KONTROLA LOGU

[killers1]

Poprosim o kontrolo logu + neviete preco ked dam zobrazit spravcu uloh tak mi spravi vzdy to iste? Robi mi to uz od nainstalovania windows

Kód: Vybrat vše

http://uploading.sk/informace/obrazek/74eyeut/10.jpg

LOG Z HJT:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\P1tkes\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\P1tkes.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\P1tkes\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\P1tkes\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: syspck32.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{576DA221-33CA-43ED-BF9D-B4FEAD4F5143}: NameServer = 92.245.2.245,92.245.2.162
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe

--
End of file - 5975 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\P1tkes\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-03-29 79224]

C:\Documents and Settings\P1tkes\Start Menu\Programs\Startup
syspck32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wbsys.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB]
C:\Program Files\AlienGUIse\fastload.dll [2001-12-21 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"LegalNoticeText"=
"LegalNoticeCaption"=

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Valve\Steam\SteamApps\panther194\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\panther194\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\TVUPlayer\TVUPlayer.exe"="C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVUPlayer Component"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\PPStream\PPStream.exe"="C:\Program Files\PPStream\PPStream.exe:*:Enabled:PPSÍřÂçµçĘÓ"
"C:\Program Files\PPStream\PPSAP.exe"="C:\Program Files\PPStream\PPSAP.exe:*:Enabled:PPS ÍřÂçĽÓËŮĆ÷"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Documents and Settings\P1tkes\Desktop\GHostOne1.7.266\GHostOne\GHostOne.exe"="C:\Documents and Settings\P1tkes\Desktop\GHostOne1.7.266\GHostOne\GHostOne.exe:*:Enabled:GHost One - advanced hosting bot"
"C:\HRY\Warcraft III\war3.exe"="C:\HRY\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46eaceb6-2146-11df-882d-001676655b50}]
shell\AutoRun\command - G:\SMEKER//laushki.exe
shell\open\command - G:\SMEKER//laushki.exe


======List of files/folders created in the last 1 months======

2010-04-06 21:37:12 ----D---- C:\Program Files\trend micro
2010-04-06 21:37:09 ----D---- C:\rsit
2010-04-06 20:10:24 ----A---- C:\WINDOWS\system32\fjhdyfhsn.bat
2010-04-06 11:45:28 ----D---- C:\Program Files\Common Files\Skype
2010-04-03 18:15:50 ----D---- C:\Documents and Settings\P1tkes\Application Data\TeamViewer
2010-04-01 11:24:13 ----A---- C:\WINDOWS\War3Unin.exe
2010-04-01 10:30:03 ----D---- C:\WINDOWS\Eurobattle.net
2010-03-31 20:33:58 ----D---- C:\HRY
2010-03-22 15:38:09 ----D---- C:\Program Files\Common Files\DirectX
2010-03-22 15:33:29 ----D---- C:\Need for Speed Underground 2
2010-03-22 15:31:27 ----D---- C:\Program Files\7-Zip
2010-03-22 14:20:56 ----D---- C:\Program Files\DAEMON Tools Toolbar
2010-03-22 14:20:45 ----D---- C:\Program Files\DAEMON Tools Lite
2010-03-22 14:20:32 ----D---- C:\Documents and Settings\P1tkes\Application Data\DAEMON Tools Lite
2010-03-22 14:20:30 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
2010-03-21 09:10:56 ----D---- C:\WINDOWS\pss
2010-03-14 16:59:36 ----D---- C:\WINDOWS\Minidump
2010-03-14 15:55:41 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2010-03-13 00:20:35 ----D---- C:\Program Files\Bonjour
2010-03-13 00:08:04 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-03-13 00:00:01 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-03-12 23:59:49 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2010-03-11 21:39:10 ----D---- C:\Program Files\Total Video Converter
2010-03-11 15:04:49 ----D---- C:\Documents and Settings\P1tkes\Application Data\skypePM
2010-03-11 12:54:18 ----D---- C:\Program Files\BS player
2010-03-08 21:09:25 ----A---- C:\WINDOWS\WORDPAD.INI

