VIRY.CZ

Ahoj,
tak to vypadá, že mám asi poprvé v PC vir (stalo se to při jedné neopatrné operaci s jistým softwarem).
Spustil jsem exe soubor, on pak zmizel a zdá se mi, že mám nějaký pomalejší počítač - v task manageru vidím, že system idlle processes vytěžují CPU fakt hodně - někdy i 95%.

Když chci vrátil bod obnovení, tak to nejde. Pomocí rootkit revealer jsem našel v tom skrytém oddílu system volume information že tam něco je, tak jsem to zkusil smazat v nouzovém režimu a nepovedlo se to. Avast mi nic nenajde. Ještě poznamenám, že se mi to stalo asi před měsícem a doteď jsem neměl náladu to řešit, ale fakt mě to už štve.

Myslíte, že to je nějaký rootkit, který je v tom volume inforormation nebo je to ještě někde jinde? Nevíte, jak se toho zbavit? Díky moc

P.S. níže přikládám rsit log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jonas at 2010-03-06 19:31:22
Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (4%) free of 38 GB
Total RAM: 503 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:31:29, on 6.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\PHPWebServer\mysql\bin\mysqld.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MozyHome\mozystat.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Jonas\My Documents\různé\programy\RSIT.exe
C:\Documents and Settings\Jonas\My Documents\různé\programy\Jonas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\IEPro.dll
O2 - BHO: IexploreOmea - {09628AAA-66AD-4FA2-82E2-698185B66463} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Omea - {35402C01-1777-4159-9ABA-3480BA70D90A} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe
O8 - Extra context menu item: Clip and Edit - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
O8 - Extra context menu item: Clip and Save - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Subscribe to Feed - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra 'Tools' menuitem: Omea Add-on Options… - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Subscribe to Feed - {35402C01-1777-4159-9ABA-3480BA70D903} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Edit - {35402C01-1777-4159-9ABA-3480BA70D905} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Save - {35402C01-1777-4159-9ABA-3480BA70D907} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Annotate - {35402C01-1777-4159-9ABA-3480BA70D909} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CWS_Apache_80 - Apache Software Foundation - C:\PHPWebServer\apache\bin\apache.exe
O23 - Service: CWS_MySQL_3306 - Unknown owner - C:\PHPWebServer\mysql\bin\mysqld.exe
O23 - Service: CXQ - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\CXQ.exe
O23 - Service: G - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe
O23 - Service: GJFDIK - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\GJFDIK.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Mozy, Inc. - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: POLXW - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\POLXW.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TTFWFMHPIRX - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\TTFWFMHPIRX.exe
O23 - Service: UMTZKCYDXJ - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\Jonas\LOCALS~1\Temp\UMTZKCYDXJ.exe

--
End of file - 9117 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\OGALogon.job
C:\WINDOWS\tasks\shutdown.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job
C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - C:\Program Files\IEPro\IEPro.dll [2008-12-08 752744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09628AAA-66AD-4FA2-82E2-698185B66463}]
COmeaHelper Object - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6}]
del.icio.us Toolbar Helper - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\Program Files\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{981FE6A8-260C-4930-960F-C3BC82746CB0} - del.icio.us - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]
{35402C01-1777-4159-9ABA-3480BA70D90A} - Omea - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"=C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe [2003-05-08 69632]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-06-22 126976]
"avast!"=C:\PROGRA~1\Avast4\ashDisp.exe [2009-11-25 81000]
"QuickTime Task"=C:\qttask.exe [2009-05-26 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
C:\PHPWebServer\bin\ServiceDirect.exe [2006-09-17 686080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2005-06-22 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2003-05-05 143360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
MozyHome Status.lnk - C:\Program Files\MozyHome\mozystat.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2005-06-22 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\VLC Player\vlc.exe"="C:\Program Files\VLC Player\vlc.exe:*:Enabled:VLC media player"
"C:\PHPWebServer\apache\bin\Apache.exe"="C:\PHPWebServer\apache\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\IDrive\IDriveEClassic.exe"="C:\Program Files\IDrive\IDriveEClassic.exe:*:Enabled:IDrive Classic"
"C:\Program Files\WinSCP\WinSCP.exe"="C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:SFTP, FTP and SCP client"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
"C:\Program Files\Metin2_TESTER\metin2.bin"="C:\Program Files\Metin2_TESTER\metin2.bin:*:Enabled:metin2"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe"="C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe:*:Enabled:MxDownloadServer"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\hry\World of Padman\wop.exe"="C:\hry\World of Padman\wop.exe:*:Enabled:wop"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 2 months======

