VIRY.CZ

Dobrý den.Po vypnutí Mozilly mi počítač fouká o závod.Ve správci misím firefox.exe ukončit proces ručně.Jinak jede na 98%.Celý počítač se někdy nedá použít.Stále se na něco čeká.V poslední době se mi začla ukazovat hláška o pokusu napadení DCOM EXPLOID.IP-xxxNa google jsem našel vaše stránky s danou tématikou a po kliknutí na odkaz na mě začal řvát AVAST.Nevím kde je chyba.Prosím o kontrolu logu.Posílám také ofocené upozornění.Předem díky.Přikládám log z hijackhist
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:57:50, on 24.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\CToolbar.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.download.com/Wise-Disk-Clean ... tag=button
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - (no file)
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 6840 bytes

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Zajímalo by mě který program hlídal hodinu můj počítač,kdyš jsem musel veškeré ochrany vypnout.Tady je ten kombofix log.
ComboFix 10-02-24.01 - Čenda 24.02.2010 21:10:40.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.631.273 [GMT 1:00]
Spuštěný z: c:\documents and settings\Čenda\Plocha\Stahování z internetu\ComboFix.exe
AV: avast! antivirus 4.7.1098 [VPS 100224-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-24 do 2010-02-24 )))))))))))))))))))))))))))))))
.

