VIRY.CZ

Zdravím,

mám problém. Prý je v PC rootkit a svchost jede na 100%.
Můžete mi prosím poradit jak to napravit?
PC bylo zavirováno, nešla spustit ani instalace NODU - pročistil jsem to ccleanerem, atd... a nakonec jsem spustil instalaci noda, ale ten nic nenasel.

Prosím o radu a předem děkuji.
Přikládám log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Miroslav at 2010-01-15 20:15:31
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 10 GB (48%) free of 20 GB
Total RAM: 446 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:15:44, on 15.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\S3Trayp.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Miroslav\Local Settings\Temporary Internet Files\Content.IE5\3C64Y9KH\RSIT[1].exe
C:\Program Files\trend micro\Miroslav.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [S3Trayp] S3Trayp.exe
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [CS Update] copy /Y "C:\WINDOWS\system32\msxml71.dll.upd" "C:\WINDOWS\system32\msxml71.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Supermapy - {040A5B37-8C14-4003-AD95-EB8B22CE09CB} - http://www.supermapy.cz (file missing) (HKCU)
O9 - Extra button: Počasí - {0C184FDE-1053-4CD0-A081-E6AB38D3F41A} - http://pocasi.centrum.cz (file missing) (HKCU)
O9 - Extra button: Bleskově - {3016D271-39D3-485D-9A95-8A095DE3B823} - http://www.bleskove.cz (file missing) (HKCU)
O9 - Extra button: Fotoalba - {33776F2F-9133-4CF7-B2EA-5A5C2EB20F5B} - http://www.fotoalba.cz (file missing) (HKCU)
O9 - Extra button: Centrum.cz - {4E1E92DD-DF59-45CC-B91A-D48CB9A3069B} - http://www.centrum.cz (file missing) (HKCU)
O9 - Extra button: Stahuj.cz - {917FF16C-1FF6-46A4-90A2-9A96B9973ADA} - http://www.stahuj.cz (file missing) (HKCU)
O9 - Extra button: Žena.cz - {B2E73AC1-2A6A-4BB3-BBDC-66A9615F2E0D} - http://www.zena.cz (file missing) (HKCU)
O9 - Extra button: Slovníky - {E9BA293F-6252-4BA4-BBCB-584C304D90AB} - http://slovniky.centrum.cz (file missing) (HKCU)
O9 - Extra button: Aktuálně - {F1F9B2C9-02B3-40DA-8399-40C1B541ACAB} - http://aktualne.centrum.cz (file missing) (HKCU)
O9 - Extra button: Xchat.cz - {F5CCFC8E-C124-460B-AECD-C373819517E6} - http://www.xchat.cz (file missing) (HKCU)
O15 - Trusted Zone: http://email.seznam.cz
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 3399066875
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://proxynet.mbudejovice.cz:3333/plugin/h263ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{58C95925-BAE2-4C2E-A92F-6B3E65FE48FF}: NameServer = 10.0.0.22,212.80.66.7
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8404 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{08E03BCB-9BF0-425B-89C3-78ACE9E0F26B}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-12 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
{2C688203-7EB3-4327-9995-1CB417BA23F9} - BS.Player ControlBar - C:\Program Files\BS.Player ControlBar\BSToolbar.dll [2008-10-08 859592]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2009-06-01 962808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-01-12 149280]
"SMSERIAL"=C:\WINDOWS\sm56hlpr.exe [2006-04-05 565248]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-08-11 794714]
"S3Trayp"=C:\WINDOWS\system32\S3Trayp.exe [2006-07-11 176128]
"MSSE"=C:\Program Files\Microsoft Security Essentials\msseces.exe [2009-09-13 1048392]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
C:\WINDOWS\system32\VTTimer.exe [2006-08-03 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2009-01-15 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^siszyd32.exe]
C:\Documents and Settings\Miroslav\Nabídka Start\Programy\Po spuštění\siszyd32.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-01-15 20:15:31 ----D---- C:\rsit
2010-01-15 20:15:31 ----D---- C:\Program Files\trend micro
2010-01-13 16:51:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-01-13 14:35:21 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2010-01-13 14:31:34 ----D---- C:\Program Files\Microsoft Security Essentials
2010-01-13 13:27:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2010-01-13 13:26:16 ----D---- C:\WINDOWS\ie8updates
2010-01-13 13:22:48 ----HDC---- C:\WINDOWS\ie8
2010-01-13 13:19:58 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2010-01-13 12:48:02 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 12:47:56 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-01-13 12:47:14 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-01-13 12:47:07 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-01-13 12:46:52 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-01-13 12:43:22 ----A---- C:\ComboFix.txt
2010-01-13 12:27:58 ----A---- C:\WINDOWS\system32\tmp.txt
2010-01-13 12:27:42 ----A---- C:\rapport.txt
2010-01-13 12:18:04 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-01-13 12:17:56 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-01-13 12:14:00 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-01-13 11:02:00 ----A---- C:\WINDOWS\system32\fjhdyfhsn.bat
2010-01-13 10:54:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\SITEguard
2010-01-13 10:53:40 ----D---- C:\Program Files\STOPzilla!
2010-01-13 10:53:40 ----D---- C:\Program Files\Common Files\iS3
2010-01-13 10:53:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\STOPzilla!
2010-01-13 09:42:27 ----D---- C:\Avenger
2010-01-13 09:42:27 ----A---- C:\avenger.txt
2010-01-13 09:29:17 ----D---- C:\WINDOWS\pss
2010-01-13 08:18:51 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-01-13 08:18:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-01-12 15:33:20 ----D---- C:\totalcmd
2010-01-12 15:33:20 ----D---- C:\Documents and Settings\Miroslav\Data aplikací\GHISLER
2010-01-12 14:59:05 ----A---- C:\WINDOWS\system32\javaws.exe
2010-01-12 14:59:05 ----A---- C:\WINDOWS\system32\javaw.exe
2010-01-12 14:59:05 ----A---- C:\WINDOWS\system32\java.exe
2010-01-12 14:59:05 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-01-12 11:22:24 ----D---- C:\WINDOWS\temp
2010-01-12 10:59:25 ----A---- C:\WINDOWS\zip.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\SWSC.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\SWREG.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\sed.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\NIRCMD.exe
2010-01-12 10:59:25 ----A---- C:\WINDOWS\grep.exe
2010-01-12 10:59:20 ----D---- C:\WINDOWS\ERDNT
2010-01-12 10:57:46 ----AD---- C:\Qoobox
2010-01-12 10:46:08 ----D---- C:\Program Files\Registry Easy