2010-03-06 19:16:30 ----D---- C:\rsit
2010-02-24 01:07:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-21 10:35:58 ----A---- C:\WINDOWS\IsUninst.exe
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmltok.dll
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmlparse.dll
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmlinst.exe
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\VB5DB.DLL
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\msxml3a.dll
2010-02-20 13:38:41 ----D---- C:\Program Files\Ubisoft
2010-02-10 16:48:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 16:48:30 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 16:44:10 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 16:43:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 16:43:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 16:43:34 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 16:43:18 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 16:43:02 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 16:42:38 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-01-31 14:53:59 ----D---- C:\Program Files\DAEMON Tools Lite
2010-01-31 14:53:10 ----D---- C:\Documents and Settings\Jonas\Application Data\DAEMON Tools Lite
2010-01-31 14:52:55 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
2010-01-13 13:53:45 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 13:53:27 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 2 months======

2010-03-06 19:16:48 ----D---- C:\WINDOWS\Prefetch
2010-03-06 19:10:39 ----D---- C:\WINDOWS\Temp
2010-03-06 14:40:19 ----HD---- C:\WINDOWS\inf
2010-03-06 14:40:18 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-06 14:14:00 ----D---- C:\Documents and Settings\Jonas\Application Data\OpenOffice.org2
2010-03-05 20:45:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 20:28:18 ----D---- C:\Program Files\Firefox
2010-03-05 19:45:27 ----D---- C:\WINDOWS
2010-03-04 19:25:04 ----D---- C:\Documents and Settings\Jonas\Application Data\Free Download Manager
2010-02-24 01:08:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 01:08:52 ----D---- C:\WINDOWS\system32
2010-02-24 01:08:50 ----D---- C:\WINDOWS\ie8updates
2010-02-24 01:08:08 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-24 01:08:00 ----A---- C:\WINDOWS\imsins.BAK
2010-02-21 22:07:19 ----SHD---- C:\System Volume Information
2010-02-21 21:20:52 ----D---- C:\WINDOWS\repair
2010-02-21 21:20:34 ----D---- C:\WINDOWS\Registration
2010-02-21 16:57:02 ----D---- C:\Documents and Settings\Jonas\Application Data\uTorrent
2010-02-21 14:34:35 ----D---- C:\hry
2010-02-20 13:38:41 ----RD---- C:\Program Files
2010-02-20 13:36:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-18 19:08:46 ----D---- C:\Documents and Settings\Jonas\Application Data\.purple
2010-02-17 15:43:38 ----A---- C:\WINDOWS\AviSplitter.INI
2010-02-13 13:19:19 ----D---- C:\WINDOWS\system32\drivers
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-30 10:35:42 ----D---- C:\Config.Msi
2010-01-29 22:03:27 ----SHD---- C:\WINDOWS\Installer
2010-01-29 22:02:53 ----D---- C:\Program Files\MozyHome
2010-01-27 10:22:13 ----D---- C:\Program Files\Avast4
2010-01-26 19:35:04 ----SHD---- C:\RECYCLER
2010-01-23 10:12:26 ----D---- C:\Program Files\Internet Explorer
2010-01-23 09:11:44 -------- C:\WINDOWS\system32\tzchange.exe
2010-01-22 16:15:18 ----D---- C:\Program Files\Microsoft Silverlight
2010-01-13 17:33:24 ----D---- C:\WINDOWS\AppPatch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 Ext2fs;Ext2fs; C:\WINDOWS\system32\DRIVERS\ext2fs.sys [2008-01-20 179584]
R1 IfsMount;IfsMount; C:\WINDOWS\system32\DRIVERS\ifsmount.sys [2007-12-29 49536]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 mozyFilter;mozyFilter; C:\WINDOWS\system32\DRIVERS\mozy.sys [2009-06-24 54776]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-14 100224]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-03-14 165760]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-06-22 807998]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-05-28 578304]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 a0tknywn;a0tknywn; C:\WINDOWS\system32\drivers\a0tknywn.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 JakNDisMP;JakNDisMP; C:\WINDOWS\system32\DRIVERS\JakNDis.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast4\ashServ.exe [2009-11-25 138680]
R2 CWS_Apache_80;CWS_Apache_80; C:\PHPWebServer\apache\bin\apache.exe [2005-10-09 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306; C:\PHPWebServer\mysql\bin\mysqld.exe [2005-12-02 3526656]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 mozybackup;MozyHome Backup Service; C:\Program Files\MozyHome\mozybackup.exe [2009-01-30 78136]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-21 45056]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 CXQ;CXQ; C:\DOCUME~1\Jonas\LOCALS~1\Temp\CXQ.exe [2010-01-03 347008]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 G;G; C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe [2010-01-29 576384]
S3 GJFDIK;GJFDIK; C:\DOCUME~1\Jonas\LOCALS~1\Temp\GJFDIK.exe [2010-01-29 498560]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 POLXW;POLXW; C:\DOCUME~1\Jonas\LOCALS~1\Temp\POLXW.exe [2010-01-29 588672]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 TTFWFMHPIRX;TTFWFMHPIRX; C:\DOCUME~1\Jonas\LOCALS~1\Temp\TTFWFMHPIRX.exe [2010-01-29 584576]
S3 UMTZKCYDXJ;UMTZKCYDXJ; C:\DOCUME~1\Jonas\LOCALS~1\Temp\UMTZKCYDXJ.exe [2010-01-29 334720]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravím

