VIRY.CZ

Prosim o kontrolu logu
netstat vypise desiatky pripojeni k serverom na port 25

NOD odstranil trojana (variant infiltrácie Win32/Wigon.MW), Spyware Terminator nenasiel nic

Dakujem

Dejte log z RSIT: http://viry.cz/forum/viewtopic.php?f=24&t=81939 .

Sorry, skusal som ho najkor pripojit ako subor


Logfile of random's system information tool 1.06 (written by random/random)
Run by lubo at 2010-02-18 21:15:19
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 394 GB (83%) free of 477 GB
Total RAM: 3549 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:21, on 18. 2. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Progress\OpenEdge\jre\bin\java.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Progress\OpenEdge\jre\bin\java.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Install\RSIT.exe
C:\Program Files\trend micro\lubo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: TOPCOM B4872 1.0.lnk = C:\Program Files\TOPCOM B4872 1.0\TOPCOM B4872 1.0.exe
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6018839751
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = avis2003.avispro.sk
O17 - HKLM\Software\..\Telephony: DomainName = avis2003.avispro.sk
O17 - HKLM\System\CCS\Services\Tcpip\..\{9893CC5F-A078-4779-9447-24C5311247CA}: NameServer = 10.10.1.3,0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = avis2003.avispro.sk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = avis2003.avispro.sk
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AdminService for OpenEdge 10.1C (AdminService10.1C) - Unknown owner - C:\Progress\OpenEdge\bin\AdmSrvc.exe
O23 - Service: AdminService for PROGRESS 9.1D (AdminService9.1D) - Unknown owner - C:\Program Files\PROGRESS\bin\AdmSrvc.exe
O23 - Service: AVerRemote - AVerMedia - C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: ProService for 9.1D (ProService9.1D) - Progress Software - C:\Program Files\PROGRESS\bin\ProSrvc.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6335 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-07-01 150040]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-07-01 170520]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-07-01 141848]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2008-04-07 318488]
"SetRefresh"=C:\Program Files\Compaq\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-05-14 2029640]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-06-02 24264488]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe

C:\Documents and Settings\lubo\Start Menu\Programs\Startup
TOPCOM B4872 1.0.lnk - C:\Program Files\TOPCOM B4872 1.0\TOPCOM B4872 1.0.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-06-27 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Disabled:Crawler Spyware Terminator"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

======List of files/folders created in the last 1 months======

2010-02-18 21:11:43 ----A---- C:\ComboFix.txt
2010-02-18 21:06:46 ----A---- C:\WINDOWS\zip.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\SWSC.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\SWREG.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\sed.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\PEV.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\MBR.exe
2010-02-18 21:06:46 ----A---- C:\WINDOWS\grep.exe
2010-02-18 21:06:35 ----D---- C:\Qoobox
2010-02-17 17:23:11 ----A---- C:\ComboFixold.txt
2010-02-10 08:26:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 08:26:40 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 08:26:34 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 08:26:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 08:26:23 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 08:26:14 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 08:26:07 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-10 08:26:01 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 08:25:52 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-01-22 10:45:38 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-01-22 10:42:15 ----D---- C:\Program Files\TOPCOM B4872 1.0
2010-01-22 10:41:38 ----A---- C:\WINDOWS\CD_Start.INI