2010-02-24 15:01 . 2010-02-24 15:01 -------- d-----w- c:\program files\Gadwin Systems
2010-02-23 19:35 . 2010-02-24 17:51 -------- d-----w- c:\program files\Crawler
2010-02-23 18:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-23 18:30 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-23 18:30 . 2010-02-23 18:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-23 17:31 . 2010-02-23 17:31 -------- d-----w- c:\program files\Trend Micro
2010-02-23 09:42 . 2007-12-04 14:53 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-23 09:42 . 2007-12-04 14:51 42912 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-23 09:42 . 2007-12-04 14:49 26624 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-23 09:40 . 2007-12-04 12:54 95608 ----a-w- c:\windows\system32\AvastSS.scr
2010-02-23 09:40 . 2007-12-04 14:56 93264 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-23 09:40 . 2007-12-04 14:55 94544 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-23 09:40 . 2007-12-04 13:04 837496 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-12 19:57 . 2010-02-12 19:57 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-02-08 09:16 . 2008-04-13 23:15 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2010-02-07 11:13 . 2010-02-07 11:13 2560 ----a-w- c:\windows\system32\bitcometres.dll
2010-02-07 11:13 . 2010-02-23 12:52 -------- d-----w- C:\Downloads
2010-02-07 11:13 . 2010-02-07 11:18 -------- d-----w- c:\program files\BitComet
2010-02-04 12:00 . 2010-02-22 13:09 -------- d-----w- c:\program files\WinClamAVShield
2010-02-04 11:49 . 2010-02-04 11:49 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-02-04 11:49 . 2010-02-04 12:12 -------- d-----w- c:\program files\Spyware Terminator
2010-01-31 18:18 . 2010-01-31 18:18 -------- d-----w- c:\program files\FotoSketcher
2010-01-31 16:31 . 2001-10-24 11:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-01-31 16:31 . 2008-04-14 07:51 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-01-27 15:27 . 2010-01-27 15:27 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-27 15:19 . 2010-01-27 15:19 -------- d-----w- c:\program files\MSXML 4.0
2010-01-26 23:11 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-01-26 23:11 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-01-26 23:11 . 2010-01-26 23:11 -------- d-----w- c:\windows\Logs
2010-01-26 22:36 . 2010-01-26 22:36 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-26 22:34 . 2010-01-26 22:34 -------- d-----w- c:\program files\Common Files\Skype
2010-01-26 22:34 . 2010-01-26 22:35 -------- d-----r- c:\program files\Skype
2010-01-26 22:06 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-26 22:06 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-01-26 21:02 . 2010-01-26 21:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-01-26 21:02 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-01-26 21:02 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-01-26 21:02 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-01-26 21:02 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-01-26 21:01 . 2008-04-13 23:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-01-26 21:01 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-01-26 20:59 . 2010-01-26 20:59 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2010-01-26 20:59 . 2010-01-26 20:59 -------- d-----w- c:\program files\ScanSoft
2010-01-26 20:58 . 2010-01-26 20:59 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-26 20:58 . 2010-01-26 20:58 -------- d-----w- c:\program files\Common Files\CANON
2010-01-26 20:55 . 2007-03-18 20:00 69632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8S.DLL
2010-01-26 20:55 . 2007-03-18 20:00 27136 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8S.DLL
2010-01-26 20:55 . 2007-03-18 20:00 215040 ----a-w- c:\windows\system32\CNMLM8S.DLL
2010-01-26 20:55 . 2010-01-26 20:55 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2010-01-26 20:55 . 2007-03-23 07:29 98304 ----a-w- c:\windows\system32\CNC210I.DLL
2010-01-26 20:55 . 2007-03-19 01:16 200704 ----a-w- c:\windows\system32\CNC210L.DLL
2010-01-26 20:55 . 2007-03-15 05:12 188416 ----a-w- c:\windows\system32\CNC210O.DLL
2010-01-26 20:55 . 2007-03-23 07:30 1400832 ----a-w- c:\windows\system32\CNC210C.DLL
2010-01-26 20:55 . 2010-01-26 20:55 -------- d--h--w- c:\program files\CanonBJ
2010-01-26 20:54 . 2010-01-26 21:04 -------- d-----w- c:\program files\Canon
2010-01-26 20:52 . 2008-11-10 10:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2010-01-26 20:52 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-01-26 20:51 . 2010-01-27 16:55 -------- d-----w- c:\program files\Microsoft Works
2010-01-26 20:51 . 2010-01-26 20:51 -------- d-----w- c:\program files\MSBuild
2010-01-26 20:46 . 2010-01-26 20:50 -------- d-----w- c:\windows\SHELLNEW
2010-01-26 20:46 . 2010-01-26 20:46 -------- d-----r- C:\MSOCache
2010-01-26 20:38 . 2010-01-26 20:38 -------- d-----w- c:\program files\Common Files\Ahead
2010-01-26 20:38 . 2010-01-26 20:38 -------- d-----w- c:\program files\Nero
2010-01-26 20:30 . 2010-01-26 20:30 0 ----a-w- c:\windows\nsreg.dat
2010-01-26 20:12 . 2010-01-26 20:12 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-01-26 20:06 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-26 20:05 . 2010-01-26 20:05 -------- d-----w- c:\windows\ie8updates
2010-01-26 20:05 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-26 20:05 . 2009-12-21 19:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-26 20:05 . 2009-12-21 19:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-26 20:05 . 2009-12-21 19:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-26 20:05 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-26 20:05 . 2009-12-21 19:08 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-26 20:04 . 2010-01-26 20:05 -------- dc-h--w- c:\windows\ie8
2010-01-26 19:54 . 2008-04-14 07:52 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-01-26 19:44 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-26 19:43 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-26 19:36 . 2009-10-15 16:32 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-26 19:36 . 2009-10-15 16:32 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-01-26 19:35 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-26 19:35 . 2009-03-06 14:23 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-26 19:35 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-26 19:35 . 2009-02-09 10:56 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-26 19:35 . 2009-02-09 10:56 684032 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-26 19:35 . 2009-02-09 10:56 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-01-26 19:35 . 2009-02-09 10:56 709632 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-26 19:35 . 2009-02-09 10:56 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-26 19:34 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-26 19:34 . 2010-01-26 19:35 -------- d-----w- c:\program files\Wise Registry Cleaner
2010-01-26 19:33 . 2010-01-26 19:33 -------- d-----w- c:\program files\VideoLAN
2010-01-26 19:32 . 2010-01-26 19:32 -------- d-----w- C:\totalcmd
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\UC.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\RAR.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\LHA.PIF
2010-01-26 19:32 . 2009-09-24 06:50 545 ----a-w- c:\windows\ARJ.PIF
2010-01-26 19:32 . 2010-01-26 19:32 -------- d-----w- c:\program files\Java
2010-01-26 19:30 . 2010-01-26 19:30 -------- d-----w- c:\program files\Common Files\Java
2010-01-26 19:29 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-26 19:29 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-26 19:29 . 2010-01-26 19:29 -------- d-----w- c:\program files\FreeCommander
2010-01-26 19:29 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-26 19:29 . 2008-05-01 14:37 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-26 19:29 . 2009-07-10 13:28 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-26 19:26 . 2008-04-11 19:06 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-26 19:22 . 2009-12-09 10:11 2147328 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-26 19:22 . 2009-12-09 10:11 2068224 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-26 19:22 . 2009-12-09 10:11 2025984 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-26 19:21 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-26 19:21 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-26 19:21 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-26 19:20 . 2009-06-22 06:48 726528 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-01-26 19:13 . 2010-02-23 12:33 -------- d--h--w- c:\windows\$hf_mig$
2010-01-26 19:11 . 2010-01-26 19:11 -------- d-----w- c:\program files\CCleaner
2010-01-26 19:10 . 2010-01-26 19:10 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 19:09 . 2010-01-26 19:09 -------- d-----w- c:\program files\7-Zip