Na logu se pracuje, prosím o strpení.

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrází stránka s licenčnímy podmínkami, pokračujte stisknutím tlačítka "Ano"

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Během skenování může být počítač restartován.

tak už to mám, trvalo to nějak dlouho, ten můj počítač je i bez viru dost velká šunka

ComboFix 10-03-06.01 - Jonas 06.03.2010 22:01:08.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.503.136 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jonas\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100306-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Jonas\LOCALS~1\Temp\install_flash_player.exe
c:\windows\system32\Ijl11.dll
c:\windows\system32\vbpng1.dll
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-06 do 2010-03-06 )))))))))))))))))))))))))))))))
.

2010-03-06 18:16 . 2010-03-06 18:17 -------- d-----w- C:\rsit
2010-02-21 09:35 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-20 12:38 . 2002-11-28 08:22 89360 ----a-r- c:\windows\system32\VB5DB.DLL
2010-02-20 12:38 . 2002-11-28 08:22 69632 ----a-r- c:\windows\system32\xmltok.dll
2010-02-20 12:38 . 2002-11-28 08:22 36864 ----a-r- c:\windows\system32\xmlparse.dll
2010-02-20 12:38 . 2002-11-28 08:22 26064 ----a-r- c:\windows\system32\xmlinst.exe
2010-02-20 12:38 . 2002-11-28 08:22 24576 ----a-r- c:\windows\system32\msxml3a.dll
2010-02-20 12:38 . 2010-02-20 12:38 -------- d-----w- c:\program files\Ubisoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 18:40 . 2009-06-06 11:03 -------- d-----w- c:\program files\Firefox
2010-03-06 16:16 . 2008-03-10 20:21 -------- d-----w- c:\documents and settings\Jonas\Application Data\OpenOffice.org2
2010-03-04 18:25 . 2009-01-04 21:41 -------- d-----w- c:\documents and settings\Jonas\Application Data\Free Download Manager
2010-02-21 15:57 . 2009-01-04 15:46 -------- d-----w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-02-21 15:20 . 2009-10-11 16:12 25 ----a-w- c:\windows\popcinfot.dat
2010-02-20 12:36 . 2007-11-15 01:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-18 18:08 . 2009-05-02 16:52 -------- d-----w- c:\documents and settings\Jonas\Application Data\.purple
2010-01-31 14:01 . 2010-01-31 13:53 -------- d-----w- c:\documents and settings\Jonas\Application Data\DAEMON Tools Lite
2010-01-31 13:54 . 2010-01-31 13:53 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-01-31 13:54 . 2010-01-31 13:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-31 13:53 . 2010-01-31 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-01-29 21:02 . 2008-06-14 12:36 -------- d-----w- c:\program files\MozyHome
2010-01-27 18:04 . 2008-03-13 18:25 -------- d-----w- c:\documents and settings\Honza\Application Data\PC Suite
2010-01-27 09:22 . 2008-03-10 18:38 -------- d-----w- c:\program files\Avast4
2010-01-22 15:15 . 2008-04-08 12:31 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-31 22:41 . 2009-12-30 14:48 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe
2009-12-31 22:41 . 2009-12-30 14:48 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 19:27 . 2008-03-08 04:59 69192 -c--a-w- c:\documents and settings\Jonas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2007-11-15 01:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-16 16:07 . 2009-12-28 15:37 166912 ----a-w- c:\windows\system32\libmcrypt.dll
2009-12-16 16:07 . 2008-03-25 16:02 212992 ----a-w- c:\windows\system32\ssleay32.dll
2009-12-16 16:07 . 2008-03-25 16:02 2076672 ----a-w- c:\windows\system32\libmysql.dll
2009-12-16 16:07 . 2008-03-25 16:02 1118208 ----a-w- c:\windows\system32\libeay32.dll
2009-12-14 07:08 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2006-02-28 12:00 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2004-08-03 22:59 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2010-01-04 10:36 2848568 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2010-01-04 10:36 2848568 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="C:\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2010-1-4 2893624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
