Vytížení PC:100% Vyřešeno

[Dejvid_1]

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je FC81-8FD4.

Věpis adres ýe C:\WINDOWS

14.04.2008 14:00 978˙432 Explorer.EXE
1 soubor…, 978˙432 bajt…


toto to vyhodilo...

[Reklama]

[Damned]

Přiložil jsem ti explorer.exe v archívu. Archív si ulož na Plochu a obsah (soubor explorer.exe) exportuj do těchto složek:
C:\WINDOWS\ServicePackFiles\i386
C:\WINDOWS\system32\dllcache\cache
až budeš mít tak:
*****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
C:\DOCUME~1\Milan\LOCALS~1\Temp\ctv285.exe
c:\windows\eins2214.dll
c:\windows\eins2214.msi

Driver::
catchme



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[Dejvid_1]

ComboFix 09-09-28.01 - Milan 29.09.2009 20:25.4.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1535.965 [GMT 2:00]
Spuštěný z: c:\documents and settings\Milan\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Milan\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\docume~1\Milan\LOCALS~1\Temp\ctv285.exe"
"c:\windows\eins2214.dll"
"c:\windows\eins2214.msi"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\docume~1\Milan\LOCALS~1\Temp\ctv285.exe
c:\windows\eins2214.dll
c:\windows\eins2214.msi
c:\windows\system32\ctfmon .exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CATCHME
-------\Service_catchme
-------\Legacy_CATCHME
-------\Service_catchme


((((((((((((((((((((((((( Soubory vytvořené od 2009-08-28 do 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-29 15:57 . 2009-09-29 15:57 -------- d-----w- c:\windows\Servicepackfiles
2009-09-28 16:31 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-28 16:31 . 2009-09-28 16:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-28 16:31 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 15:30 . 2009-09-28 15:30 -------- d-----w- c:\program files\FCleaner
2009-09-28 14:40 . 2009-09-28 14:40 -------- d-----w- c:\documents and settings\Milan\SmitfraudFix
2009-09-28 14:38 . 2009-09-28 14:38 -------- d-----w- c:\program files\Trend Micro
2009-09-28 07:22 . 2009-09-28 07:35 -------- d-----w- c:\program files\Security Task Manager
2009-09-27 18:52 . 2009-09-27 18:52 -------- d-----w- c:\program files\Common Files\Corel
2009-09-27 18:41 . 2009-09-27 20:00 -------- d-----w- c:\program files\Corel
2009-09-27 18:32 . 2009-09-27 19:36 27136 ----a-w- c:\documents and settings\Milan\soundman.exe
2009-09-27 08:02 . 2009-09-27 08:02 -------- d-----w- c:\program files\Realtek AC97
2009-09-22 20:12 . 2009-09-22 20:12 -------- d-----w- C:\Nová složka
2009-09-12 20:09 . 2009-09-19 10:21 -------- d-----w- c:\program files\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 18:37 . 2009-07-08 08:13 -------- d-----w- c:\program files\SysMetrix
2009-09-27 21:45 . 2009-05-22 16:26 -------- d-----w- c:\program files\Common Files\Real
2009-09-27 21:44 . 2009-05-13 15:29 -------- d-----w- c:\program files\VstPlugins
2009-09-27 21:44 . 2009-05-13 15:26 -------- d-----w- c:\program files\Image-Line
2009-09-27 20:10 . 2008-12-04 17:02 -------- d-----w- c:\program files\Garena
2009-09-27 19:24 . 2008-12-02 20:18 -------- d-----w- c:\program files\ESET
2009-09-27 11:58 . 2009-01-17 10:40 138352 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-27 11:58 . 2009-01-17 10:39 191304 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-26 15:10 . 2009-01-17 10:39 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-09-25 12:29 . 2008-10-29 15:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 12:03 . 2008-10-29 20:48 -------- d-----w- c:\program files\Winamp
2009-09-19 14:35 . 2008-12-02 20:01 140038 ----a-w- c:\windows\War3Unin.dat
2009-09-19 11:17 . 2009-05-05 12:17 -------- d-----w- c:\program files\EA GAMES
2009-09-19 10:36 . 2008-11-15 20:31 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-09-13 08:04 . 2009-01-17 16:48 -------- d-----w- c:\program files\HLSW
2009-09-11 12:00 . 2009-07-01 14:16 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-02 18:12 . 2009-07-24 10:52 -------- d-----w- c:\program files\Winferno
2009-08-28 12:28 . 2008-11-01 09:31 -------- d-----w- c:\program files\Java
2009-08-27 11:04 . 2009-08-27 11:04 -------- d-----w- c:\program files\Hamachi
2009-08-27 11:04 . 2008-12-04 16:30 16224 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-08-05 09:01 . 2008-04-14 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 13:17 . 2009-01-17 10:07 -------- d-----w- c:\program files\Activision
2009-07-25 03:23 . 2008-11-01 09:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:04 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-04-14 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-28_19.11.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 18:36 . 2009-09-29 18:36 16384 c:\windows\temp\Perflib_Perfdata_368.dat
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\logagent.exe
+ 2008-04-14 12:00 . 2009-07-12 10:21 233472 c:\windows\system32\dllcache\wmpdxm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 233472 c:\windows\system32\dllcache\wmpdxm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\WMVCore.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\wmp.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\WMNetmgr.dll
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\dllcache\WMVCore.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\dllcache\WMNetmgr.dll
+ 2009-09-29 15:58 . 2008-04-14 07:52 1034240 c:\windows\system32\dllcache\cache\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\i386\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2009-09-29 27136]
"SysMetrix"="c:\program files\SysMetrix\SysMetrix.exe" [2009-09-29 27136]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Milan\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"GzhengnXe"= {FC818FD5-562B-257F-2935-A6BAC7D6CABC} - c:\windows\system32\pv.dll [2009-03-21 32768]