======List of files/folders modified in the last 1 months======

2010-01-15 20:15:37 ----D---- C:\WINDOWS\Prefetch
2010-01-15 20:15:31 ----RD---- C:\Program Files
2010-01-15 20:12:48 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-15 20:10:10 ----D---- C:\WINDOWS
2010-01-15 20:08:07 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-15 20:03:29 ----HD---- C:\WINDOWS\inf
2010-01-13 17:11:26 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-01-13 17:11:23 ----D---- C:\WINDOWS\system32
2010-01-13 16:53:22 ----SHD---- C:\WINDOWS\Installer
2010-01-13 16:52:44 ----D---- C:\WINDOWS\system32\drivers
2010-01-13 16:51:37 ----D---- C:\Program Files\Eset
2010-01-13 16:45:36 ----SD---- C:\WINDOWS\Tasks
2010-01-13 14:31:40 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-01-13 14:18:09 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-13 14:18:08 ----D---- C:\WINDOWS\system32\cs-cz
2010-01-13 14:18:07 ----D---- C:\WINDOWS\Media
2010-01-13 14:18:07 ----D---- C:\WINDOWS\Help
2010-01-13 14:18:07 ----D---- C:\Program Files\Internet Explorer
2010-01-13 14:17:24 ----D---- C:\WINDOWS\security
2010-01-13 13:27:08 ----A---- C:\WINDOWS\imsins.BAK
2010-01-13 13:26:31 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-13 12:52:31 ----D---- C:\WINDOWS\AppPatch
2010-01-13 12:45:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-13 12:41:07 ----A---- C:\WINDOWS\system.ini
2010-01-13 12:38:36 ----D---- C:\Program Files\Common Files
2010-01-13 12:26:26 ----A---- C:\WINDOWS\ntbtlog.txt
2010-01-13 11:04:23 ----D---- C:\WINDOWS\Minidump
2010-01-13 10:53:45 ----D---- C:\WINDOWS\WinSxS
2010-01-13 10:16:36 ----A---- C:\WINDOWS\DUMP56ab.tmp
2010-01-13 09:43:09 ----D---- C:\Documents and Settings\Miroslav\Data aplikací\ICQ
2010-01-13 09:30:21 ----RSH---- C:\boot.ini
2010-01-13 09:30:21 ----A---- C:\WINDOWS\win.ini
2010-01-13 09:18:29 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-12 14:57:25 ----D---- C:\Program Files\Java
2010-01-12 11:05:25 ----D---- C:\Program Files\ICQ6.5
2010-01-04 16:17:48 ----A---- C:\WINDOWS\system32\MRT.exe
2009-12-27 19:59:02 ----A---- C:\WINDOWS\ShortCutInf.ini
2009-12-27 19:59:02 ----A---- C:\WINDOWS\FantasyDVD.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-18 43008]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2005-11-16 42496]
R3 HdAudAddService;VIA High Definition Audio Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2006-09-18 141824]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 S3GIGP;S3GIGP; C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2006-09-12 659456]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\WINDOWS\system32\DRIVERS\sis163u.sys [2006-07-03 217600]
R3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys [2006-04-05 891008]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-08-11 197152]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 atirage3;atirage3; C:\WINDOWS\system32\DRIVERS\atimpae.sys [2001-10-24 75136]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BTHMODEM;Ovladač pro sériovou komunikaci protokolem Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 HidBth;Miniport Bluetooth HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidbth.sys [2008-04-14 25600]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-24 6784]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-05-12 611664]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2009-06-01 222968]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-12 153376]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 GameConsoleService;GameConsoleService; C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe [2008-08-26 242424]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-09-26 355584]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

ComboFix 10-01-15.01 - Miroslav 15.01.2010 21:14:40.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.446.219 [GMT 1:00]
Spuštěný z: c:\documents and settings\Miroslav\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-15 do 2010-01-15 )))))))))))))))))))))))))))))))
.

