VIRY.CZ

Prosím o kontrolu logu z HijackThis,děkuji.



Logfile of HijackThis v1.99.1
Scan saved at 13:15:22, on 8.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\system32\wscntfy.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\HP\Office-Web Center\panel.exe
C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\ParadisePoker\poker.exe
C:\Program Files\ParadisePoker\browserhost.exe
C:\instalace\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lexmark.com/MD/?func=newreg& ... os=5&src=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\listicka.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
O4 - Global Startup: NewShortcut1.lnk = ?
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Betway Casino - {3063c161-2f7e-4225-ba73-08bc8f64c67e} - C:\Program Files\Betway\Casino\casinogame.exe
O9 - Extra button: Betway.com Poker - {4CBB5C71-1BA0-49ca-93CD-159AF8AA0CC9} - C:\Program Files\Betway\Poker\MPPoker.exe
O9 - Extra button: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8630087250
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Spyware Terminator Clam Service (sp_clamsrv) - Crawler.com - C:\Program Files\WinClamAVShield\sp_clamsrv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

omlouvám se za zpoždění

ComboFix 10-02-26.03 - Petr 27.02.2010 15:49:06.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.511.147 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Hook.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-27 do 2010-02-27 )))))))))))))))))))))))))))))))
.

2010-02-15 22:42 . 2010-02-15 22:42 -------- d-----w- C:\Casino
2010-02-01 19:16 . 2010-02-01 19:17 -------- d-----w- C:\sql2ksp3

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 14:40 . 2008-11-24 22:32 -------- d-----w- c:\program files\Vidalia Bundle
2010-02-27 14:37 . 2007-05-04 15:18 -------- d-----w- c:\program files\ESET
2010-02-20 11:07 . 2007-08-15 05:14 -------- d-----w- c:\program files\Spyware Terminator
2010-02-18 09:37 . 2009-09-21 18:19 -------- d-----w- c:\program files\ParadisePoker
2010-02-09 15:15 . 2009-12-23 07:15 -------- d-----w- c:\program files\Betway
2010-02-06 16:22 . 2007-05-16 09:23 -------- d-----w- c:\program files\Google
2010-01-28 11:51 . 2010-01-28 11:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-28 11:49 . 2010-01-28 11:49 -------- d-----w- c:\program files\Common Files\Skype
2010-01-28 11:49 . 2007-05-04 14:40 -------- d-----r- c:\program files\Skype
2010-01-19 07:30 . 2001-10-25 14:00 63148 ----a-w- c:\windows\system32\perfc005.dat
2010-01-19 07:30 . 2001-10-25 14:00 382548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-01 18:10 . 2009-12-21 20:52 -------- d-----w- c:\program files\StepMania
2010-01-01 17:48 . 2010-01-01 17:48 -------- d-----w- c:\program files\ScummVM
2010-01-01 16:19 . 2010-01-01 16:20 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-01 16:19 . 2007-05-16 07:49 -------- d-----w- c:\program files\Java
2009-12-23 17:01 . 2009-12-23 17:02 389632 ----a-w- c:\windows\system32\CF25078.exe
2007-09-17 09:52 . 2007-09-17 09:52 774144 ----a-w- c:\program files\RngInterstitial.dll
.