[HKLM\~\startupfolder\C:^Documents and Settings^Milan^Nabídka Start^Programy^Po spuštění^PowerReg Scheduler V3.exe]
path=c:\documents and settings\Milan\Nabídka Start\Programy\Po spuštění\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"FTweakFCleaner"=c:\program files\FCleaner\FCleaner.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games Files\\Valve\\hl.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Games Files\\Valve\\hlds.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\Warcraft III.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\war3.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Garena HostEdition\\Garena.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Valve\\hl.exe"=
"c:\\Program Files\\EA GAMES\\Command and Conquer Generals\\game.dat"=
"c:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [29.10.2008 17:15 76373]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [19.9.2009 12:21 305936]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [29.10.2008 17:15 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [29.10.2008 17:15 10005]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [29.10.2008 17:20 9510]
.
Obsah adresáře 'Naplánované úlohy'

2009-09-24 c:\windows\Tasks\Italobrothers - Stamp on the ground.job
- c:\documents and settings\Milan\Plocha\mp3\Nirvana\Nevermind\08-Nirvana-Drain_You.mp3 [2009-07-13 11:27]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\rtun255r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Eurobattle.net - c:\windows\Eurobattle.net



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 20:37
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(4060)
c:\windows\system32\SHDOCVW.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO860un71.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Microsoft Office\Office12\1029\GrooveIntlResource.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\WinFast\WFTVFM\wfwiz .exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\SysMetrix\sysmetrix .exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Celkový čas: 2009-09-29 20:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-09-29 18:46
ComboFix2.txt 2009-09-28 20:23
ComboFix3.txt 2009-09-28 19:16

Před spuštěním: 8 544 206 848
Po spuštění: 8 531 619 840

265 --- E O F --- 2009-09-28 20:25

[Damned]

Ještě jeden skript.
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\pv.dll

FCopy::
c:\windows\Servicepackfiles\i386\explorer.exe | C:\windows\explorer.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"GzhengnXe"=-




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[Dejvid_1]

Ok

[Dejvid_1]

Tady je log, a chtel bych doplnit ze po dokonceni se zacala stale obevovat chybova hlaska o ochrane souboru systemu windows, chce to po me nejake cd asi winů... jestli to neni problém... ?


ComboFix 09-09-28.01 - Milan 29.09.2009 21:19.5.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1535.971 [GMT 2:00]
Spuštěný z: c:\documents and settings\Milan\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Milan\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\system32\pv.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\pv.dll