2010-01-15 19:15 . 2010-01-15 19:15 -------- d-----w- C:\rsit
2010-01-15 19:15 . 2010-01-15 19:15 -------- d-----w- c:\program files\trend micro
2010-01-13 15:45 . 2010-01-13 15:45 -------- d-sh--w- c:\documents and settings\Miroslav\IECompatCache
2010-01-13 15:45 . 2010-01-13 15:45 -------- d-sh--w- c:\documents and settings\Miroslav\PrivacIE
2010-01-13 13:35 . 2009-11-02 19:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 13:31 . 2010-01-13 13:31 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-01-13 13:18 . 2010-01-13 13:18 -------- d-sh--w- c:\documents and settings\Miroslav\IETldCache
2010-01-13 12:26 . 2009-10-29 07:43 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-13 12:26 . 2009-10-29 07:43 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-13 12:26 . 2010-01-13 12:26 -------- d-----w- c:\windows\ie8updates
2010-01-13 12:25 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-13 12:22 . 2010-01-13 12:24 -------- dc-h--w- c:\windows\ie8
2010-01-13 11:18 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-13 10:02 . 2010-01-13 10:02 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2010-01-13 09:53 . 2010-01-13 11:50 -------- d-----w- c:\program files\STOPzilla!
2010-01-13 09:53 . 2010-01-13 09:53 -------- d-----w- c:\program files\Common Files\iS3
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\UC.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\RAR.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\LHA.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\ARJ.PIF
2010-01-12 14:33 . 2010-01-12 15:09 -------- d-----w- C:\totalcmd
2010-01-12 13:59 . 2010-01-12 13:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-12 09:46 . 2010-01-12 09:52 -------- d-----w- c:\program files\Registry Easy
2010-01-05 18:51 . 2010-01-15 20:19 763904 ----a-w- c:\windows\system32\drivers\aseripkx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-13 15:51 . 2008-05-16 16:48 -------- d-----w- c:\program files\Eset
2010-01-13 11:45 . 2004-08-18 12:00 63526 ----a-w- c:\windows\system32\perfc005.dat
2010-01-13 11:45 . 2004-08-18 12:00 383060 ----a-w- c:\windows\system32\perfh005.dat
2010-01-13 11:41 . 2010-01-13 11:34 1056 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-01-13 11:36 . 2010-01-13 11:33 1992 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-01-13 09:16 . 2008-05-06 19:58 98304 ----a-w- c:\windows\DUMP56ab.tmp
2010-01-12 13:57 . 2008-05-06 18:21 -------- d-----w- c:\program files\Java
2010-01-12 10:05 . 2009-10-13 17:28 -------- d-----w- c:\program files\ICQ6.5
2009-11-21 16:03 . 2004-08-18 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 08:06 . 2009-11-16 08:06 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-11-16 08:03 . 2009-11-16 08:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 07:56 . 2009-11-16 07:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-10-29 07:43 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-18 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-18 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-18 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-20 11:08 . 2009-10-20 11:08 339456 ----a-w- c:\windows\UIA200.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-12_10.06.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 19:32 . 2009-07-11 19:32 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80KOR.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80JPN.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ITA.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHT.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHS.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80FRA.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ESP.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ENU.dll
+ 2009-07-11 19:32 . 2009-07-11 19:32 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80DEU.dll
+ 2009-07-12 00:07 . 2009-07-12 00:07 57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80u.dll
+ 2009-07-12 00:19 . 2009-07-12 00:19 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80.dll
+ 2009-07-11 18:41 . 2009-07-11 18:41 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
+ 2010-01-15 20:10 . 2010-01-15 20:10 16384 c:\windows\temp\Perflib_Perfdata_600.dat
- 2007-11-13 11:31 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2007-11-13 11:31 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2008-05-06 18:18 . 2009-01-07 17:20 26144 c:\windows\system32\spupdsvc.exe
+ 2008-05-07 19:11 . 2009-01-07 17:20 17952 c:\windows\system32\spmsg.dll
- 2004-08-18 12:00 . 2008-04-14 03:21 79872 c:\windows\system32\raschap.dll
+ 2004-08-18 12:00 . 2009-10-12 13:40 79872 c:\windows\system32\raschap.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 46592 c:\windows\system32\pngfilt.dll
+ 2005-10-28 23:26 . 2005-10-28 23:26 84992 c:\windows\system32\pintool.exe
+ 2004-08-18 12:00 . 2010-01-13 11:45 53942 c:\windows\system32\perfc009.dat
- 2004-08-18 12:00 . 2009-10-25 10:00 53942 c:\windows\system32\perfc009.dat
+ 2004-08-18 12:00 . 2009-10-08 13:57 22528 c:\windows\system32\oleaccrc.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20 23552 c:\windows\system32\normaliz.dll
- 2006-06-29 06:05 . 2006-06-29 06:05 23552 c:\windows\system32\normaliz.dll
+ 2006-06-28 15:59 . 2009-01-07 17:20 24576 c:\windows\system32\nlsdl.dll
- 2006-06-28 15:59 . 2006-06-28 15:59 24576 c:\windows\system32\nlsdl.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 48128 c:\windows\system32\mshtmler.dll
- 2004-08-18 12:00 . 2006-10-17 09:28 48128 c:\windows\system32\mshtmler.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 66560 c:\windows\system32\mshtmled.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 45568 c:\windows\system32\mshta.exe
- 2004-08-18 12:00 . 2006-10-17 09:56 45568 c:\windows\system32\mshta.exe
+ 2006-10-17 09:58 . 2009-03-08 03:31 13312 c:\windows\system32\msfeedssync.exe
+ 2006-11-07 19:03 . 2009-10-29 07:43 55296 c:\windows\system32\msfeedsbs.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 43008 c:\windows\system32\licmgr10.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 94720 c:\windows\system32\inseng.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 34816 c:\windows\system32\imgutil.dll
+ 2006-11-07 01:26 . 2009-03-08 03:32 36864 c:\windows\system32\ieudinit.exe
+ 2004-08-18 12:00 . 2009-03-08 03:32 71680 c:\windows\system32\iesetup.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 55808 c:\windows\system32\iernonce.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20 26112 c:\windows\system32\idndl.dll
- 2006-06-29 06:05 . 2006-06-29 06:05 26112 c:\windows\system32\idndl.dll
+ 2006-10-17 09:58 . 2009-03-08 03:31 59904 c:\windows\system32\icardie.dll
+ 2004-08-18 12:00 . 2009-10-15 16:32 81920 c:\windows\system32\fontsub.dll
- 2004-08-18 12:00 . 2009-06-16 14:40 81920 c:\windows\system32\fontsub.dll