2006-09-17 20:55 686080 -c--a-w- c:\phpwebserver\bin\ServiceDirect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-22 00:48 155648 -c----w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
2003-05-05 16:57 143360 -c----w- c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\VLC Player\\vlc.exe"=
"c:\\PHPWebServer\\apache\\bin\\Apache.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Metin2_TESTER\\metin2.bin"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [31.1.2010 14:54 691696]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 15:41 114768]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [23.6.2009 17:37 179584]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [23.6.2009 17:37 49536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 15:41 20560]
R2 CWS_Apache_80;CWS_Apache_80;c:\phpwebserver\apache\bin\Apache.exe [25.3.2008 17:01 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306;c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 --> c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 [?]
S3 CXQ;CXQ;c:\docume~1\Jonas\LOCALS~1\Temp\CXQ.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\CXQ.exe [?]
S3 G;G;c:\docume~1\Jonas\LOCALS~1\Temp\G.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\G.exe [?]
S3 GJFDIK;GJFDIK;c:\docume~1\Jonas\LOCALS~1\Temp\GJFDIK.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\GJFDIK.exe [?]
S3 JakNDisMP;JakNDisMP;c:\windows\system32\DRIVERS\JakNDis.sys --> c:\windows\system32\DRIVERS\JakNDis.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]
S3 POLXW;POLXW;c:\docume~1\Jonas\LOCALS~1\Temp\POLXW.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\POLXW.exe [?]
S3 TTFWFMHPIRX;TTFWFMHPIRX;c:\docume~1\Jonas\LOCALS~1\Temp\TTFWFMHPIRX.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\TTFWFMHPIRX.exe [?]
S3 UMTZKCYDXJ;UMTZKCYDXJ;c:\docume~1\Jonas\LOCALS~1\Temp\UMTZKCYDXJ.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\UMTZKCYDXJ.exe [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-01-04 c:\windows\Tasks\shutdown.job
- c:\windows\system32\shutdown.exe [2006-02-28 00:12]

2010-03-06 c:\windows\Tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Clip and Edit - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
IE: Clip and Save - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: Subscribe to Feed - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\f9aakado.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-DataLayer - c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe
MSConfigStartUp-PCSuiteTrayApplication - c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
AddRemove-HijackThis - c:\documents and settings\Jonas\Desktop\HijackThis.exe
AddRemove-Mozilla Firefox (2.0.0.14) - c:\documents and settings\Jonas\My Documents\FirefoxPortable\App\firefox\uninstall\helper.exe
AddRemove-Mozilla Firefox (3.0.5) - c:\documents and settings\Jonas\My Documents\webdev\FirefoxPortable\App\firefox\uninstall\helper.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-06 22:21
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sple.sys >>UNKNOWN [0x82394938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf8585f28
\Driver\ACPI -> ACPI.sys @ 0xf83edcb8
\Driver\atapi -> atapi.sys @ 0xf8382b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Intel(R) PRO/100 VM Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf8278bb0
PacketIndicateHandler -> NDIS.sys @ 0xf8285a21
SendHandler -> NDIS.sys @ 0xf826387b
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1923132299-448257100-619329731-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'explorer.exe'(1680)
c:\windows\system32\WININET.dll
c:\program files\MozyHome\mozyshell.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avast4\aswUpdSv.exe
c:\program files\Avast4\ashServ.exe
c:\windows\system32\brss01a.exe
c:\phpwebserver\mysql\bin\mysqld.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MozyHome\mozybackup.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Avast4\ashMaiSv.exe
c:\program files\Avast4\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2010-03-06 22:38:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-06 21:38