======List of files/folders modified in the last 1 months======

2010-04-06 21:37:17 ----D---- C:\WINDOWS\Prefetch
2010-04-06 21:37:12 ----RD---- C:\Program Files
2010-04-06 21:33:20 ----D---- C:\Program Files\Registry Mechanic
2010-04-06 21:33:03 ----D---- C:\WINDOWS\Temp
2010-04-06 21:30:25 ----D---- C:\WINDOWS
2010-04-06 21:28:27 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-06 20:13:22 ----D---- C:\WINDOWS\system32\drivers
2010-04-06 20:12:39 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-06 20:10:24 ----D---- C:\WINDOWS\system32
2010-04-06 11:53:47 ----D---- C:\Documents and Settings\P1tkes\Application Data\Skype
2010-04-06 11:45:45 ----SHD---- C:\WINDOWS\Installer
2010-04-06 11:45:41 ----RD---- C:\Program Files\Skype
2010-04-06 11:45:28 ----D---- C:\Program Files\Common Files
2010-04-06 11:45:25 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2010-04-05 21:45:15 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-04-04 23:04:18 ----A---- C:\WINDOWS\NeroDigital.ini
2010-04-03 18:14:53 ----D---- C:\Documents and Settings\P1tkes\Application Data\ICQ
2010-04-03 18:14:40 ----D---- C:\Program Files\ICQ7.0
2010-04-02 20:57:21 ----D---- C:\Program Files\Mozilla Firefox
2010-04-01 11:06:26 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-03-28 12:15:11 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-24 00:53:26 ----D---- C:\Documents and Settings\P1tkes\Application Data\Adobe
2010-03-22 00:29:39 ----D---- C:\Program Files\JetAudio
2010-03-21 09:31:58 ----SH---- C:\boot.ini
2010-03-21 09:31:58 ----A---- C:\WINDOWS\win.ini
2010-03-21 09:31:57 ----A---- C:\WINDOWS\system.ini
2010-03-17 20:54:56 ----D---- C:\WINDOWS\pchealth
2010-03-16 12:54:27 ----SD---- C:\Documents and Settings\P1tkes\Application Data\Microsoft
2010-03-13 00:23:41 ----D---- C:\Program Files\Adobe
2010-03-13 00:22:38 ----D---- C:\Program Files\Common Files\Adobe
2010-03-13 00:17:32 ----RSD---- C:\WINDOWS\Fonts
2010-03-13 00:08:39 ----D---- C:\WINDOWS\WinSxS
2010-03-13 00:00:46 ----HD---- C:\WINDOWS\inf

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-03-29 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 75856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-03-29 42912]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-03-29 94544]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-03-01 3959360]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-03-29 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S2 ATE_PROCMON;ATE_PROCMON; \??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 axtd6guu;axtd6guu; C:\WINDOWS\system32\drivers\axtd6guu.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-06-05 561152]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-03-29 17272]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-03-29 144760]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-03-29 247160]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-03-29 345464]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-03-13 654848]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