------- Sigcheck -------

[7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-03 . 6A603809F598332DBEDD535BDBCE313E . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys
[-] 2002-08-29 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-12-23_17.26.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-27 14:46 . 2010-02-27 14:46 16384 c:\windows\temp\Perflib_Perfdata_1fc.dat
+ 2001-10-25 14:00 . 2010-01-19 07:30 53608 c:\windows\system32\perfc009.dat
- 2001-10-25 14:00 . 2009-10-25 09:51 53608 c:\windows\system32\perfc009.dat
+ 2007-08-15 06:24 . 2004-08-17 13:49 98304 c:\windows\system32\dllcache\wmpband.dll
+ 2007-05-04 09:21 . 2004-08-17 13:49 30208 c:\windows\system32\dllcache\wabmig.exe
+ 2007-05-04 09:21 . 2004-08-17 13:49 84992 c:\windows\system32\dllcache\wabimp.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 61440 c:\windows\system32\dllcache\rrcm.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 35328 c:\windows\system32\dllcache\oemiglib.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 60416 c:\windows\system32\dllcache\oemig50.exe
+ 2007-05-04 09:20 . 2004-08-17 13:49 81920 c:\windows\system32\dllcache\nmchat.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 77824 c:\windows\system32\dllcache\nmcom.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 28672 c:\windows\system32\dllcache\nmasnt.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 57344 c:\windows\system32\dllcache\mst123.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 57344 c:\windows\system32\dllcache\h323cc.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 40960 c:\windows\system32\dllcache\dcap32.dll
+ 2007-08-15 06:24 . 2004-08-17 13:49 28672 c:\windows\system32\dllcache\custsat.dll
+ 2007-05-04 09:21 . 2004-08-17 13:49 45056 c:\windows\system32\dllcache\confmrsl.dll
+ 2010-02-06 16:22 . 2010-02-06 16:22 22528 c:\windows\Installer\1bc42ea.msi
+ 2010-01-01 16:25 . 2010-01-01 16:25 49936 c:\windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2010-02-01 19:03 . 2010-02-01 19:03 16384 c:\windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll
+ 2010-02-01 19:11 . 2010-02-01 19:11 64088 c:\windows\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 5632 c:\windows\system32\dllcache\wmm2res2.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 7680 c:\windows\system32\dllcache\wmm2ext.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 4096 c:\windows\system32\dllcache\wmm2eres.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 4639 c:\windows\system32\dllcache\mplayer2.exe
+ 2010-02-01 19:03 . 2010-02-01 19:13 7168 c:\windows\Installer\{90260405-6000-11D3-8CFE-0150048383C9}\owcico.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2010-02-01 19:03 . 2010-02-01 19:03 4096 c:\windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll
+ 2001-10-25 14:00 . 2010-01-19 07:30 383254 c:\windows\system32\perfh009.dat
- 2001-10-25 14:00 . 2009-10-25 09:51 383254 c:\windows\system32\perfh009.dat
+ 2010-01-01 16:20 . 2010-01-01 16:19 149280 c:\windows\system32\javaws.exe
+ 2010-01-01 16:19 . 2010-01-01 16:19 145184 c:\windows\system32\javaw.exe
+ 2010-01-01 16:19 . 2010-01-01 16:19 145184 c:\windows\system32\java.exe
+ 2007-08-15 06:24 . 2004-08-17 13:49 221184 c:\windows\system32\dllcache\wmpns.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 325632 c:\windows\system32\dllcache\wmm2fxb.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 502272 c:\windows\system32\dllcache\wmm2fxa.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 402432 c:\windows\system32\dllcache\wmm2filt.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 167936 c:\windows\system32\dllcache\wmm2ae.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 774144 c:\windows\system32\dllcache\setup_wm.exe
+ 2007-05-04 09:21 . 2004-08-17 13:49 104448 c:\windows\system32\dllcache\oeimport.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 151552 c:\windows\system32\dllcache\nmft.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 229376 c:\windows\system32\dllcache\nmas.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 221184 c:\windows\system32\dllcache\nac.dll
+ 2007-05-04 09:20 . 2004-08-17 13:49 274432 c:\windows\system32\dllcache\mst120.dll
+ 2007-08-15 06:24 . 2004-08-17 13:49 786432 c:\windows\system32\dllcache\migrate.exe
+ 2007-05-04 09:19 . 2004-08-17 13:49 543232 c:\windows\system32\dllcache\dialer.exe