Před spuštěním: 1 478 856 704 bytes free
Po spuštění: 2 606 575 616 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - B64387AA746D111076A55F272DAE134C

Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

log vypadá takto:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

no píše to, že to je ok, tak nevím

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

vše proběhlo ok, tady je další log:

ComboFix 10-03-06.01 - Jonas 07.03.2010 14:11:32.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.503.191 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jonas\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jonas\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100306-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\docume~1\Jonas\LOCALS~1\Temp\CXQ.exe"
"c:\docume~1\Jonas\LOCALS~1\Temp\G.exe"
"c:\docume~1\Jonas\LOCALS~1\Temp\GJFDIK.exe"
"c:\docume~1\Jonas\LOCALS~1\Temp\POLXW.exe"
"c:\docume~1\Jonas\LOCALS~1\Temp\TTFWFMHPIRX.exe"
"c:\docume~1\Jonas\LOCALS~1\Temp\UMTZKCYDXJ.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CXQ
-------\Legacy_GJFDIK
-------\Legacy_POLXW
-------\Legacy_TTFWFMHPIRX
-------\Legacy_UMTZKCYDXJ
-------\Service_CXQ
-------\Service_GJFDIK
-------\Service_POLXW
-------\Service_TTFWFMHPIRX
-------\Service_UMTZKCYDXJ


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-07 do 2010-03-07 )))))))))))))))))))))))))))))))
.