+


info.txt logfile of random's system information tool 1.06 2010-04-06 21:37:30

======Uninstall list======

-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
ABBYY PDF Transformer 2.0-->MsiExec.exe /I{FA200000-0001-0000-0000-074957833700}
Ad-Aware 2007-->MsiExec.exe /X{0E6AB9FC-76C2-431B-9C06-6C1CFFFEA8EB}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{BD087F50-46B2-43E4-BD73-5DB3DC20B47C}
Adobe Color JA Extra Settings-->MsiExec.exe /I{D92B72E2-C854-4738-8ED6-4C3661CC17AE}
Adobe Color NA Extra Settings-->MsiExec.exe /I{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\4977c84bcdc298c444ccfbdcccb660d\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{5178C1BB-1EB1-4468-894B-7DE964DDCAA2}
Adobe Reader 7.0 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A70000000000}
Adobe Setup-->MsiExec.exe /I{0901FCE8-5415-4499-BBC8-1AA106DD66E2}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
AlienGUIse Theme Manager-->C:\PROGRA~1\ALIENG~1\thememgr.exe /uninstallwise
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->MsiExec.exe /I{86EC42B5-346E-4BAB-948D-58E021EA4BD1}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
BSPlayer-->"C:\Program Files\BS player\uninstall.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Counter-Strike(TM)-->MsiExec.exe /I{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}
COWON Media Center - jetAudio Basic-->C:\Program Files\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe -runfromtemp -l0x0009 -removeonly
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Eurobattle.net-->"C:\WINDOWS\Eurobattle.net\uninstall.exe" "/U:C:\HRY\Warcraft III\Uninstall\uninstall.xml"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
ICQ Toolbar-->C:\Program Files\ICQ6Toolbar\ICQUnToolbar.exe
ICQ7-->"C:\Program Files\InstallShield Installation Information\{88EB38EF-4D2C-436D-ABD3-56B232674062}\ICQ7.exe" -runfromtemp -l0x0009 -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110405-6000-11D3-8CFE-0150048383C9}
Mozilla Firefox (3.6.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Nero 7 Demo-->MsiExec.exe /I{1CBCC734-E92F-C744-D86C-3699D5351051}
PDF Settings-->MsiExec.exe /I{293D5729-7C01-4FA4-A4DE-BB6A1587BBB9}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\Setup.exe" -l0x9 -removeonly
REALTEK GbE & FE Ethernet PCI NIC Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe" -l0x1b -removeonly
Registry Mechanic 6.0-->"C:\Program Files\Registry Mechanic\unins000.exe"
save2pc Pro 3.25-->"C:\Program Files\save2pc\unins000.exe"
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Total Video Converter 3.10-->"C:\Program Files\Total Video Converter\unins000.exe"
Ventrilo-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
WinXP Manager-->MsiExec.exe /I{784CFD4D-1BA5-4DB5-9377-84DAF0D19EF1}
Your Uninstaller! 2008 Version 6.0-->"C:\Program Files\Your Uninstaller 2008\unins000.exe"

======Security center information======

AV: avast! antivirus 4.8.1169 [VPS 100406-2]

======System event log======

Computer Name: P1TKES-CB2A6C0E
Event Code: 7035
Message: Službe Application Layer Gateway Service bolo úspešne odoslané riadenie Spustené.

Record Number: 988
Source Name: Service Control Manager
Time Written: 20100301135209.000000+000
Event Type: informácie
User: NT AUTHORITY\SYSTEM

Computer Name: P1TKES-CB2A6C0E
Event Code: 7036
Message: Služba SSDP Discovery Service vstúpila do stavu Spustené.

Record Number: 987
Source Name: Service Control Manager
Time Written: 20100301135209.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 7035
Message: Službe SSDP Discovery Service bolo úspešne odoslané riadenie Spustené.

Record Number: 986
Source Name: Service Control Manager
Time Written: 20100301135209.000000+000
Event Type: informácie
User: NT AUTHORITY\SYSTEM

Computer Name: P1TKES-CB2A6C0E
Event Code: 7036
Message: Služba IMAPI CD-Burning COM Service vstúpila do stavu Spustené.

Record Number: 985
Source Name: Service Control Manager
Time Written: 20100301135209.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 7035
Message: Službe aswRdr bolo úspešne odoslané riadenie Spustené.

Record Number: 984
Source Name: Service Control Manager
Time Written: 20100301135209.000000+000
Event Type: informácie
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: P1TKES-CB2A6C0E
Event Code: 1000
Message: Podarilo sa načítať počítadlá výkonu služby MSDTC (MSDTC).
Údaje záznamu obsahujú nové hodnoty registra priradené
k tejto službe.

Record Number: 5
Source Name: LoadPerf
Time Written: 20100219114429.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 1000
Message: Podarilo sa načítať počítadlá výkonu služby TermService (Terminal Services).
Údaje záznamu obsahujú nové hodnoty registra priradené
k tejto službe.

Record Number: 4
Source Name: LoadPerf
Time Written: 20100219114426.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 1000
Message: Podarilo sa načítať počítadlá výkonu služby RemoteAccess (Routing and Remote Access).
Údaje záznamu obsahujú nové hodnoty registra priradené
k tejto službe.

Record Number: 3
Source Name: LoadPerf
Time Written: 20100219114306.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 1000
Message: Podarilo sa načítať počítadlá výkonu služby PSched (PSched).
Údaje záznamu obsahujú nové hodnoty registra priradené
k tejto službe.

Record Number: 2
Source Name: LoadPerf
Time Written: 20100219114237.000000+000
Event Type: informácie
User:

Computer Name: P1TKES-CB2A6C0E
Event Code: 1000
Message: Podarilo sa načítať počítadlá výkonu služby RSVP (QoS RSVP).
Údaje záznamu obsahujú nové hodnoty registra priradené
k tejto službe.

