\networklist\icons\{D98E401F-38B0-48EA-99D5-469DFAB5F230}_32.bin
+ 2009-10-12 08:29 . 2009-10-12 08:29 2456 c:\windows\System32\networklist\icons\{D98E401F-38B0-48EA-99D5-469DFAB5F230}_24.bin
+ 2006-11-02 10:33 . 2009-10-12 06:26 612436 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-12 06:26 104158 c:\windows\System32\perfc009.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-06-16 1006264]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-28 1799952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-04-10 4431872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]

c:\users\u§ivatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-1-15 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1EAF3F70-E596-43D4-B596-950A0420343C}"= Profile=Private|c:\program files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"{E35DB22D-F6C9-4231-B703-C6CDAC87FB96}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{FE16C0AE-64A1-4419-968E-208EF0EE09D4}d:\\marek\\qip\\qip.exe"= UDP:d:\marek\qip\qip.exe:Quiet Internet Pager
"UDP Query User{14D9443F-6686-4CD2-AE91-22BD72E51666}d:\\marek\\qip\\qip.exe"= TCP:d:\marek\qip\qip.exe:Quiet Internet Pager
"{8D9F82BD-2787-4060-B12B-37B4CE3BF8FE}"= UDP:c:\program files\HP\hp laserjet m2727\Fax Config utility0.exe:HP Networked Printer Installer
"{EE2EC9F2-B88F-421E-AFDA-C6C08CF155A6}"= TCP:c:\program files\HP\hp laserjet m2727\Fax Config utility0.exe:HP Networked Printer Installer
"TCP Query User{5B31CE86-7052-44FF-A404-E3051116AFEB}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{C7DF17A1-F02F-4481-9AF4-C7DA9C544D43}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{2D966BD5-F1FF-4DD6-829F-DE0342AB3493}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{9F87F4CD-1BB7-4C52-AB47-7866B22E6EAD}c:\\windows\\explorer.exe"= UDP:c:\windows\explorer.exe:Průzkumník Windows
"UDP Query User{FF1FD878-723E-4112-81CF-BC2B0A8AA10E}c:\\windows\\explorer.exe"= TCP:c:\windows\explorer.exe:Průzkumník Windows
"{E1BB9A0F-B878-4956-8AF0-BB52C511B03B}"= UDP:c:\windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process
"{E6BCCE07-11EA-427C-80BA-D9F6518EB385}"= TCP:c:\windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process
"{D4BB5886-6160-4D1A-BE3F-3B881C321170}"= Disabled:c:\program files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"{FA19396A-544D-4795-8F0F-F88C856306CF}"= UDP:c:\windows\System32\spoolsv.exe:HP Networked Printer Installer
"{9E0457BB-F760-4D7C-8EB1-9406A83A8F6E}"= TCP:c:\windows\System32\spoolsv.exe:HP Networked Printer Installer

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [1.7.2009 22:11 29520]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [16.6.2007 16:41 46592]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [1.4.2009 21:27 4232704]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [1.7.2009 22:11 128888]
S3 HPFXFAX;HPFXFAX;c:\windows\System32\drivers\hpfxfax.sys [1.3.2008 13:26 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Obsah adresáře 'Naplánované úlohy'

2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{D9A28F2E-C6BA-4C19-B173-9CCB15C48B44}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]

2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{EAD53FA0-58C7-47C4-9253-6EE534845340}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.sanbohemia.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ctivex.cab
DPF: {F680B28A-3AEE-4C88-93ED-45AE9215C128} - hxxp://adisepo.mfcr.cz/adistc/adis/idpr_pub/hlib/bin/cryptsignx.cab
FF - ProfilePath - c:\users\uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\92ffgizp.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-RunOnce-<NO NAME> - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-12 10:37
Windows 6.0.6000 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000002e
.
Celkový čas: 2009-10-12 10:39
ComboFix-quarantined-files.txt 2009-10-12 08:39
ComboFix2.txt 2009-10-11 18:54

Před spuštěním: Volných bajtů: 54 921 330 688
Po spuštění: Volných bajtů: 54 615 412 736

219 --- E O F --- 2009-09-28 12:16

[dmitrijsadlo]

Prosim Vas o odpved, radcove, s pocitacem potrebuji pracovat (maily, banka, atd.). Pokud si myslite, ze je system v pr.eli, mam se chystat na reinstal Windows?
Veskere programy a logy zde jsou tvoreny v nouzovem rezimu, to by ale na veci nemelo mit zadny vliv, ne?