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 21:40 . 2004-08-18 12:00 47386 ----a-w- c:\windows\system32\perfc005.dat
2010-01-26 21:40 . 2004-08-18 12:00 313244 ----a-w- c:\windows\system32\perfh005.dat
2010-01-26 18:57 . 2010-01-26 18:03 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-26 18:57 . 2010-01-26 18:03 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-26 18:54 . 2010-01-26 18:03 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-26 18:21 . 2010-01-26 18:21 -------- d-----w- c:\program files\IObit
2010-01-26 18:17 . 2010-01-26 18:17 -------- d-----w- c:\program files\Alwil Software
2010-01-26 18:04 . 2010-01-26 18:04 -------- d-----w- c:\program files\microsoft frontpage
2010-01-26 18:01 . 2010-01-26 18:01 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-31 16:50 . 2004-08-18 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:09 . 2009-12-22 05:09 81920 ------w- c:\windows\system32\ieencode.dll
2009-12-21 19:08 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2010-01-26 18:00 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-18 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2004-08-18 12:00 2191360 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2068224 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-18 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:14 . 2004-08-18 12:00 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2004-08-18 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-18 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:09 . 2004-08-18 12:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-02-08 2343632]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-02-04 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-02-04 2166784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\¬enda\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"12449:TCP"= 12449:TCP:BitComet 12449 TCP
"12449:UDP"= 12449:UDP:BitComet 12449 UDP

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.2.2010 12:49 142592]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-24 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2010-01-26 13:11]

2010-02-23 c:\windows\Tasks\AWC Update.job
- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2010-01-26 12:38]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.download.com/Wise-Disk-Cleaner-3-Fr ... tag=button
IE: &Winamp Search - c:\documents and settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\documents and settings\Čenda\Data aplikací\Mozilla\Firefox\Profiles\64ejhfjr.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60076&qkw=
FF - component: c:\documents and settings\Čenda\Data aplikací\Mozilla\Firefox\Profiles\64ejhfjr.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\Crawler\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-24 21:15
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3292)
c:\windows\system32\webcheck.dll
.
Celkový čas: 2010-02-24 21:16:01
ComboFix-quarantined-files.txt 2010-02-24 20:15

Před spuštěním: Volných bajtů: 22 806 372 352
Po spuštění: Volných bajtů: 22 778 773 504

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 0B77060130593F48B908CE42B24294FB

Log vypadá čistý. Zkuste vyčistit cache mozilly. Hlášku můžete ignorovat v případě, že jste si jist, že oba rez. štíty (Avast i ST) jste vypnul.