======List of files/folders modified in the last 1 months======

2010-02-18 21:15:19 ----D---- C:\Program Files\trend micro
2010-02-18 21:14:41 ----D---- C:\WINDOWS\temp
2010-02-18 21:11:46 ----D---- C:\WINDOWS\Prefetch
2010-02-18 21:10:53 ----D---- C:\WINDOWS
2010-02-18 21:10:53 ----A---- C:\WINDOWS\system.ini
2010-02-18 21:08:56 ----D---- C:\WINDOWS\system32\drivers
2010-02-18 21:08:56 ----D---- C:\WINDOWS\system32
2010-02-18 21:08:56 ----D---- C:\WINDOWS\AppPatch
2010-02-18 21:08:53 ----D---- C:\Program Files\Common Files
2010-02-18 21:07:05 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-18 21:06:49 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-18 21:04:49 ----D---- C:\Install
2010-02-18 21:00:33 ----D---- C:\Documents and Settings\lubo\Application Data\Skype
2010-02-18 20:54:18 ----A---- C:\WINDOWS\ntbtlog.txt
2010-02-18 20:16:35 ----RD---- C:\Program Files
2010-02-18 19:51:31 ----D---- C:\Documents and Settings\lubo\Application Data\skypePM
2010-02-18 18:27:23 ----D---- C:\WINDOWS\security
2010-02-18 17:31:45 ----D---- C:\MIS
2010-02-17 17:26:48 ----D---- C:\WINDOWS\ERDNT
2010-02-17 17:22:40 ----RSHD---- C:\WINDOWS\system32\dllcache
2010-02-17 17:22:08 ----SD---- C:\WINDOWS\Tasks
2010-02-10 10:38:35 ----HD---- C:\WINDOWS\inf
2010-02-10 08:42:03 ----D---- C:\_Lubo
2010-02-10 08:32:23 ----D---- C:\_Lubo Súkromne
2010-02-10 08:26:44 ----A---- C:\WINDOWS\imsins.BAK
2010-02-10 08:26:40 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-03 12:58:14 ----D---- C:\Kamar
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-28 10:34:43 ----SHD---- C:\WINDOWS\CSC
2010-01-22 08:43:23 ----D---- C:\Program Files\Internet Explorer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-05-14 94360]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 AVerRadio;AVerMedia USB Radio 810; C:\WINDOWS\system32\DRIVERS\AVerRadio.sys [2008-07-22 50048]
R3 BulkUsb;VoIPUSBDriver.sys; C:\WINDOWS\System32\Drivers\VoIPUSBDriver.sys [2006-10-12 149504]
R3 catchme;catchme; \??\C:\DOCUME~1\lubo\LOCALS~1\Temp\catchme.sys []
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\WINDOWS\system32\DRIVERS\e1y5132.sys [2008-06-13 243856]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-06-27 6023072]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-08-04 4752896]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-13 42752]
S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 esihdrv;esihdrv; \??\C:\DOCUME~1\lubo\LOCALS~1\Temp\esihdrv.sys []
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-04 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-04 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-04 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-04 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-04 22271]
S3 mbr;mbr; \??\C:\DOCUME~1\lubo\LOCALS~1\Temp\mbr.sys []
S3 MPE;BDA MPE Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-09 105472]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVerRemote;AVerRemote; C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe [2008-06-05 352256]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2008-04-07 576024]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 AdminService10.1C;AdminService for OpenEdge 10.1C; C:\Progress\OpenEdge\bin\AdmSrvc.exe [2008-06-07 28672]
S2 AdminService9.1D;AdminService for PROGRESS 9.1D; C:\Program Files\PROGRESS\bin\AdmSrvc.exe [2002-05-07 20480]
S2 AVerScheduleService;AVerScheduleService; C:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe [2008-07-14 409600]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-05-14 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ProService9.1D;ProService for 9.1D; C:\Program Files\PROGRESS\bin\ProSrvc.exe [2002-05-07 126976]
S3 RoxMediaDB10;RoxMediaDB10; C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2008-04-08 1112560]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dělal jste sken ComboFix. Dejte z něj log.

ComboFix 10-02-10.05 - lubo . 02. 2010 17:19:07.2.4 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3549.2877 [GMT 1:00]
Running from: c:\documents and settings\lubo\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Startup\AVerQuick.lnk
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\lubo\Application Data\avdrn.dat
c:\documents and settings\lubo\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\system32\config\systemprofile\CsimPlayer.exe
c:\windows\system32\config\systemprofile\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\system32\CsimPlayer.exe
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.
((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-01-22 09:45 . 2008-04-14 04:41 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-01-22 09:45 . 2008-04-14 04:41 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll
2010-01-22 09:45 . 2008-04-13 23:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-22 09:45 . 2008-04-13 23:15 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-22 09:45 . 2008-04-13 23:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-01-22 09:45 . 2008-04-13 23:15 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-01-22 09:43 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-01-22 09:43 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-01-22 09:42 . 2010-01-22 09:42 -------- d-----w- c:\program files\TOPCOM B4872 1.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 16:22 . 2009-06-26 16:48 -------- d-----w- c:\documents and settings\lubo\Application Data\Skype
2010-02-17 16:22 . 2009-12-12 17:39 792064 ----a-w- c:\windows\system32\drivers\ayljc.sys
2010-02-17 15:07 . 2009-06-26 16:49 -------- d-----w- c:\documents and settings\lubo\Application Data\skypePM
2010-01-15 14:34 . 2010-01-15 14:34 -------- d-----w- c:\documents and settings\lubo\Application Data\Roxio
2009-12-31 16:50 . 2004-08-04 06:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-04 07:56 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2004-08-04 07:56 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 15:18 . 2009-12-12 11:55 24 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
2009-12-14 07:08 . 2004-08-04 07:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 11:55 . 2009-12-12 11:55 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-12-08 19:26 . 2004-08-04 06:20 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2006-02-28 09:00 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-04 06:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-02-28 09:00 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11 . 2004-08-04 07:56 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07 . 2006-02-28 09:00 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2001-08-18 05:36 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2006-02-28 09:00 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07 . 2004-08-04 07:56 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 07:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-21 15:51 . 2004-08-04 07:56 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