[dmitrijsadlo]

Pridavam log z DDS, v jinych threadech byl casto zadan:

DDS (Ver_09-10-12.01) - NTFSx86 NETWORK
Run by u§ivatel at 14:36:12,96 on po 12.10.2009
Internet Explorer: 7.0.6000.16890 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.420.1029.18.1022.571 [GMT 2:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
SP: COMODO Defense+ *enabled* (Updated) {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: avast! antivirus 4.8.1335 [VPS 090417-0] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\Marek\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com/
uURLSearchHooks: H - No File
BHO: Podpora odkazu pro Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\uivate~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ctivex.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F680B28A-3AEE-4C88-93ED-45AE9215C128} - hxxp://adisepo.mfcr.cz/adistc/adis/idpr_pub/hlib/bin/cryptsignx.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\windows\system32\guard32.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\uivate~1\appdata\roaming\mozilla\firefox\profiles\92ffgizp.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.default.XMLHttpRequest.channel", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("security.checkloaduri", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("bidi.characterset", 1);
c:\program files\mozilla firefox\defaults\pref\channel-prefs.js - pref("app.update.channel", "release");
c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");

============= SERVICES / DRIVERS ===============

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-7-1 29520]
R3 itecir;ITECIR Infrared Receiver;c:\windows\system32\drivers\itecir.sys [2007-6-16 46592]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-4-1 4232704]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-7-1 128888]
S3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2008-3-1 14336]

=============== Created Last 30 ================

2009-10-12 13:34 19,286 a------- C:\cleanup.exe
2009-10-12 10:39 <DIR> --dsh--- C:\$RECYCLE.BIN
2009-10-12 07:45 <DIR> --d----- c:\users\uivate~1\appdata\roaming\Malwarebytes
2009-10-12 07:45 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-12 07:45 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-10-12 07:45 <DIR> --d----- c:\programdata\Malwarebytes
2009-10-12 07:45 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-10-12 07:45 <DIR> --d----- c:\progra~2\Malwarebytes
2009-09-16 19:53 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-09-16 19:53 4,247,552 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-16 18:21 3,426 a------- c:\windows\WTRAN32.INI