+ 2009-10-21 05:40 . 2009-10-21 05:40 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2009-10-12 13:40 . 2009-10-12 13:40 79872 c:\windows\system32\dllcache\raschap.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 46592 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-18 12:00 . 2009-10-08 13:57 22528 c:\windows\system32\dllcache\oleaccrc.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 48128 c:\windows\system32\dllcache\mshtmler.dll
- 2004-08-18 12:00 . 2006-10-17 09:28 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 45568 c:\windows\system32\dllcache\mshta.exe
- 2004-08-18 12:00 . 2006-10-17 09:56 45568 c:\windows\system32\dllcache\mshta.exe
+ 2008-05-07 11:53 . 2009-10-29 07:43 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 43008 c:\windows\system32\dllcache\licmgr10.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 34816 c:\windows\system32\dllcache\imgutil.dll
- 2008-05-07 11:53 . 2009-08-28 10:27 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2008-05-07 11:53 . 2009-10-28 14:35 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2004-08-18 12:00 . 2009-03-08 03:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2008-05-07 11:53 . 2009-03-08 03:31 59904 c:\windows\system32\dllcache\icardie.dll
+ 2009-10-21 05:40 . 2009-10-21 05:40 25088 c:\windows\system32\dllcache\httpapi.dll
+ 2008-05-06 18:14 . 2009-03-08 03:24 68608 c:\windows\system32\dllcache\hmmapi.dll
- 2009-06-16 14:40 . 2009-06-16 14:40 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2009-06-16 14:40 . 2009-10-15 16:32 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2009-06-29 15:59 . 2009-03-08 03:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 18944 c:\windows\system32\corpol.dll
+ 2008-05-06 18:25 . 2010-01-13 10:03 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-06 18:25 . 2010-01-05 18:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-06 18:25 . 2010-01-05 18:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-05-06 18:25 . 2010-01-13 10:03 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-10-28 23:26 . 2005-10-28 23:26 26112 c:\windows\system32\bcsprsrc.dll
+ 2005-10-28 15:40 . 2005-10-28 15:40 96792 c:\windows\system32\basecsp.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 72704 c:\windows\system32\admparse.dll
+ 2010-01-13 15:52 . 2010-01-13 15:52 10134 c:\windows\Installer\{621EB5F7-B871-47C0-AB53-E1376E71D858}\callmsi.exe
+ 2010-01-13 12:26 . 2009-03-08 03:33 12288 c:\windows\ie8updates\KB976325-IE8\xpshims.dll
+ 2010-01-13 12:26 . 2009-03-08 03:31 55296 c:\windows\ie8updates\KB976325-IE8\msfeedsbs.dll
+ 2010-01-13 12:26 . 2009-03-08 03:33 25600 c:\windows\ie8updates\KB976325-IE8\jsproxy.dll
+ 2010-01-13 12:24 . 2009-03-08 15:57 58448 c:\windows\ie8\spuninst\iecustom.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 44544 c:\windows\ie8\pngfilt.dll
+ 2010-01-13 12:22 . 2006-10-17 09:28 48128 c:\windows\ie8\mshtmler.dll
+ 2010-01-13 12:22 . 2006-10-17 09:56 45568 c:\windows\ie8\mshta.exe
+ 2010-01-13 12:22 . 2006-10-17 09:58 12288 c:\windows\ie8\msfeedssync.exe
+ 2010-01-13 12:22 . 2009-10-29 07:45 52224 c:\windows\ie8\msfeedsbs.dll
+ 2010-01-13 12:22 . 2006-10-17 10:05 40960 c:\windows\ie8\licmgr10.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 27648 c:\windows\ie8\jsproxy.dll
+ 2010-01-13 12:22 . 2006-11-07 01:26 92672 c:\windows\ie8\inseng.dll
+ 2010-01-13 12:22 . 2006-10-17 09:57 36352 c:\windows\ie8\imgutil.dll
+ 2010-01-13 12:22 . 2006-11-07 01:26 55296 c:\windows\ie8\iesetup.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 44544 c:\windows\ie8\iernonce.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 78336 c:\windows\ie8\ieencode.dll
+ 2010-01-13 12:22 . 2009-10-28 14:35 70656 c:\windows\ie8\ie4uinit.exe
+ 2010-01-13 12:22 . 2009-10-29 07:45 63488 c:\windows\ie8\icardie.dll
+ 2010-01-13 12:22 . 2006-10-17 09:44 60416 c:\windows\ie8\hmmapi.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 17408 c:\windows\ie8\corpol.dll
+ 2010-01-13 12:22 . 2006-11-07 01:26 71680 c:\windows\ie8\admparse.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 44544 c:\windows\ie7updates\KB976325-IE7\pngfilt.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 52224 c:\windows\ie7updates\KB976325-IE7\msfeedsbs.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 27648 c:\windows\ie7updates\KB976325-IE7\jsproxy.dll
+ 2010-01-13 11:47 . 2009-08-28 10:27 13824 c:\windows\ie7updates\KB976325-IE7\ieudinit.exe
+ 2010-01-13 11:47 . 2009-08-29 07:30 44544 c:\windows\ie7updates\KB976325-IE7\iernonce.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 78336 c:\windows\ie7updates\KB976325-IE7\ieencode.dll
+ 2010-01-13 11:47 . 2009-08-28 10:27 70656 c:\windows\ie7updates\KB976325-IE7\ie4uinit.exe
+ 2010-01-13 11:47 . 2009-08-29 07:30 63488 c:\windows\ie7updates\KB976325-IE7\icardie.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 17408 c:\windows\ie7updates\KB976325-IE7\corpol.dll
+ 2010-01-13 12:26 . 2009-03-08 03:35 2048 c:\windows\ie8updates\KB975364-IE8\iecompat.dll
+ 2009-07-12 00:12 . 2009-07-12 00:12 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
+ 2009-07-12 00:09 . 2009-07-12 00:09 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
+ 2009-07-12 00:08 . 2009-07-12 00:08 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
- 2008-05-07 11:58 . 2008-04-14 03:22 121856 c:\windows\system32\xmllite.dll
+ 2008-05-07 11:58 . 2009-01-07 17:21 121856 c:\windows\system32\xmllite.dll
+ 2004-08-18 12:00 . 2009-08-25 09:19 354816 c:\windows\system32\winhttp.dll
+ 2006-10-17 10:05 . 2009-03-08 03:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 2004-08-18 12:00 . 2009-03-08 03:34 236544 c:\windows\system32\webcheck.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 420352 c:\windows\system32\vbscript.dll
- 2004-08-18 12:00 . 2009-08-29 07:30 105984 c:\windows\system32\url.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 105984 c:\windows\system32\url.dll
+ 2009-10-08 13:57 . 2009-10-08 13:57 613376 c:\windows\system32\uiautomationcore.dll
- 2004-08-18 12:00 . 2009-06-16 14:40 119808 c:\windows\system32\t2embed.dll
+ 2004-08-18 12:00 . 2009-10-15 16:32 119808 c:\windows\system32\t2embed.dll
+ 2004-08-18 12:00 . 2009-10-12 13:40 150016 c:\windows\system32\rastls.dll
+ 2004-08-18 12:00 . 2010-01-13 11:45 383588 c:\windows\system32\perfh009.dat
- 2004-08-18 12:00 . 2009-10-25 10:00 383588 c:\windows\system32\perfh009.dat
+ 2004-08-18 12:00 . 2009-10-08 13:57 220160 c:\windows\system32\oleacc.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 206848 c:\windows\system32\occache.dll
+ 2004-08-18 12:00 . 2009-10-13 10:34 271360 c:\windows\system32\oakley.dll
- 2004-08-18 12:00 . 2008-04-14 03:21 271360 c:\windows\system32\oakley.dll
+ 2009-08-06 18:23 . 2009-08-06 18:23 215904 c:\windows\system32\muweb.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 611840 c:\windows\system32\mstime.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 193536 c:\windows\system32\msrating.dll
+ 2004-08-18 12:00 . 2009-03-08 03:22 156160 c:\windows\system32\msls31.dll
- 2004-08-18 12:00 . 2006-11-07 19:03 156160 c:\windows\system32\msls31.dll