.
--------------- FCopy ---------------

c:\windows\Servicepackfiles\i386\explorer.exe --> c:\windows\explorer.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-08-28 do 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-29 15:57 . 2009-09-29 15:57 -------- d-----w- c:\windows\Servicepackfiles
2009-09-28 16:31 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-28 16:31 . 2009-09-28 16:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-28 16:31 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 15:30 . 2009-09-28 15:30 -------- d-----w- c:\program files\FCleaner
2009-09-28 14:40 . 2009-09-28 14:40 -------- d-----w- c:\documents and settings\Milan\SmitfraudFix
2009-09-28 14:38 . 2009-09-28 14:38 -------- d-----w- c:\program files\Trend Micro
2009-09-28 07:22 . 2009-09-28 07:35 -------- d-----w- c:\program files\Security Task Manager
2009-09-27 18:52 . 2009-09-27 18:52 -------- d-----w- c:\program files\Common Files\Corel
2009-09-27 18:41 . 2009-09-27 20:00 -------- d-----w- c:\program files\Corel
2009-09-27 18:32 . 2009-09-27 19:36 27136 ----a-w- c:\documents and settings\Milan\soundman.exe
2009-09-27 08:02 . 2009-09-27 08:02 -------- d-----w- c:\program files\Realtek AC97
2009-09-22 20:12 . 2009-09-22 20:12 -------- d-----w- C:\Nová složka
2009-09-12 20:09 . 2009-09-19 10:21 -------- d-----w- c:\program files\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 18:37 . 2009-07-08 08:13 -------- d-----w- c:\program files\SysMetrix
2009-09-27 21:45 . 2009-05-22 16:26 -------- d-----w- c:\program files\Common Files\Real
2009-09-27 21:44 . 2009-05-13 15:29 -------- d-----w- c:\program files\VstPlugins
2009-09-27 21:44 . 2009-05-13 15:26 -------- d-----w- c:\program files\Image-Line
2009-09-27 20:10 . 2008-12-04 17:02 -------- d-----w- c:\program files\Garena
2009-09-27 19:24 . 2008-12-02 20:18 -------- d-----w- c:\program files\ESET
2009-09-27 11:58 . 2009-01-17 10:40 138352 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-27 11:58 . 2009-01-17 10:39 191304 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-26 15:10 . 2009-01-17 10:39 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-09-25 12:29 . 2008-10-29 15:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 12:03 . 2008-10-29 20:48 -------- d-----w- c:\program files\Winamp
2009-09-19 14:35 . 2008-12-02 20:01 140038 ----a-w- c:\windows\War3Unin.dat
2009-09-19 11:17 . 2009-05-05 12:17 -------- d-----w- c:\program files\EA GAMES
2009-09-19 10:36 . 2008-11-15 20:31 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-09-13 08:04 . 2009-01-17 16:48 -------- d-----w- c:\program files\HLSW
2009-09-11 12:00 . 2009-07-01 14:16 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-02 18:12 . 2009-07-24 10:52 -------- d-----w- c:\program files\Winferno
2009-08-28 12:28 . 2008-11-01 09:31 -------- d-----w- c:\program files\Java
2009-08-27 11:04 . 2009-08-27 11:04 -------- d-----w- c:\program files\Hamachi
2009-08-27 11:04 . 2008-12-04 16:30 16224 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-08-05 09:01 . 2008-04-14 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 13:17 . 2009-01-17 10:07 -------- d-----w- c:\program files\Activision
2009-07-25 03:23 . 2008-11-01 09:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:04 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-04-14 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-28_19.11.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 19:29 . 2009-09-29 19:29 16384 c:\windows\temp\Perflib_Perfdata_2d4.dat
+ 2009-09-29 19:32 . 2009-09-29 19:32 16384 c:\windows\temp\Perflib_Perfdata_1b4.dat
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\logagent.exe
- 2008-04-14 12:00 . 2008-04-14 12:00 233472 c:\windows\system32\dllcache\wmpdxm.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 233472 c:\windows\system32\dllcache\wmpdxm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\WMVCore.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\WMNetmgr.dll
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\dllcache\WMVCore.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\dllcache\wmp.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-04-14 12:00 . 2008-04-14 07:52 1034240 c:\windows\system32\dllcache\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\i386\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2009-09-29 27136]
"SysMetrix"="c:\program files\SysMetrix\SysMetrix.exe" [2009-09-29 27136]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Milan\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

[HKLM\~\startupfolder\C:^Documents and Settings^Milan^Nabídka Start^Programy^Po spuštění^PowerReg Scheduler V3.exe]
path=c:\documents and settings\Milan\Nabídka Start\Programy\Po spuštění\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"FTweakFCleaner"=c:\program files\FCleaner\FCleaner.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games Files\\Valve\\hl.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Games Files\\Valve\\hlds.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\Warcraft III.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\war3.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Garena HostEdition\\Garena.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Valve\\hl.exe"=
"c:\\Program Files\\EA GAMES\\Command and Conquer Generals\\game.dat"=
"c:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [29.10.2008 17:15 76373]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [19.9.2009 12:21 305936]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [29.10.2008 17:15 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [29.10.2008 17:15 10005]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [29.10.2008 17:20 9510]
.
Obsah adresáře 'Naplánované úlohy'