Record Number: 1
Source Name: LoadPerf
Time Written: 20100219114236.000000+000
Event Type: informácie
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\ATI Technologies\ATI.ACE\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

[JaRon]

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46eaceb6-2146-11df-882d-001676655b50}]

Driver::
ATE_PROCMON


File::
C:\Documents and Settings\P1tkes\Start Menu\Programs\Startup\syspck32.exe

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[killers1]

combofix:
ComboFix 10-04-06.04 - P1tkes 07.04.2010 15:04:00.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1535.935 [GMT 1:00]
Running from: c:\documents and settings\P1tkes\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\P1tkes\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1169 [VPS 100407-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\P1tkes\Start Menu\Programs\Startup\syspck32.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\P1tkes\Application Data\avdrn.dat
c:\documents and settings\P1tkes\Application Data\Microsoft\Internet Explorer\qiPSearchbar.dll
c:\documents and settings\P1tkes\csrss.exe
c:\documents and settings\P1tkes\Start Menu\Programs\Startup\syspck32.exe
c:\windows\system32\fjhdyfhsn.bat
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ATE_PROCMON
-------\Service_ATE_PROCMON


((((((((((((((((((((((((( Files Created from 2010-03-07 to 2010-04-07 )))))))))))))))))))))))))))))))
.