+ 2006-11-07 19:03 . 2009-10-29 07:43 594432 c:\windows\system32\msfeeds.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20 265720 c:\windows\system32\msdbg2.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 726528 c:\windows\system32\jscript.dll
+ 2010-01-12 13:59 . 2010-01-12 13:58 149280 c:\windows\system32\javaws.exe
+ 2010-01-12 13:59 . 2010-01-12 13:58 145184 c:\windows\system32\javaw.exe
+ 2010-01-12 13:59 . 2010-01-12 13:58 145184 c:\windows\system32\java.exe
+ 2005-10-28 23:25 . 2005-10-28 23:25 151552 c:\windows\system32\ifxcardm.dll
+ 2006-11-07 19:03 . 2009-03-08 03:22 164352 c:\windows\system32\ieui.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 184320 c:\windows\system32\iepeers.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 387584 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 09:27 . 2009-03-08 03:11 445952 c:\windows\system32\ieapfltr.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 163840 c:\windows\system32\ieakui.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 229376 c:\windows\system32\ieaksie.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 125952 c:\windows\system32\ieakeng.dll
+ 2004-08-18 12:00 . 2009-10-28 14:40 173056 c:\windows\system32\ie4uinit.exe
+ 2008-05-06 20:05 . 2010-01-13 11:52 298048 c:\windows\system32\FNTCACHE.DAT
- 2008-05-06 20:05 . 2009-11-05 20:32 298048 c:\windows\system32\FNTCACHE.DAT
- 2004-08-18 12:00 . 2009-08-29 07:30 133120 c:\windows\system32\extmgr.dll
+ 2004-08-18 12:00 . 2009-10-29 07:45 133120 c:\windows\system32\extmgr.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 216064 c:\windows\system32\dxtrans.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 348160 c:\windows\system32\dxtmsft.dll
+ 2009-06-18 17:48 . 2009-06-18 17:48 142832 c:\windows\system32\drivers\MpFilter.sys
+ 2004-08-18 12:00 . 2009-10-29 07:43 916480 c:\windows\system32\dllcache\wininet.dll
+ 2008-12-16 12:32 . 2009-08-25 09:19 354816 c:\windows\system32\dllcache\winhttp.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2008-05-06 18:15 . 2009-03-08 03:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2008-05-09 10:56 . 2009-03-08 03:33 420352 c:\windows\system32\dllcache\vbscript.dll
- 2004-08-18 12:00 . 2009-08-29 07:30 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 105984 c:\windows\system32\dllcache\url.dll
- 2009-06-16 14:40 . 2009-06-16 14:40 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-06-16 14:40 . 2009-10-15 16:32 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20 134144 c:\windows\system32\dllcache\sqmapi.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-10-12 13:40 . 2009-10-12 13:40 150016 c:\windows\system32\dllcache\rastls.dll
+ 2004-08-18 12:00 . 2009-10-08 13:57 220160 c:\windows\system32\dllcache\oleacc.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 206848 c:\windows\system32\dllcache\occache.dll
+ 2009-10-13 10:34 . 2009-10-13 10:34 271360 c:\windows\system32\dllcache\oakley.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 611840 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-18 12:00 . 2009-03-08 03:34 193536 c:\windows\system32\dllcache\msrating.dll
- 2004-08-18 12:00 . 2006-11-07 19:03 156160 c:\windows\system32\dllcache\msls31.dll
+ 2004-08-18 12:00 . 2009-03-08 03:22 156160 c:\windows\system32\dllcache\msls31.dll
+ 2008-05-07 11:53 . 2009-10-29 07:43 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2008-05-09 10:56 . 2009-03-08 03:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2008-05-06 18:14 . 2009-03-08 13:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2004-08-18 12:00 . 2009-10-29 07:43 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-05-07 11:53 . 2009-03-08 03:11 445952 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-18 12:00 . 2009-03-08 03:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-18 12:00 . 2009-10-28 14:40 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-10-20 16:20 . 2009-10-20 16:20 265728 c:\windows\system32\dllcache\http.sys
- 2004-08-18 12:00 . 2009-08-29 07:30 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-18 12:00 . 2009-10-29 07:45 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2004-08-18 12:00 . 2009-03-08 03:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2005-10-28 23:25 . 2005-10-28 23:25 133120 c:\windows\system32\axaltocm.dll
+ 2004-08-18 12:00 . 2009-03-08 03:32 128512 c:\windows\system32\advpack.dll
+ 2010-01-13 13:31 . 2010-01-13 13:31 259072 c:\windows\Installer\c75c5.msi
+ 2010-01-13 13:31 . 2010-01-13 13:31 211968 c:\windows\Installer\c75bf.msi
+ 2010-01-13 13:31 . 2010-01-13 13:31 301056 c:\windows\Installer\c75b9.msi
+ 2010-01-12 13:57 . 2010-01-12 13:57 537600 c:\windows\Installer\990c2.msi
+ 2010-01-13 15:52 . 2010-01-13 15:52 101480 c:\windows\Installer\{621EB5F7-B871-47C0-AB53-E1376E71D858}\egui.exe
+ 2010-01-13 12:26 . 2009-03-08 03:34 914944 c:\windows\ie8updates\KB976325-IE8\wininet.dll
+ 2010-01-13 12:26 . 2009-05-26 11:40 391032 c:\windows\ie8updates\KB976325-IE8\spuninst\updspapi.dll
+ 2010-01-13 12:26 . 2009-05-26 11:40 233848 c:\windows\ie8updates\KB976325-IE8\spuninst\spuninst.exe
+ 2010-01-13 12:26 . 2009-03-08 03:34 109568 c:\windows\ie8updates\KB976325-IE8\occache.dll
+ 2010-01-13 12:26 . 2009-03-08 03:32 594432 c:\windows\ie8updates\KB976325-IE8\msfeeds.dll
+ 2010-01-13 12:26 . 2009-03-08 03:33 246784 c:\windows\ie8updates\KB976325-IE8\ieproxy.dll
+ 2010-01-13 12:26 . 2009-03-08 03:31 183808 c:\windows\ie8updates\KB976325-IE8\iepeers.dll
+ 2010-01-13 12:26 . 2009-03-08 13:09 391536 c:\windows\ie8updates\KB976325-IE8\iedkcs32.dll
+ 2010-01-13 12:26 . 2009-03-08 03:32 173056 c:\windows\ie8updates\KB976325-IE8\ie4uinit.exe
+ 2010-01-13 12:26 . 2009-05-26 11:40 391032 c:\windows\ie8updates\KB975364-IE8\spuninst\updspapi.dll
+ 2010-01-13 12:26 . 2009-05-26 11:40 233848 c:\windows\ie8updates\KB975364-IE8\spuninst\spuninst.exe
+ 2010-01-13 12:22 . 2009-10-29 07:45 832512 c:\windows\ie8\wininet.dll
+ 2010-01-13 12:22 . 2006-10-17 10:05 206336 c:\windows\ie8\winfxdocobj.exe
+ 2010-01-13 12:22 . 2009-10-29 07:45 233472 c:\windows\ie8\webcheck.dll
+ 2010-01-13 12:22 . 2007-07-12 23:32 765952 c:\windows\ie8\vgx.dll
+ 2010-01-13 12:22 . 2008-05-09 10:56 430080 c:\windows\ie8\vbscript.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 105984 c:\windows\ie8\url.dll
+ 2010-01-13 12:24 . 2009-01-07 17:20 390688 c:\windows\ie8\spuninst\updspapi.dll
+ 2010-01-13 12:24 . 2009-01-07 17:20 234016 c:\windows\ie8\spuninst\spuninst.exe
+ 2010-01-13 12:22 . 2006-09-06 14:42 215776 c:\windows\ie8\spuninst.exe
+ 2010-01-13 12:22 . 2009-10-29 07:45 102912 c:\windows\ie8\occache.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 671232 c:\windows\ie8\mstime.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 193024 c:\windows\ie8\msrating.dll
+ 2010-01-13 12:22 . 2006-11-07 19:03 156160 c:\windows\ie8\msls31.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 477696 c:\windows\ie8\mshtmled.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 459264 c:\windows\ie8\msfeeds.dll
+ 2010-01-13 12:22 . 2009-08-13 15:24 512000 c:\windows\ie8\jscript.dll
