Nastavení Eset 4

Příspěvek od **jaro3** » 20 bře 2009 18:50

Koukni zda Ti funguje firewall ve win , zda jde vypnout a zapnout.
V ESS Nástroje- Log files (logy událostí)ESET Personal firewall log zda tam máš ten log. Nic Ti to nepíše ohledně firewallu? Nevím ESS jsem neměl. Já bych ještě kontaktoval jednou , ať Ti pomohou.

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 18:58

V celém Ess není nikde o firewallu ani slovíčko. Jakoby ani neexistoval

Brána ve Windech funguje. To znamená jde vypnout i zapnout

Příspěvek od **jaro3** » 20 bře 2009 19:03

Tak to nevím , koupil sis celý balík ESS?
Návod je tady , ale to už si asi absolvoval:
http://www.viry.cz/forum/viewtopic.php?t=56589" onclick="window.open(this.href);return false;
ESS jsi asi už zkoušel přeinstalovat..
Když jde firewall ve win , tak to asi viry nebude, ale stejně můžeš vložit log z HJT.

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 19:59

Tady je log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:07, on 20.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\oodtray.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\PopTray\PopTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [EPSON Stylus C40 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "C:\WINDOWS\system32\E_S57A.tmp"
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O8 - Extra context menu item: Analyzovat LeechGetem - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\Parser.html
O8 - Extra context menu item: Download LeechGetem - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\AddUrl.html
O8 - Extra context menu item: Download s průvodcem LeechGetu - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\Wizard.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 8374 bytes

Příspěvek od **jaro3** » 20 bře 2009 20:11

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O24 - Desktop Component 0: (no name) - (no file)

Vypni rez. ochrany u ESS.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 20:29

Tady je log z ComboFixu:

ComboFix 09-03-19.02 - Pavel 2009-03-20 20:19:52.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1633 [GMT 1:00]
Spuštěný z: c:\documents and settings\Pavel\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\regedit.com
c:\windows\system32\Dvbpws.dll
c:\windows\system32\taskmgr.com

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-20 do 2009-03-20 )))))))))))))))))))))))))))))))
.