2010-03-06 18:16 . 2010-03-06 18:17 -------- d-----w- C:\rsit
2010-02-21 09:35 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-20 12:38 . 2002-11-28 08:22 89360 ----a-r- c:\windows\system32\VB5DB.DLL
2010-02-20 12:38 . 2002-11-28 08:22 69632 ----a-r- c:\windows\system32\xmltok.dll
2010-02-20 12:38 . 2002-11-28 08:22 36864 ----a-r- c:\windows\system32\xmlparse.dll
2010-02-20 12:38 . 2002-11-28 08:22 26064 ----a-r- c:\windows\system32\xmlinst.exe
2010-02-20 12:38 . 2002-11-28 08:22 24576 ----a-r- c:\windows\system32\msxml3a.dll
2010-02-20 12:38 . 2010-02-20 12:38 -------- d-----w- c:\program files\Ubisoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 18:40 . 2009-06-06 11:03 -------- d-----w- c:\program files\Firefox
2010-03-06 16:16 . 2008-03-10 20:21 -------- d-----w- c:\documents and settings\Jonas\Application Data\OpenOffice.org2
2010-03-04 18:25 . 2009-01-04 21:41 -------- d-----w- c:\documents and settings\Jonas\Application Data\Free Download Manager
2010-02-21 15:57 . 2009-01-04 15:46 -------- d-----w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-02-21 15:20 . 2009-10-11 16:12 25 ----a-w- c:\windows\popcinfot.dat
2010-02-20 12:36 . 2007-11-15 01:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-18 18:08 . 2009-05-02 16:52 -------- d-----w- c:\documents and settings\Jonas\Application Data\.purple
2010-01-31 14:01 . 2010-01-31 13:53 -------- d-----w- c:\documents and settings\Jonas\Application Data\DAEMON Tools Lite
2010-01-31 13:53 . 2010-01-31 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-01-29 21:02 . 2008-06-14 12:36 -------- d-----w- c:\program files\MozyHome
2010-01-27 18:04 . 2008-03-13 18:25 -------- d-----w- c:\documents and settings\Honza\Application Data\PC Suite
2010-01-27 09:22 . 2008-03-10 18:38 -------- d-----w- c:\program files\Avast4
2010-01-22 15:15 . 2008-04-08 12:31 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-31 22:41 . 2009-12-30 14:48 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe
2009-12-31 22:41 . 2009-12-30 14:48 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 19:27 . 2008-03-08 04:59 69192 -c--a-w- c:\documents and settings\Jonas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2006-02-28 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2007-11-15 01:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-16 16:07 . 2009-12-28 15:37 166912 ----a-w- c:\windows\system32\libmcrypt.dll
2009-12-16 16:07 . 2008-03-25 16:02 212992 ----a-w- c:\windows\system32\ssleay32.dll
2009-12-16 16:07 . 2008-03-25 16:02 2076672 ----a-w- c:\windows\system32\libmysql.dll
2009-12-16 16:07 . 2008-03-25 16:02 1118208 ----a-w- c:\windows\system32\libeay32.dll
2009-12-14 07:08 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2006-02-28 12:00 2189184 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2004-08-03 22:59 2066048 ------w- c:\windows\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2010-01-04 10:36 2848568 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2010-01-04 10:36 2848568 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="C:\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2010-1-4 2893624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
2006-09-17 20:55 686080 -c--a-w- c:\phpwebserver\bin\ServiceDirect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-22 00:48 155648 -c----w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
2003-05-05 16:57 143360 -c----w- c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\VLC Player\\vlc.exe"=
"c:\\PHPWebServer\\apache\\bin\\Apache.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Metin2_TESTER\\metin2.bin"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 15:41 114768]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [23.6.2009 17:37 179584]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [23.6.2009 17:37 49536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 15:41 20560]
R2 CWS_Apache_80;CWS_Apache_80;c:\phpwebserver\apache\bin\Apache.exe [25.3.2008 17:01 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306;c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 --> c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 [?]
S3 G;G;c:\docume~1\Jonas\LOCALS~1\Temp\G.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\G.exe [?]
S3 JakNDisMP;JakNDisMP;c:\windows\system32\DRIVERS\JakNDis.sys --> c:\windows\system32\DRIVERS\JakNDis.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-01-04 c:\windows\Tasks\shutdown.job
- c:\windows\system32\shutdown.exe [2006-02-28 00:12]

2010-03-07 c:\windows\Tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Clip and Edit - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
IE: Clip and Save - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: Subscribe to Feed - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\f9aakado.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-07 14:25
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1923132299-448257100-619329731-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'explorer.exe'(4064)
c:\windows\system32\WININET.dll
c:\program files\MozyHome\mozyshell.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avast4\aswUpdSv.exe
c:\program files\Avast4\ashServ.exe
c:\windows\system32\brss01a.exe
c:\phpwebserver\mysql\bin\mysqld.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MozyHome\mozybackup.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Avast4\ashMaiSv.exe
c:\program files\Avast4\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2010-03-07 14:37:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-07 13:37
ComboFix2.txt 2010-03-06 21:38

Před spuštěním: 2 530 689 024 bytes free
Po spuštění: 2 492 272 640 bytes free

- - End Of File - - E00E23149AFA60EF6D391F81061BBE9C

Jak to vypadá s PC

Zdá se mi, že je o něco rychlejší a že by to snad už mělo být v pohodě. Ale ty system idlle processes pořád spotřebovávají podle task maangeru cpu, okolo 90%. Ale v tom okně výkon, sekce využití cpu se tolik nezobrazuje, tam jenom tak 20%. Tak třeba to je s těmi system procesy normální, že se tam zobrazuje tolik procent.

Že je vše ok by taky asi šlo pozant tak, že když chci vrátit bod na bod obnovení, tak že to bez problémů funguje. Ale to mi teď přijde blbé zkoušet, když by se ty změny co jsme udělali zase tedy asi vrátily zpátky. Mám třeba teď udělat bod obnovení a zkusit to vrátit? Nebo ještě nějaký test?

System idlle processes jsou nečinné procesy, to je v pořádku.