+ 2010-01-13 12:22 . 2009-10-28 06:54 634632 c:\windows\ie8\iexplore.exe
+ 2010-01-13 12:22 . 2006-11-07 19:03 180736 c:\windows\ie8\ieui.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 268288 c:\windows\ie8\iertutil.dll
+ 2010-01-13 12:22 . 2006-11-07 19:03 287744 c:\windows\ie8\ieproxy.dll
+ 2010-01-13 12:22 . 2006-11-07 19:03 191488 c:\windows\ie8\iepeers.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 385024 c:\windows\ie8\iedkcs32.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 380928 c:\windows\ie8\ieapfltr.dll
+ 2010-01-13 12:22 . 2009-10-28 06:52 161792 c:\windows\ie8\ieakui.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 230400 c:\windows\ie8\ieaksie.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 153088 c:\windows\ie8\ieakeng.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 214528 c:\windows\ie8\dxtrans.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 347136 c:\windows\ie8\dxtmsft.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 124928 c:\windows\ie8\advpack.dll
+ 2010-01-13 11:47 . 2009-08-29 07:31 832512 c:\windows\ie7updates\KB976325-IE7\wininet.dll
+ 2010-01-13 11:47 . 2009-08-29 07:31 233472 c:\windows\ie7updates\KB976325-IE7\webcheck.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 105984 c:\windows\ie7updates\KB976325-IE7\url.dll
+ 2010-01-13 11:47 . 2009-05-26 11:40 391032 c:\windows\ie7updates\KB976325-IE7\spuninst\updspapi.dll
+ 2010-01-13 11:47 . 2009-05-26 11:40 233848 c:\windows\ie7updates\KB976325-IE7\spuninst\spuninst.exe
+ 2010-01-13 11:47 . 2009-08-29 07:30 102912 c:\windows\ie7updates\KB976325-IE7\occache.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 671232 c:\windows\ie7updates\KB976325-IE7\mstime.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 193024 c:\windows\ie7updates\KB976325-IE7\msrating.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 477696 c:\windows\ie7updates\KB976325-IE7\mshtmled.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 459264 c:\windows\ie7updates\KB976325-IE7\msfeeds.dll
+ 2010-01-13 11:47 . 2009-08-27 05:18 634648 c:\windows\ie7updates\KB976325-IE7\iexplore.exe
+ 2010-01-13 11:47 . 2009-08-29 07:30 268288 c:\windows\ie7updates\KB976325-IE7\iertutil.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 385024 c:\windows\ie7updates\KB976325-IE7\iedkcs32.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 380928 c:\windows\ie7updates\KB976325-IE7\ieapfltr.dll
+ 2010-01-13 11:47 . 2009-08-27 05:18 161792 c:\windows\ie7updates\KB976325-IE7\ieakui.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 230400 c:\windows\ie7updates\KB976325-IE7\ieaksie.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 153088 c:\windows\ie7updates\KB976325-IE7\ieakeng.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 133120 c:\windows\ie7updates\KB976325-IE7\extmgr.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 214528 c:\windows\ie7updates\KB976325-IE7\dxtrans.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 347136 c:\windows\ie7updates\KB976325-IE7\dxtmsft.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 124928 c:\windows\ie7updates\KB976325-IE7\advpack.dll
+ 2009-10-20 16:20 . 2009-10-20 16:20 265728 c:\windows\Driver Cache\i386\http.sys
+ 2009-07-11 19:46 . 2009-07-11 19:46 1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80u.dll
+ 2009-07-11 19:46 . 2009-07-11 19:46 1105920 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80.dll
+ 2005-10-06 03:10 . 2009-08-14 15:15 1850624 c:\windows\system32\win32k.sys
+ 2004-08-18 12:00 . 2009-10-29 07:43 1208832 c:\windows\system32\urlmon.dll
+ 2008-04-14 03:21 . 2009-07-31 09:05 1372672 c:\windows\system32\msxml6.dll
+ 2004-08-18 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 5940736 c:\windows\system32\mshtml.dll
+ 2006-10-17 09:57 . 2009-10-29 07:43 1985536 c:\windows\system32\iertutil.dll
+ 2006-09-05 21:01 . 2009-02-06 20:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2008-10-15 05:52 . 2009-08-14 15:15 1850624 c:\windows\system32\dllcache\win32k.sys
+ 2004-08-18 12:00 . 2009-10-29 07:43 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20 1497600 c:\windows\system32\dllcache\shdocvw.dll
+ 2008-04-14 03:21 . 2009-07-31 09:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-11-12 10:32 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2004-08-18 12:00 . 2009-10-29 07:43 5940736 c:\windows\system32\dllcache\mshtml.dll
+ 2008-05-07 11:53 . 2009-10-29 07:43 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2008-05-07 11:53 . 2009-02-06 20:07 3698584 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-01-07 17:20 . 2009-01-07 17:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2010-01-13 15:52 . 2010-01-13 15:52 1138176 c:\windows\Installer\8c9b8e.msi
+ 2010-01-13 12:26 . 2009-03-08 03:34 1206784 c:\windows\ie8updates\KB976325-IE8\urlmon.dll
+ 2010-01-13 12:26 . 2009-03-08 03:41 5937152 c:\windows\ie8updates\KB976325-IE8\mshtml.dll
+ 2010-01-13 12:26 . 2009-03-08 03:32 1985024 c:\windows\ie8updates\KB976325-IE8\iertutil.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 1168384 c:\windows\ie8\urlmon.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 3598336 c:\windows\ie8\mshtml.dll
+ 2010-01-13 12:22 . 2009-10-29 07:45 6067200 c:\windows\ie8\ieframe.dll
+ 2010-01-13 12:22 . 2009-06-29 08:33 2452872 c:\windows\ie8\ieapfltr.dat
+ 2010-01-13 11:47 . 2009-08-29 07:31 1168384 c:\windows\ie7updates\KB976325-IE7\urlmon.dll
+ 2010-01-13 11:47 . 2009-10-21 04:08 3598336 c:\windows\ie7updates\KB976325-IE7\mshtml.dll
+ 2010-01-13 11:47 . 2009-08-29 07:30 6067200 c:\windows\ie7updates\KB976325-IE7\ieframe.dll
+ 2008-05-07 11:56 . 2010-01-04 15:17 29634504 c:\windows\system32\MRT.exe
+ 2006-11-07 19:03 . 2009-10-29 07:43 11069952 c:\windows\system32\ieframe.dll
+ 2008-05-07 11:53 . 2009-10-29 07:43 11069952 c:\windows\system32\dllcache\ieframe.dll
+ 2010-01-13 12:26 . 2009-03-08 03:39 11063808 c:\windows\ie8updates\KB976325-IE8\ieframe.dll
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-12 149280]
"SMSERIAL"="c:\windows\sm56hlpr.exe" [2006-04-05 565248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-08-11 794714]
"S3Trayp"="S3Trayp.exe" [2006-07-11 176128]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CS Update"="copy" [X]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Miroslav\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^siszyd32.exe]
path=c:\documents and settings\Miroslav\Nabídka Start\Programy\Po spuštění\siszyd32.exe
backup=c:\windows\pss\siszyd32.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 09:50 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
2006-08-03 12:53 53248 ----a-w- c:\windows\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [13.10.2009 18:31 222968]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [7.5.2008 12:05 659456]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [16.5.2008 14:32 217600]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.11.2008 16:23 717296]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - aseripkx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 07:09]