==================== Find3M ====================

2009-10-12 14:36 4,718,592 a--sh--- c:\users\uživatel\ntuser.dat
2009-10-12 13:39 476,852 a------- c:\windows\system32\perfh005.dat
2009-10-12 13:39 82,594 a------- c:\windows\system32\perfc005.dat
2009-10-11 21:07 1,474,832 a------- c:\windows\system32\drivers\sfi.dat
2009-09-28 14:12 179,792 a------- c:\windows\system32\guard32.dll
2009-09-28 14:12 29,520 a------- c:\windows\system32\drivers\cmdhlp.sys
2009-09-28 14:12 128,888 a------- c:\windows\system32\drivers\cmdguard.sys
2009-08-29 05:41 1,686,528 a------- c:\windows\system32\gameux.dll
2009-08-29 05:40 449,024 a------- c:\windows\apppatch\AcSpecfc.dll
2009-08-29 05:40 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-08-29 05:40 2,143,744 a------- c:\windows\apppatch\AcGenral.dll
2009-08-29 05:40 537,600 a------- c:\windows\apppatch\AcLayers.dll
2009-08-29 01:15 2,560 a------- c:\windows\apppatch\AcRes.dll
2009-08-25 18:15 86,016 a------- c:\windows\inf\infstrng.dat
2009-08-25 18:15 51,200 a------- c:\windows\inf\infpub.dat
2009-08-25 18:09 86,016 a------- c:\windows\inf\infstor.dat
2009-08-25 17:08 665,600 a------- c:\windows\inf\drvindex.dat
2009-08-14 19:16 213,592 a------- c:\windows\system32\drivers\netio.sys
2009-08-14 18:42 167,424 a------- c:\windows\system32\tcpipcfg.dll
2009-08-14 18:40 103,936 a------- c:\windows\system32\netiohlp.dll
2009-08-14 18:40 15,360 a------- c:\windows\system32\netevent.dll
2009-08-14 16:25 9,728 a------- c:\windows\system32\TCPSVCS.EXE
2009-08-14 16:25 17,920 a------- c:\windows\system32\ROUTE.EXE
2009-08-14 16:25 11,264 a------- c:\windows\system32\MRINFO.EXE
2009-08-14 16:25 27,136 a------- c:\windows\system32\NETSTAT.EXE
2009-08-14 16:25 19,968 a------- c:\windows\system32\ARP.EXE
2009-08-14 16:25 10,240 a------- c:\windows\system32\finger.exe
2009-08-14 16:25 8,704 a------- c:\windows\system32\HOSTNAME.EXE
2009-08-14 16:24 813,568 a------- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:23 22,016 a------- c:\windows\system32\netiougc.exe
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-18 14:17 827,392 a------- c:\windows\system32\wininet.dll
2009-07-18 14:10 56,320 a------- c:\windows\system32\iesetup.dll
2009-07-18 14:10 78,336 a------- c:\windows\system32\ieencode.dll
2009-07-18 14:10 52,736 a------- c:\windows\apppatch\iebrshim.dll
2009-07-18 14:07 72,704 a------- c:\windows\system32\admparse.dll
2009-07-18 12:00 26,624 a------- c:\windows\system32\ieUnatt.exe
2009-07-18 10:34 48,128 a------- c:\windows\system32\mshtmler.dll
2009-07-17 16:52 71,680 a------- c:\windows\system32\atl.dll
2009-07-14 15:02 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-07-14 15:01 4,096 a------- c:\windows\system32\dxmasf.dll
2009-07-14 15:00 7,680 a------- c:\windows\system32\spwmp.dll
2008-12-14 04:18 174 a--sh--- c:\program files\desktop.ini
2008-06-07 17:49 48 a---h--- c:\programdata\ezsidmv.dat
2008-06-07 17:49 48 a---h--- c:\progra~2\ezsidmv.dat
2008-01-08 16:17 16 a------- c:\users\uživatel\p1FG21.dll
2008-01-03 19:31 32 a------- c:\programdata\ezsid.dat
2008-01-03 19:31 32 a------- c:\progra~2\ezsid.dat
2007-06-16 16:29 286,912 a------- c:\windows\inf\perflib\0405\perfi.dat
2007-06-16 16:29 286,912 a------- c:\windows\inf\perflib\0405\perfh.dat
2007-06-16 16:29 34,724 a------- c:\windows\inf\perflib\0405\perfd.dat
2007-06-16 16:29 34,724 a------- c:\windows\inf\perflib\0405\perfc.dat
2006-11-02 11:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 11:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 11:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 11:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2009-07-13 14:11 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-07-13 14:11 32,768 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-07-13 14:11 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2008-03-08 16:52 608 a--sh--- c:\windows\system32\winzvprt5.sys
2009-04-18 18:34 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009041820090419\index.dat

============= FINISH: 14:37:57,60 ===============

[Rudy]

Logy vypadají čisté. Jen CF hlásí, že v PC máte 2 antiviry. 1 odinstalujte. Rez štíty mohou navzájem kolidovat.

[dmitrijsadlo]

No nic, po reinsta Woken vypada v poradku. Dekuju za rady i tak!
Jaky byste doporucil spolehlivy Internet Security klient? Mam na mysli nejaky balik - Eset, Norton, atp.?

[Rudy]

ESS by vám jako home userovi mohl stačit. Možná by se dalo uvažovat ještě o KIS. Nemáte zač!

[K.Lane]

Ahoj mám stejný problém, snažím se odinstalovat antivir ale v nouzovém režimu to nejde a na normální se nepřihlásím ihned se vypne. Díky za rady