Dejte nový log z RSIT, obnovu systému nedělejte.

tady je ten rsit log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jonas at 2010-03-07 15:11:11
Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (6%) free of 38 GB
Total RAM: 503 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:11:12, on 7.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\PHPWebServer\mysql\bin\mysqld.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MozyHome\mozystat.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Jonas\My Documents\různé\programy\anti-viry\RSIT.exe
C:\Documents and Settings\Jonas\My Documents\různé\programy\anti-viry\Jonas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\IEPro.dll
O2 - BHO: IexploreOmea - {09628AAA-66AD-4FA2-82E2-698185B66463} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Omea - {35402C01-1777-4159-9ABA-3480BA70D90A} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - Global Startup: MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe
O8 - Extra context menu item: Clip and Edit - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
O8 - Extra context menu item: Clip and Save - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Subscribe to Feed - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra 'Tools' menuitem: Omea Add-on Options… - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Subscribe to Feed - {35402C01-1777-4159-9ABA-3480BA70D903} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Edit - {35402C01-1777-4159-9ABA-3480BA70D905} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Save - {35402C01-1777-4159-9ABA-3480BA70D907} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Annotate - {35402C01-1777-4159-9ABA-3480BA70D909} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CWS_Apache_80 - Apache Software Foundation - C:\PHPWebServer\apache\bin\apache.exe
O23 - Service: CWS_MySQL_3306 - Unknown owner - C:\PHPWebServer\mysql\bin\mysqld.exe
O23 - Service: G - Unknown owner - C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Mozy, Inc. - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 8397 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\shutdown.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - C:\Program Files\IEPro\IEPro.dll [2008-12-08 752744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09628AAA-66AD-4FA2-82E2-698185B66463}]
COmeaHelper Object - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6}]
del.icio.us Toolbar Helper - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\Program Files\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{981FE6A8-260C-4930-960F-C3BC82746CB0} - del.icio.us - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]
{35402C01-1777-4159-9ABA-3480BA70D90A} - Omea - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"=C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe [2003-05-08 69632]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-06-22 126976]
"avast!"=C:\PROGRA~1\Avast4\ashDisp.exe [2009-11-25 81000]
"QuickTime Task"=C:\qttask.exe [2009-05-26 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
C:\PHPWebServer\bin\ServiceDirect.exe [2006-09-17 686080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2005-06-22 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2003-05-05 143360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
MozyHome Status.lnk - C:\Program Files\MozyHome\mozystat.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2005-06-22 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\VLC Player\vlc.exe"="C:\Program Files\VLC Player\vlc.exe:*:Enabled:VLC media player"
"C:\PHPWebServer\apache\bin\Apache.exe"="C:\PHPWebServer\apache\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\WinSCP\WinSCP.exe"="C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:SFTP, FTP and SCP client"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
"C:\Program Files\Metin2_TESTER\metin2.bin"="C:\Program Files\Metin2_TESTER\metin2.bin:*:Enabled:metin2"
"C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe"="C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe:*:Enabled:MxDownloadServer"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-07 14:37:24 ----A---- C:\ComboFix.txt
2010-03-06 21:01:20 ----A---- C:\Boot.bak
2010-03-06 21:01:08 ----RASHD---- C:\cmdcons
2010-03-06 20:59:35 ----A---- C:\WINDOWS\zip.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\SWREG.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\sed.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\PEV.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\MBR.exe
2010-03-06 20:59:35 ----A---- C:\WINDOWS\grep.exe
2010-03-06 20:59:34 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-06 20:59:34 ----A---- C:\WINDOWS\SWSC.exe
2010-03-06 20:58:45 ----D---- C:\WINDOWS\ERDNT
2010-03-06 20:56:20 ----D---- C:\Qoobox
2010-03-06 19:16:30 ----D---- C:\rsit
2010-02-24 01:07:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-21 10:35:58 ----A---- C:\WINDOWS\IsUninst.exe
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmltok.dll
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmlparse.dll
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\xmlinst.exe
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\VB5DB.DLL
2010-02-20 13:38:42 ----RA---- C:\WINDOWS\system32\msxml3a.dll
2010-02-20 13:38:41 ----D---- C:\Program Files\Ubisoft
2010-02-10 16:48:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 16:48:30 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 16:44:10 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 16:43:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 16:43:46 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 16:43:34 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 16:43:18 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 16:43:02 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 16:42:38 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$