2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2010-01-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 16:36]

2010-01-15 c:\windows\Tasks\User_Feed_Synchronization-{08E03BCB-9BF0-425B-89C3-78ACE9E0F26B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: seznam.cz\email
Trusted Zone: szn.cz\login
TCP: {58C95925-BAE2-4C2E-A92F-6B3E65FE48FF} = 10.0.0.22,212.80.66.7
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 21:19
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\windows\system32\mucltui.dll
c:\windows\system32\mucltui.dll.mui 17264 bytes executable

sken byl úspešně dokončen
skryté soubory: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aseripkx]

.
Celkový čas: 2010-01-15 21:21:58
ComboFix-quarantined-files.txt 2010-01-15 20:21
ComboFix2.txt 2010-01-13 11:43
ComboFix3.txt 2010-01-12 10:22
ComboFix4.txt 2010-01-12 10:08

Před spuštěním: 9 927 733 248
Po spuštění: 9 889 591 296

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 9FF1744EF482A45CBD90973BCCAE82E5

Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\fjhdyfhsn.bat
c:\windows\pss\siszyd32.exe
c:\documents and settings\Miroslav\Nabídka Start\Programy\Po spuštění\siszyd32.exe

Driver::
aseripkx

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^siszyd32.exe]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy bze skriptu.