2010-04-06 20:37 . 2010-04-06 20:37 -------- d-----w- c:\program files\trend micro
2010-04-06 20:37 . 2010-04-06 20:37 -------- d-----w- C:\rsit
2010-04-06 19:12 . 2010-04-06 19:12 804864 ----a-w- c:\windows\system32\drivers\pnnyzrol.sys
2010-04-06 19:12 . 2004-08-03 22:00 8192 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-04-06 19:12 . 2004-08-03 22:00 8192 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-04-06 19:11 . 2004-08-03 22:00 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-06 19:11 . 2004-08-03 22:00 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-06 10:45 . 2010-04-06 10:45 -------- d-----w- c:\program files\Common Files\Skype
2010-04-03 17:15 . 2010-04-03 17:58 -------- d-----w- c:\documents and settings\P1tkes\Application Data\TeamViewer
2010-04-03 17:15 . 2010-04-03 17:15 -------- d-----w- c:\documents and settings\P1tkes\temp
2010-04-01 10:24 . 2010-04-01 10:29 65892 ----a-w- c:\windows\War3Unin.dat
2010-04-01 10:24 . 2010-04-01 10:28 2829 ----a-w- c:\windows\War3Unin.pif
2010-04-01 10:24 . 2010-04-01 10:28 139264 ----a-w- c:\windows\War3Unin.exe
2010-04-01 09:30 . 2010-04-01 09:30 -------- d-----w- c:\windows\Eurobattle.net
2010-03-31 19:33 . 2010-04-03 17:59 -------- d-----w- C:\HRY
2010-03-22 14:38 . 2010-03-22 15:28 -------- d-----w- c:\documents and settings\P1tkes\Local Settings\Application Data\NFS Underground 2
2010-03-22 14:38 . 2010-03-22 14:38 -------- d-----w- c:\program files\Common Files\DirectX
2010-03-22 14:33 . 2008-01-09 17:30 -------- d-----w- C:\Need for Speed Underground 2
2010-03-22 14:31 . 2010-03-22 14:31 -------- d-----w- c:\program files\7-Zip
2010-03-22 13:20 . 2010-03-22 14:08 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-03-22 13:20 . 2010-03-22 14:08 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-03-22 13:20 . 2010-03-22 14:28 -------- d-----w- c:\documents and settings\P1tkes\Application Data\DAEMON Tools Lite
2010-03-22 13:20 . 2010-03-22 13:20 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-22 13:19 . 2010-03-22 14:08 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-15 22:40 . 2004-08-03 23:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-03-15 22:40 . 2004-08-03 23:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-03-14 14:55 . 2010-03-14 14:55 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-03-12 23:20 . 2010-03-12 23:20 -------- d-----w- c:\program files\Bonjour
2010-03-12 23:08 . 2010-03-12 23:08 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-03-11 20:39 . 2010-03-11 20:39 -------- d-----w- c:\program files\Total Video Converter
2010-03-11 14:04 . 2010-03-11 14:04 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-11 14:04 . 2010-04-06 10:40 -------- d-----w- c:\documents and settings\P1tkes\Application Data\skypePM
2010-03-11 11:54 . 2010-03-11 12:09 -------- d-----w- c:\program files\BS player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-06 20:27 . 2010-02-21 03:54 117760 ----a-w- c:\documents and settings\P1tkes\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-06 19:10 . 2010-04-06 19:10 8 ----a-w- c:\documents and settings\NetworkService\Application Data\jasltw.dat
2010-04-06 10:53 . 2010-02-19 13:44 -------- d-----w- c:\documents and settings\P1tkes\Application Data\Skype
2010-04-06 10:45 . 2010-02-19 13:44 -------- d-----r- c:\program files\Skype
2010-04-06 10:45 . 2010-02-19 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-04-03 17:14 . 2010-02-19 14:09 -------- d-----w- c:\documents and settings\P1tkes\Application Data\ICQ
2010-04-03 17:14 . 2010-02-19 14:08 -------- d-----w- c:\program files\ICQ7.0
2010-04-01 10:06 . 2010-02-20 20:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-21 23:29 . 2010-02-19 13:38 -------- d-----w- c:\program files\JetAudio
2010-03-16 12:58 . 2010-02-19 13:33 43336 ----a-w- c:\documents and settings\P1tkes\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-12 23:22 . 2010-02-19 13:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-24 16:36 . 2010-02-24 16:34 -------- d-----w- c:\program files\ABBYY PDF Transformer 2.0
2010-02-24 16:33 . 2010-02-24 16:32 -------- d-----w- c:\program files\PDF Transformer
2010-02-23 11:08 . 2010-02-19 13:43 -------- d-----w- c:\documents and settings\P1tkes\Application Data\Ahead
2010-02-22 15:53 . 2010-02-22 15:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-02-22 14:57 . 2010-02-22 14:57 -------- d-----w- c:\documents and settings\P1tkes\Application Data\AdobeUM
2010-02-21 04:33 . 2010-02-21 04:33 -------- d-----w- c:\program files\Lavasoft
2010-02-21 04:32 . 2010-02-19 13:28 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-21 04:07 . 2010-02-21 04:07 -------- d-----w- c:\documents and settings\P1tkes\Application Data\Malwarebytes
2010-02-21 04:07 . 2010-02-21 04:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-21 04:07 . 2010-02-21 04:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-21 03:55 . 2010-02-21 03:55 52224 ----a-w- c:\documents and settings\P1tkes\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-21 03:54 . 2010-02-21 03:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-21 03:54 . 2010-02-21 03:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-21 03:54 . 2010-02-21 03:54 -------- d-----w- c:\documents and settings\P1tkes\Application Data\SUPERAntiSpyware.com
2010-02-21 03:30 . 2010-02-21 03:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-21 03:20 . 2010-02-21 03:20 -------- d-----w- c:\program files\save2pc
2010-02-21 02:04 . 2010-02-21 01:55 -------- d-----w- c:\documents and settings\P1tkes\Application Data\PPStream