c:\windows\System32\drivers\atapi.sys ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-06-02 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-01 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-01 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-01 141848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\lubo\Start Menu\Programs\Startup\
TOPCOM B4872 1.0.lnk - c:\program files\TOPCOM B4872 1.0\TOPCOM B4872 1.0.exe [2006-10-5 942080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2009-6-26 159744]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14. 5. 2009 14:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [18. 8. 2008 12:27 94360]
R2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [26. 6. 2009 18:38 352256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14. 5. 2009 14:47 731840]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [26. 6. 2009 21:39 576024]
R3 AVerRadio;AVerMedia USB Radio 810;c:\windows\system32\drivers\AVerRadio.sys [26. 6. 2009 18:39 50048]
R3 BulkUsb;VoIPUSBDriver.sys;c:\windows\system32\drivers\VoIPUSBDriver.sys [13. 2. 2006 3:46 149504]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [26. 6. 2009 21:25 243856]
S2 AdminService10.1C;AdminService for OpenEdge 10.1C;c:\progress\OpenEdge\bin\admsrvc.exe [26. 6. 2009 17:14 28672]
S2 AdminService9.1D;AdminService for PROGRESS 9.1D;c:\program files\PROGRESS\bin\admsrvc.exe [26. 6. 2009 16:53 20480]
S2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [26. 6. 2009 18:38 409600]
S3 ProService9.1D;ProService for 9.1D;c:\program files\PROGRESS\bin\prosrvc.exe [26. 6. 2009 16:53 126976]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8. 4. 2008 18:12 1112560]

--- Other Services/Drivers In Memory ---

*Deregistered* - ayljc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {9893CC5F-A078-4779-9447-24C5311247CA} = 10.10.1.3,0.0.0.0
.
- - - - ORPHANS REMOVED - - - -

AddRemove-PROGRESS 9.1D - c:\windows\ProgressUninstall9.1D -cc:\program files\PROGRESS\uninst.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 17:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ayljc]

.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-02-17 17:23:11
ComboFix-quarantined-files.txt 2010-02-17 16:23
ComboFix2.txt 2009-08-24 12:33

Pre-Run: 413 246 750 720 bytes free
Post-Run: 413 204 578 304 bytes free

- - End Of File - - 11996DA8EFC7705946AD52F408707610

Ještě dočistíme. otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\drivers\ayljc.sys
c:\windows\system32\fjhdyfhsn.bat

Driver::
ayljc

FCopy::
c:\windows\ServicePackFiles\i386\atapi.sys | c:\windows\System32\drivers\atapi.sys

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

netstat je uz kludnejsi, neziadane pripojenia zmizli

Novy log z combofix:

ComboFix 10-02-18.05 - lubo . 02. 2010 22:47:00.5.4 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3549.2994 [GMT 1:00]
Running from: c:\documents and settings\lubo\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\lubo\Desktop\CFScript.txt.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

file zipped: c:\windows\system32\drivers\ayljc.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ayljc.sys

.
--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\System32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AYLJC
-------\Service_ayljc


((((((((((((((((((((((((( Files Created from 2010-01-18 to 2010-02-18 )))))))))))))))))))))))))))))))
.