Tady je nový log z combofixu.

Po restartu PC co provedl combofix mi vyskocila hlaska:
NOD32
chyba pri komunikaci s jadrem systemu.

ComboFix 10-01-15.01 - Miroslav 15.01.2010 22:56:57.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.446.243 [GMT 1:00]
Spuštěný z: c:\documents and settings\Miroslav\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Miroslav\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

file zipped: c:\windows\system32\fjhdyfhsn.bat
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\fjhdyfhsn.bat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASERIPKX
-------\Service_aseripkx


((((((((((((((((((((((((( Soubory vytvořené od 2009-12-15 do 2010-01-15 )))))))))))))))))))))))))))))))
.

2010-01-15 20:19 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-15 19:15 . 2010-01-15 19:15 -------- d-----w- C:\rsit
2010-01-15 19:15 . 2010-01-15 19:15 -------- d-----w- c:\program files\trend micro
2010-01-13 15:45 . 2010-01-13 15:45 -------- d-sh--w- c:\documents and settings\Miroslav\IECompatCache
2010-01-13 15:45 . 2010-01-13 15:45 -------- d-sh--w- c:\documents and settings\Miroslav\PrivacIE
2010-01-13 13:35 . 2009-11-02 19:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 13:31 . 2010-01-13 13:31 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-01-13 13:18 . 2010-01-13 13:18 -------- d-sh--w- c:\documents and settings\Miroslav\IETldCache
2010-01-13 12:26 . 2009-10-29 07:43 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-13 12:26 . 2009-10-29 07:43 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-13 12:26 . 2010-01-13 12:26 -------- d-----w- c:\windows\ie8updates
2010-01-13 12:25 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-13 12:22 . 2010-01-13 12:24 -------- dc-h--w- c:\windows\ie8
2010-01-13 11:18 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-13 09:53 . 2010-01-13 11:50 -------- d-----w- c:\program files\STOPzilla!
2010-01-13 09:53 . 2010-01-13 09:53 -------- d-----w- c:\program files\Common Files\iS3
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\UC.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\RAR.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\LHA.PIF
2010-01-12 14:33 . 2009-09-24 06:50 545 ----a-w- c:\windows\ARJ.PIF
2010-01-12 14:33 . 2010-01-12 15:09 -------- d-----w- C:\totalcmd
2010-01-12 13:59 . 2010-01-12 13:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-12 09:46 . 2010-01-12 09:52 -------- d-----w- c:\program files\Registry Easy
2010-01-05 18:51 . 2010-01-15 22:02 763904 ----a-w- c:\windows\system32\drivers\aseripkx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-13 15:51 . 2008-05-16 16:48 -------- d-----w- c:\program files\Eset
2010-01-13 11:45 . 2004-08-18 12:00 63526 ----a-w- c:\windows\system32\perfc005.dat
2010-01-13 11:45 . 2004-08-18 12:00 383060 ----a-w- c:\windows\system32\perfh005.dat
2010-01-13 11:41 . 2010-01-13 11:34 1056 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-01-13 11:36 . 2010-01-13 11:33 1992 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-01-13 09:16 . 2008-05-06 19:58 98304 ----a-w- c:\windows\DUMP56ab.tmp
2010-01-12 13:57 . 2008-05-06 18:21 -------- d-----w- c:\program files\Java
2010-01-12 10:05 . 2009-10-13 17:28 -------- d-----w- c:\program files\ICQ6.5
2009-11-21 16:03 . 2004-08-18 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 08:06 . 2009-11-16 08:06 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-11-16 08:03 . 2009-11-16 08:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 07:56 . 2009-11-16 07:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-10-29 07:43 . 2004-08-18 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-18 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-18 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-18 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-20 11:08 . 2009-10-20 11:08 339456 ----a-w- c:\windows\UIA200.exe
.

((((((((((((((((((((((((((((( SnapShot_2010-01-15_20.19.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-15 22:03 . 2010-01-15 22:03 16384 c:\windows\temp\Perflib_Perfdata_4b8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-12 149280]
"SMSERIAL"="c:\windows\sm56hlpr.exe" [2006-04-05 565248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-08-11 794714]
"S3Trayp"="S3Trayp.exe" [2006-07-11 176128]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CS Update"="copy" [X]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Miroslav^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Miroslav\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 09:50 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
2006-08-03 12:53 53248 ----a-w- c:\windows\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.11.2008 16:23 717296]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [13.10.2009 18:31 222968]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [7.5.2008 12:05 659456]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [16.5.2008 14:32 217600]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 07:09]

2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2010-01-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 16:36]

2010-01-15 c:\windows\Tasks\User_Feed_Synchronization-{08E03BCB-9BF0-425B-89C3-78ACE9E0F26B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: seznam.cz\email
Trusted Zone: szn.cz\login
TCP: {58C95925-BAE2-4C2E-A92F-6B3E65FE48FF} = 10.0.0.22,212.80.66.7
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 23:04
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys spuz.sys hal.dll >>UNKNOWN [0x84795938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf760ef28
\Driver\ACPI -> ACPI.sys @ 0xf7389cb8
\Driver\atapi -> atapi.sys @ 0xf721eb40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(528)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\S3Trayp.exe
.
**************************************************************************
.
Celkový čas: 2010-01-15 23:07:29 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-15 22:07
ComboFix2.txt 2010-01-15 20:21
ComboFix3.txt 2010-01-13 11:43
ComboFix4.txt 2010-01-12 10:22
ComboFix5.txt 2010-01-15 21:56

Před spuštěním: 9 510 645 760
Po spuštění: 9 456 779 264

- - End Of File - - 5E03F34910F4840145DDFF820EED8E5F

Spusťte ještě MBR: http://www2.gmer.net/mbr/mbr.exe a dejte log.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Toto je OK, takže PC by měl být čistý.

Mnohokrát děkuji

PC vypadá OK.
- Jediné co pořád nefunguje je eset nod32, ale tam asi pomůže reinstall.

Ještě jednou děkuji

Mirek

Reinstal zkuste. Nemáte zač!