======List of files/folders modified in the last 1 months======

2010-03-07 14:53:21 ----D---- C:\WINDOWS\Temp
2010-03-07 14:51:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-07 14:51:27 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-07 14:37:32 ----D---- C:\WINDOWS\system32\drivers
2010-03-07 14:24:04 ----N---- C:\WINDOWS\system.ini
2010-03-07 14:24:04 ----D---- C:\WINDOWS
2010-03-07 14:21:46 ----D---- C:\WINDOWS\system32\config
2010-03-07 14:18:28 ----D---- C:\WINDOWS\system32
2010-03-07 14:18:28 ----D---- C:\WINDOWS\AppPatch
2010-03-07 14:18:21 ----D---- C:\Program Files\Common Files
2010-03-07 14:10:10 ----D---- C:\WINDOWS\Prefetch
2010-03-07 13:52:47 ----RD---- C:\Program Files
2010-03-06 22:36:42 ----SD---- C:\WINDOWS\Tasks
2010-03-06 21:01:20 ----RASH---- C:\boot.ini
2010-03-06 19:40:24 ----D---- C:\Program Files\Firefox
2010-03-06 17:16:52 ----D---- C:\Documents and Settings\Jonas\Application Data\OpenOffice.org2
2010-03-06 14:40:19 ----HD---- C:\WINDOWS\inf
2010-03-04 19:25:04 ----D---- C:\Documents and Settings\Jonas\Application Data\Free Download Manager
2010-02-24 01:08:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 01:08:50 ----D---- C:\WINDOWS\ie8updates
2010-02-24 01:08:08 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-24 01:08:00 ----A---- C:\WINDOWS\imsins.BAK
2010-02-21 22:07:19 ----SHD---- C:\System Volume Information
2010-02-21 21:20:52 ----D---- C:\WINDOWS\repair
2010-02-21 21:20:34 ----D---- C:\WINDOWS\Registration
2010-02-21 16:57:02 ----D---- C:\Documents and Settings\Jonas\Application Data\uTorrent
2010-02-21 14:34:35 ----D---- C:\hry
2010-02-20 13:36:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-18 19:08:46 ----D---- C:\Documents and Settings\Jonas\Application Data\.purple
2010-02-17 15:43:38 ----A---- C:\WINDOWS\AviSplitter.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 Ext2fs;Ext2fs; C:\WINDOWS\system32\DRIVERS\ext2fs.sys [2008-01-20 179584]
R1 IfsMount;IfsMount; C:\WINDOWS\system32\DRIVERS\ifsmount.sys [2007-12-29 49536]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 mozyFilter;mozyFilter; C:\WINDOWS\system32\DRIVERS\mozy.sys [2009-06-24 54776]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-14 100224]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-03-14 165760]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-06-22 807998]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-05-28 578304]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 JakNDisMP;JakNDisMP; C:\WINDOWS\system32\DRIVERS\JakNDis.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast4\ashServ.exe [2009-11-25 138680]
R2 CWS_Apache_80;CWS_Apache_80; C:\PHPWebServer\apache\bin\apache.exe [2005-10-09 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306; C:\PHPWebServer\mysql\bin\mysqld.exe [2005-12-02 3526656]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 mozybackup;MozyHome Backup Service; C:\Program Files\MozyHome\mozybackup.exe [2009-01-30 78136]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-21 45056]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 G;G; C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe []
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Doporučuji odinstalovat:
C:\Program Files\uTorrent\utorrent.exe

P2P sítě a jejich klienti jsou potenciálním bezpečnostním rizikem, prakticky neustále jsou zdrojem virů, zbytečně se vystavujete riziku.



Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

• Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
• Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

• Spusťte.
• Klikněte na "CleanUp!". Potvrďte hlášky stiskem "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

• Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.
  
  Záložka Čistič
• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
  OK Zavřít

V logu nevidím firewall, doinstalujte Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

Tak jsem vše udělal, snad už to je v pořádku. Díky moc za vaše rady. Je skvělé že tady člověku zdarma takto poradí a pomůžou. To budou ty zlaté české ručičky .

Vím, že torrenty jsou nebezpečné, ale snažím se stahovat jen ověřené soubory a to víte, občas si člověk prostě něco stáhnout musí . Firewall chci nainstalovat už dlouho, pořád to ale odkládám - myslím, že teď se do toho konečně pustím. Ještě jednou díky za pomoc!

Nemáte zač