2010-02-18 21:46 . 2008-04-13 22:10 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-02-18 21:46 . 2008-04-13 22:10 96512 ----a-w- c:\windows\system32\dllcache\atapi.sys
2010-01-22 09:45 . 2008-04-14 04:41 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-01-22 09:45 . 2008-04-14 04:41 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll
2010-01-22 09:45 . 2008-04-13 23:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-22 09:45 . 2008-04-13 23:15 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-22 09:45 . 2008-04-13 23:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-01-22 09:45 . 2008-04-13 23:15 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-01-22 09:43 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-01-22 09:43 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-01-22 09:42 . 2010-01-22 09:42 -------- d-----w- c:\program files\TOPCOM B4872 1.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-18 21:49 . 2009-06-26 16:48 -------- d-----w- c:\documents and settings\lubo\Application Data\Skype
2010-02-18 20:15 . 2009-08-24 12:04 -------- d-----w- c:\program files\trend micro
2010-02-18 18:51 . 2009-06-26 16:49 -------- d-----w- c:\documents and settings\lubo\Application Data\skypePM
2010-01-15 14:34 . 2010-01-15 14:34 -------- d-----w- c:\documents and settings\lubo\Application Data\Roxio
2009-12-31 16:50 . 2004-08-04 06:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-04 07:56 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2004-08-04 07:56 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 15:18 . 2009-12-12 11:55 24 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
2009-12-14 07:08 . 2004-08-04 07:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2004-08-04 06:20 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2006-02-28 09:00 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-04 06:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-02-28 09:00 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11 . 2004-08-04 07:56 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07 . 2006-02-28 09:00 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2001-08-18 05:36 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2006-02-28 09:00 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07 . 2004-08-04 07:56 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 07:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-21 15:51 . 2004-08-04 07:56 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-02-18_21.44.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-18 21:49 . 2010-02-18 21:49 16384 c:\windows\temp\Perflib_Perfdata_8b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-06-02 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-01 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-01 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-01 141848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\lubo\Start Menu\Programs\Startup\
TOPCOM B4872 1.0.lnk - c:\program files\TOPCOM B4872 1.0\TOPCOM B4872 1.0.exe [2006-10-5 942080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2009-6-26 159744]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14. 5. 2009 14:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [18. 8. 2008 12:27 94360]
R2 AdminService10.1C;AdminService for OpenEdge 10.1C;c:\progress\OpenEdge\bin\admsrvc.exe [26. 6. 2009 17:14 28672]
R2 AdminService9.1D;AdminService for PROGRESS 9.1D;c:\program files\PROGRESS\bin\admsrvc.exe [26. 6. 2009 16:53 20480]
R2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [26. 6. 2009 18:38 352256]
R2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [26. 6. 2009 18:38 409600]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14. 5. 2009 14:47 731840]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [26. 6. 2009 21:39 576024]
R3 AVerRadio;AVerMedia USB Radio 810;c:\windows\system32\drivers\AVerRadio.sys [26. 6. 2009 18:39 50048]
R3 BulkUsb;VoIPUSBDriver.sys;c:\windows\system32\drivers\VoIPUSBDriver.sys [13. 2. 2006 3:46 149504]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [26. 6. 2009 21:25 243856]
S3 esihdrv;esihdrv;\??\c:\docume~1\lubo\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\lubo\LOCALS~1\Temp\esihdrv.sys [?]
S3 ProService9.1D;ProService for 9.1D;c:\program files\PROGRESS\bin\prosrvc.exe [26. 6. 2009 16:53 126976]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8. 4. 2008 18:12 1112560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {9893CC5F-A078-4779-9447-24C5311247CA} = 10.10.1.3,0.0.0.0
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-18 22:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3700)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.SKY
c:\program files\Adobe\Reader 9.0\Reader\viewerps.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progress\OpenEdge\jre\bin\java.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\igfxsrvc.exe
c:\progress\OpenEdge\jre\bin\java.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
.
**************************************************************************
.
Completion time: 2010-02-18 22:51:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-18 21:51
ComboFix2.txt 2010-02-18 21:45

Pre-Run: 413 104 693 248 bytes free
Post-Run: 412 987 645 952 bytes free

- - End Of File - - D9F4ED3911A44AF89311811A96223D49

Dakujem za pomoc, zda sa ze uz je OK.

Prajem prijemny den.

Stejné přání i vám a nemáte zač!