2009-09-24 c:\windows\Tasks\Italobrothers - Stamp on the ground.job
- c:\documents and settings\Milan\Plocha\mp3\Nirvana\Nevermind\08-Nirvana-Drain_You.mp3 [2009-07-13 11:27]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\rtun255r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Eurobattle.net - c:\windows\Eurobattle.net



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 21:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\docume~1\Milan\LOCALS~1\Temp\lucene-7f62f6f7ebf09f76af24ae7c24f526fb-commit.lock 0 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2964)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO860un71.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\SysMetrix\sysmetrix .exe
c:\program files\WinFast\WFTVFM\wfwiz .exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\mspaint.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Celkový čas: 2009-09-29 21:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-09-29 19:40
ComboFix2.txt 2009-09-29 18:46
ComboFix3.txt 2009-09-28 20:23
ComboFix4.txt 2009-09-28 19:16

Před spuštěním: 8 530 604 032
Po spuštění: 8 481 538 048

255 --- E O F --- 2009-09-28 20:25
ComboFix 09-09-28.01 - Milan 29.09.2009 21:19.5.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1535.971 [GMT 2:00]
Spuštěný z: c:\documents and settings\Milan\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Milan\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\system32\pv.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\pv.dll

.
--------------- FCopy ---------------

c:\windows\Servicepackfiles\i386\explorer.exe --> c:\windows\explorer.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-08-28 do 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-29 15:57 . 2009-09-29 15:57 -------- d-----w- c:\windows\Servicepackfiles
2009-09-28 16:31 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-28 16:31 . 2009-09-28 16:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-28 16:31 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 15:30 . 2009-09-28 15:30 -------- d-----w- c:\program files\FCleaner
2009-09-28 14:40 . 2009-09-28 14:40 -------- d-----w- c:\documents and settings\Milan\SmitfraudFix
2009-09-28 14:38 . 2009-09-28 14:38 -------- d-----w- c:\program files\Trend Micro
2009-09-28 07:22 . 2009-09-28 07:35 -------- d-----w- c:\program files\Security Task Manager
2009-09-27 18:52 . 2009-09-27 18:52 -------- d-----w- c:\program files\Common Files\Corel
2009-09-27 18:41 . 2009-09-27 20:00 -------- d-----w- c:\program files\Corel
2009-09-27 18:32 . 2009-09-27 19:36 27136 ----a-w- c:\documents and settings\Milan\soundman.exe
2009-09-27 08:02 . 2009-09-27 08:02 -------- d-----w- c:\program files\Realtek AC97
2009-09-22 20:12 . 2009-09-22 20:12 -------- d-----w- C:\Nová složka
2009-09-12 20:09 . 2009-09-19 10:21 -------- d-----w- c:\program files\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 18:37 . 2009-07-08 08:13 -------- d-----w- c:\program files\SysMetrix
2009-09-27 21:45 . 2009-05-22 16:26 -------- d-----w- c:\program files\Common Files\Real
2009-09-27 21:44 . 2009-05-13 15:29 -------- d-----w- c:\program files\VstPlugins
2009-09-27 21:44 . 2009-05-13 15:26 -------- d-----w- c:\program files\Image-Line
2009-09-27 20:10 . 2008-12-04 17:02 -------- d-----w- c:\program files\Garena
2009-09-27 19:24 . 2008-12-02 20:18 -------- d-----w- c:\program files\ESET
2009-09-27 11:58 . 2009-01-17 10:40 138352 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-27 11:58 . 2009-01-17 10:39 191304 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-26 15:10 . 2009-01-17 10:39 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-09-25 12:29 . 2008-10-29 15:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 12:03 . 2008-10-29 20:48 -------- d-----w- c:\program files\Winamp
2009-09-19 14:35 . 2008-12-02 20:01 140038 ----a-w- c:\windows\War3Unin.dat
2009-09-19 11:17 . 2009-05-05 12:17 -------- d-----w- c:\program files\EA GAMES
2009-09-19 10:36 . 2008-11-15 20:31 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-09-13 08:04 . 2009-01-17 16:48 -------- d-----w- c:\program files\HLSW
2009-09-11 12:00 . 2009-07-01 14:16 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-02 18:12 . 2009-07-24 10:52 -------- d-----w- c:\program files\Winferno
2009-08-28 12:28 . 2008-11-01 09:31 -------- d-----w- c:\program files\Java
2009-08-27 11:04 . 2009-08-27 11:04 -------- d-----w- c:\program files\Hamachi
2009-08-27 11:04 . 2008-12-04 16:30 16224 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-08-05 09:01 . 2008-04-14 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 13:17 . 2009-01-17 10:07 -------- d-----w- c:\program files\Activision
2009-07-25 03:23 . 2008-11-01 09:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:04 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-04-14 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-28_19.11.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 19:29 . 2009-09-29 19:29 16384 c:\windows\temp\Perflib_Perfdata_2d4.dat
+ 2009-09-29 19:32 . 2009-09-29 19:32 16384 c:\windows\temp\Perflib_Perfdata_1b4.dat
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\logagent.exe
- 2008-04-14 12:00 . 2008-04-14 12:00 233472 c:\windows\system32\dllcache\wmpdxm.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 233472 c:\windows\system32\dllcache\wmpdxm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2008-06-10 01:11 103936 c:\windows\system32\dllcache\logagent.exe
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\WMVCore.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\WMNetmgr.dll
+ 2008-04-14 12:00 . 2009-05-26 14:53 2174976 c:\windows\system32\dllcache\WMVCore.dll
+ 2008-04-14 12:00 . 2009-07-12 10:21 4874240 c:\windows\system32\dllcache\wmp.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2008-04-14 12:00 . 2008-06-10 04:11 1053696 c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-04-14 12:00 . 2008-04-14 07:52 1034240 c:\windows\system32\dllcache\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\i386\explorer.exe
+ 2009-09-29 15:57 . 2008-04-14 07:52 1034240 c:\windows\Servicepackfiles\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2009-09-29 27136]
"SysMetrix"="c:\program files\SysMetrix\SysMetrix.exe" [2009-09-29 27136]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Milan\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