+ 2007-05-04 09:20 . 2004-08-17 13:49 385024 c:\windows\system32\dllcache\callcont.dll
+ 2010-01-01 16:25 . 2010-01-01 16:25 360448 c:\windows\Installer\795c5.msi
+ 2010-01-01 16:19 . 2010-01-01 16:19 537600 c:\windows\Installer\795bd.msi
+ 2010-02-01 19:03 . 2010-02-01 19:03 600576 c:\windows\Installer\6b5c68.msi
+ 2010-02-01 19:03 . 2010-02-01 19:03 556032 c:\windows\Installer\6b5c63.msi
+ 2010-01-28 11:50 . 2010-01-28 11:50 794112 c:\windows\Installer\30566.msi
+ 2010-01-28 11:49 . 2010-01-28 11:49 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2010-02-01 19:03 . 2010-02-01 19:14 135168 c:\windows\Installer\{90A40405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2010-02-01 19:03 . 2010-02-01 19:13 135168 c:\windows\Installer\{90260405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2010-02-01 19:11 . 2010-02-01 19:11 135168 c:\windows\Installer\{901C0405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2010-02-01 19:11 . 2010-02-01 19:11 593920 c:\windows\Installer\{901C0405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2007-05-04 10:21 . 2007-05-04 10:21 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2007-05-04 10:21 . 2010-02-01 19:18 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2010-02-01 19:11 . 2010-02-01 19:11 223800 c:\windows\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\OFFICE.DLL
+ 2010-02-01 19:03 . 2010-02-01 19:03 229376 c:\windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL
+ 2010-02-01 19:03 . 2010-02-01 19:03 110592 c:\windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
+ 2007-08-15 06:23 . 2004-08-17 13:49 4263936 c:\windows\system32\dllcache\wmm2res.dll
+ 2010-02-01 19:11 . 2010-02-01 19:11 1668608 c:\windows\Installer\6b5c6e.msi
+ 2003-10-29 22:11 . 2003-10-29 22:11 4726784 c:\windows\Installer\6b5c6a.msp
+ 2010-01-28 11:49 . 2010-01-28 11:49 1565696 c:\windows\Installer\30560.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-11-07 95536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-12 39408]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2009-10-15 5238258]
"Google Update"="c:\documents and settings\Petr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-01-11 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"AudioDeck"="c:\program files\VIAudioi\SBADeck\ADeck.exe" [2006-07-26 540672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-01 149280]
"QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2006-09-01 282624]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-05-05 1817600]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-11-07 54576]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-07-11 73728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
NewShortcut1.lnk - c:\program files\HP\Office-Web Center\panel.exe [2008-2-5 233472]
Privoxy.lnk - c:\program files\Vidalia Bundle\Privoxy\privoxy.exe [2006-11-20 250368]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-17 13:49 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDVD]
2003-09-05 14:25 409600 ----a-w- c:\program files\CyberLink\PowerDVD\PowerDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Casino\\ParadiseCasino\\casino.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10412:TCP"= 10412:TCP:BitComet 10412 TCP
"10412:UDP"= 10412:UDP:BitComet 10412 UDP

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [15.8.2007 6:16 141312]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.3.2008 18:35 716272]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.2.2010 17:22 135664]
S3 tap0901_2gm;VPN Anonymizer Adapter;c:\windows\system32\drivers\tap0901_2gm.sys [21.6.2007 16:21 30720]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:22]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:22]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.lexmark.com/MD/?func=newreg&lang=15 ... os=5&src=1
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - c:\program files\Seznam.cz\listicka.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 15:58
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\program files\VIAudioi\SBADeck\ADeck.exe 1??????w????c:\docume~1\Petr?$?w???w????$????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-02-27 16:02:26
ComboFix-quarantined-files.txt 2010-02-27 15:02
ComboFix2.txt 2010-01-08 20:12

Před spuštěním: 347 136 000
Po spuštění: 2 088 472 576

- - End Of File - - CE5E0D6292E44795ACEFF2EBC254916F

1 položka smazána, zbytek logu vypadá čistý.