2010-02-21 01:37 . 2010-02-21 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\TVU Networks
2010-02-20 21:05 . 2010-02-20 21:05 129 ----a-w- c:\documents and settings\P1tkes\Local Settings\Application Data\fusioncache.dat
2010-02-20 21:02 . 2010-02-19 13:19 -------- d-----w- c:\program files\ATI Technologies
2010-02-20 21:01 . 2010-02-19 12:49 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-20 21:00 . 2010-02-19 12:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-20 20:56 . 2010-02-20 20:50 -------- d-----w- c:\program files\Your Uninstaller 2008
2010-02-20 20:51 . 2010-02-20 20:51 -------- d-----w- c:\documents and settings\P1tkes\Application Data\URSoft
2010-02-20 12:06 . 2010-02-19 14:15 -------- d-----w- c:\program files\AlienGUIse
2010-02-20 12:03 . 2010-02-19 14:03 -------- d-----w- c:\program files\QIP
2010-02-19 14:25 . 2010-02-19 14:25 15872 ----a-r- c:\documents and settings\P1tkes\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2010-02-19 14:25 . 2010-02-19 14:25 -------- d-----w- c:\program files\Valve
2010-02-19 14:21 . 2010-02-19 14:21 -------- d-----w- c:\documents and settings\P1tkes\Application Data\COWON
2010-02-19 14:15 . 2010-02-19 14:15 -------- d-----w- c:\program files\Common Files\Stardock
2010-02-19 14:10 . 2010-02-19 14:10 -------- d-----w- c:\program files\ICQ6Toolbar
2010-02-19 14:10 . 2010-02-19 14:10 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ
2010-02-19 14:05 . 2010-02-19 14:05 -------- d-----w- c:\program files\Microsoft.NET
2010-02-19 13:47 . 2010-02-19 13:47 -------- d-----w- c:\program files\Webteh
2010-02-19 13:43 . 2010-02-19 13:41 -------- d-----w- c:\program files\Common Files\Ahead
2010-02-19 13:41 . 2010-02-19 13:41 -------- d-----w- c:\program files\Nero
2010-02-19 13:38 . 2010-02-19 13:38 -------- d-----w- c:\program files\Common Files\COWON
2010-02-19 13:38 . 2010-02-19 13:38 -------- d-----w- c:\documents and settings\P1tkes\Application Data\InstallShield
2010-02-19 13:37 . 2010-02-19 13:37 -------- d-----w- c:\program files\CCleaner
2010-02-19 13:32 . 2010-02-19 13:32 -------- d-----w- c:\documents and settings\P1tkes\Application Data\ATI
2010-02-19 13:31 . 2010-02-19 13:31 -------- d-----w- c:\program files\Alwil Software
2010-02-19 13:29 . 2010-02-19 13:29 -------- d-----w- c:\documents and settings\P1tkes\Application Data\Ventrilo
2010-02-19 13:28 . 2010-02-19 13:28 -------- d-----w- c:\program files\Ventrilo
2010-02-19 13:21 . 2010-02-19 13:21 0 ----a-w- c:\windows\ativpsrm.bin
2010-02-19 13:15 . 2010-02-19 13:15 0 ----a-w- c:\windows\nsreg.dat
2010-02-19 12:53 . 2010-02-19 12:53 -------- d-----w- c:\program files\Realtek
2010-02-19 12:49 . 2010-02-19 12:49 -------- d-----w- c:\program files\Realtek AC97
2010-02-19 12:45 . 2010-02-19 12:45 -------- d-----w- c:\program files\Intel
2010-02-19 12:12 . 2010-02-19 11:47 5194 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-02-19 12:12 . 2010-02-19 11:47 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-19 12:11 . 2010-02-19 11:47 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-02-19 11:48 . 2010-02-19 11:48 -------- d-----w- c:\program files\microsoft frontpage
2010-02-19 11:44 . 2010-02-19 11:44 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-07 16:07 . 2010-02-21 04:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2010-02-21 04:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 23:34 24576 ----a-w- c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\panther194\\counter-strike\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\HRY\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.3.2010 14:19 691696]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [19.2.2010 14:31 75856]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 11:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17.2.2010 11:15 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.2.2010 14:31 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [19.2.2010 15:10 246520]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17.2.2010 11:15 12872]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
TCP: {576DA221-33CA-43ED-BF9D-B4FEAD4F5143} = 92.245.2.245,92.245.2.162
FF - ProfilePath - c:\documents and settings\P1tkes\Application Data\Mozilla\Firefox\Profiles\rno3as21.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - component: c:\documents and settings\P1tkes\Application Data\Mozilla\Firefox\Profiles\rno3as21.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 15:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x898531F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecfc3
\Driver\ACPI -> ACPI.sys @ 0xb9e74cb8
\Driver\atapi -> 0x898531f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb9d14bc3
PacketIndicateHandler -> NDIS.sys @ 0xb9d20b21
SendHandler -> NDIS.sys @ 0xb9d14d33
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-796845957-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(572)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\AlienGUIse\fastload.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2010-04-07 15:11:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-07 14:11

Pre-Run: 24 386 441 216 bytes free
Post-Run: 10 adresárov, 24 321 101 824 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

- - End Of File - - F277E94179E8E82CBF95269BABE0B262

[JaRon]

vycisti este PC s MBAM a napis ci su nejake problemy

[killers1]

dakujem velmi pekne. pc ide jak ma. V pripade nejakych problemov ozvem sa zas

[JaRon]

rado sa stalo