[HKLM\~\startupfolder\C:^Documents and Settings^Milan^Nabídka Start^Programy^Po spuštění^PowerReg Scheduler V3.exe]
path=c:\documents and settings\Milan\Nabídka Start\Programy\Po spuštění\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"FTweakFCleaner"=c:\program files\FCleaner\FCleaner.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games Files\\Valve\\hl.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Games Files\\Valve\\hlds.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\Warcraft III.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games Files\\WRFT3\\Warcraft III\\war3.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Garena HostEdition\\Garena.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Milan\\Plocha\\Valve\\hl.exe"=
"c:\\Program Files\\EA GAMES\\Command and Conquer Generals\\game.dat"=
"c:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [29.10.2008 17:15 76373]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [19.9.2009 12:21 305936]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [29.10.2008 17:15 32631]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [29.10.2008 17:15 10005]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [29.10.2008 17:20 9510]
.
Obsah adresáře 'Naplánované úlohy'

2009-09-24 c:\windows\Tasks\Italobrothers - Stamp on the ground.job
- c:\documents and settings\Milan\Plocha\mp3\Nirvana\Nevermind\08-Nirvana-Drain_You.mp3 [2009-07-13 11:27]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Milan\Data aplikací\Mozilla\Firefox\Profiles\rtun255r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Eurobattle.net - c:\windows\Eurobattle.net



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 21:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\docume~1\Milan\LOCALS~1\Temp\lucene-7f62f6f7ebf09f76af24ae7c24f526fb-commit.lock 0 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2964)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO860un71.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\SysMetrix\sysmetrix .exe
c:\program files\WinFast\WFTVFM\wfwiz .exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\mspaint.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Celkový čas: 2009-09-29 21:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-09-29 19:40
ComboFix2.txt 2009-09-29 18:46
ComboFix3.txt 2009-09-28 20:23
ComboFix4.txt 2009-09-28 19:16

Před spuštěním: 8 530 604 032
Po spuštění: 8 481 538 048

255 --- E O F --- 2009-09-28 20:25

[Damned]

Klidně nech kontrolu provést. Ověří pravost systémových souborů Win. Pokud nevložíš CD Win, najdi mu kontrolní složku:

c:\windows\Servicepackfiles\i386\
nebo
c:\windows\system32\dllcache\

[Dejvid_1]

ok... :-) moc diky

[Dejvid_1]

myslím že už to běží vše v pořádku.... :) moc dekuji za všechny rady...

[Damned]

Odinstaluj ComboFix (nutné!).
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem a použij i T-Cleaner(taky nutné), smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.

ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Kdyby něco, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

[Dejvid_1]

A jeste pro doplnění co programem MWAV.... mám používat? nebo /u ?

[Damned]

MWAV má zhruba měsíční aktualizaci. Já si po měsíci stáhnu novej *exe, zkontroluju co najde a smažu ho.