2009-03-20 19:47 . 2009-03-20 19:47 <DIR> d-------- c:\program files\Trend Micro
2009-03-20 19:45 . 2009-03-20 19:45 <DIR> d-------- c:\windows\LastGood
2009-03-20 19:44 . 2009-03-20 19:44 <DIR> d-------- c:\program files\ESET
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\windows\Easy CD-DA Extractor 12
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\program files\Easy CD-DA Extractor 12
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Easy CD-DA Extractor
2009-03-19 19:18 . 2009-03-19 20:00 184 --a------ c:\windows\MyDrivers.ini
2009-03-19 19:15 . 2009-03-19 19:15 <DIR> d-------- c:\program files\My Drivers
2009-03-19 17:11 . 2009-03-19 17:11 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ESET
2009-03-19 00:16 . 2009-03-19 00:16 4,315,844 --a------ c:\windows\REGBK00.ZIP
2009-03-19 00:11 . 2009-03-19 00:11 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-19 00:02 . 2009-03-19 00:02 <DIR> d-a------ c:\windows\system32\vcmgcd32.dll
2009-03-19 00:02 . 2009-03-19 00:02 <DIR> d-a------ c:\windows\system32\iifgfgf.dll
2009-03-18 23:58 . 2008-04-14 07:52 147,968 --a------ c:\windows\R.COM
2009-03-18 23:58 . 2008-04-14 07:52 137,216 --a------ c:\windows\system32\T.COM
2009-03-18 23:58 . 2009-03-19 18:10 27 --a------ c:\windows\Lic.xxx
2009-03-18 20:05 . 2009-03-18 20:05 <DIR> d-------- c:\program files\Common Files\Adobe
2009-03-18 19:53 . 2009-03-18 19:53 <DIR> d-------- c:\program files\ScanButton 3.0
2009-03-18 19:53 . 2009-03-18 19:53 <DIR> d-------- c:\program files\MiraScan
2009-03-18 19:53 . 2002-02-26 14:34 172,032 --------- c:\windows\scanusdX.dll
2009-03-18 19:53 . 2000-05-22 17:46 151,552 -r------- c:\windows\UnUSBDrv.exe
2009-03-18 19:53 . 2000-03-03 15:18 147,456 -r------- c:\windows\CHECKING.DLL
2009-03-18 19:53 . 1999-08-24 21:55 66,560 --------- c:\windows\system32\WNASPI32.DLL
2009-03-18 19:53 . 2001-09-27 11:04 53,248 --------- c:\windows\stiaspi.dll
2009-03-18 19:53 . 1998-09-30 19:00 5,741 --------- c:\windows\gulp.vxd
2009-03-18 13:19 . 2009-03-20 08:35 1,905 --a------ c:\windows\diagwrn.xml
2009-03-18 13:19 . 2009-03-20 08:35 1,905 --a------ c:\windows\diagerr.xml
2009-03-18 08:56 . 2009-03-18 08:56 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Alawar
2009-03-18 08:55 . 2009-03-18 08:55 <DIR> d-------- c:\program files\Roboball
2009-03-17 13:53 . 2009-03-17 13:53 <DIR> d-------- c:\program files\Foxit Software
2009-03-17 13:53 . 2009-03-17 13:53 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Foxit
2009-03-17 12:33 . 2009-03-17 12:33 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ICQ Toolbar
2009-03-17 11:00 . 2009-03-17 11:11 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\SolSuite
2009-03-17 11:00 . 2009-03-17 11:00 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\TreeCardGames
2009-03-17 10:59 . 2009-03-17 11:01 <DIR> d-------- c:\program files\SolSuite
2009-03-17 10:52 . 2009-03-17 10:52 <DIR> d--h----- c:\program files\Seznam
2009-03-16 17:18 . 2009-03-16 17:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Ulead Systems
2009-03-16 16:31 . 2009-03-16 16:33 <DIR> d-------- c:\program files\ABBYY FineReader 7.0 Professional Edition
2009-03-16 15:47 . 2009-03-16 15:47 <DIR> d-------- c:\windows\system32\NtmsData
2009-03-16 07:41 . 2009-03-16 07:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LightScribe
2009-03-16 07:40 . 2009-03-16 07:41 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Nero
2009-03-16 07:31 . 2009-03-16 07:31 4,767 --a------ c:\windows\Irremote.ini
2009-03-16 07:30 . 2009-03-16 07:30 <DIR> d-------- c:\program files\Windows Sidebar
2009-03-16 07:22 . 2009-03-16 07:31 <DIR> d-------- c:\program files\Nero
2009-03-16 07:22 . 2009-03-16 07:38 <DIR> d-------- c:\program files\Common Files\Nero
2009-03-16 07:22 . 2009-03-16 07:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Nero
2009-03-16 07:21 . 2009-03-16 07:22 <DIR> d-------- c:\program files\Common Files\LightScribe
2009-03-16 07:02 . 2009-03-16 07:04 <DIR> d-------- c:\program files\ICQ6.5
2009-03-16 06:59 . 2009-03-19 11:55 <DIR> d-------- c:\program files\ICQToolbar
2009-03-16 06:58 . 2009-03-16 07:02 <DIR> d-------- c:\program files\ICQ6
2009-03-16 06:58 . 2009-03-16 15:14 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ICQ
2009-03-15 22:40 . 2009-03-20 16:21 0 --a------ c:\windows\XXLGSC
2009-03-15 22:35 . 2009-03-15 22:35 2,686 --a------ c:\windows\TRNCOM.INI
2009-03-15 22:34 . 2009-03-15 22:37 <DIR> d-------- C:\TRANSLAT
2009-03-15 22:34 . 2009-03-15 22:35 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LangSoft
2009-03-15 22:33 . 2009-03-15 22:40 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\LangSoft
2009-03-15 22:22 . 2009-03-15 22:22 <DIR> d-------- C:\CloneDVDTemp
2009-03-15 22:17 . 2009-03-15 22:17 135,772 ---h----- C:\treeinfo.wc
2009-03-15 14:39 . 2009-03-15 14:39 <DIR> d-------- c:\program files\Common Files\EPSON
2009-03-15 14:39 . 2000-06-07 01:01 169,472 --a------ c:\windows\system32\EBAPI2.dll
2009-03-15 14:38 . 2009-03-15 14:38 <DIR> d-------- c:\program files\EPSON
2009-03-15 14:36 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-03-15 14:36 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-03-15 12:18 . 2009-03-18 19:53 <DIR> d-------- c:\windows\usbbin
2009-03-15 12:18 . 2001-10-24 12:24 61,440 --a--c--- c:\windows\system32\dllcache\acerscad.dll
2009-03-15 12:18 . 2001-10-24 12:24 61,440 --a------ c:\windows\system32\AcerScaD.dll
2009-03-15 12:18 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-03-15 12:18 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-03-15 10:28 . 2009-03-15 10:28 <DIR> d-------- c:\program files\LeechGet 2009
2009-03-15 10:26 . 2009-03-15 10:26 <DIR> d-------- c:\program files\VistaCodecPack
2009-03-15 10:26 . 2009-03-15 10:26 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\VistaCodecs
2009-03-15 09:36 . 2009-03-15 09:36 <DIR> d-------- c:\windows\system32\Futuremark
2009-03-15 09:36 . 2009-03-15 09:36 <DIR> d-------- c:\program files\Common Files\Futuremark Shared
2009-03-15 09:36 . 2008-09-17 15:14 27,672 -ra------ c:\windows\system32\drivers\Entech.sys
2009-03-13 23:36 . 2009-03-13 23:36 <DIR> d-------- c:\documents and settings\Božena\Data aplikací\CyberLink
2009-03-13 21:03 . 2008-04-14 07:52 221,184 --a------ c:\windows\system32\wmpns.dll
2009-03-13 20:31 . 2009-03-13 20:31 <DIR> d-------- c:\documents and settings\Božena\Data aplikací\ArcSoft
2009-03-13 20:11 . 2004-12-23 17:27 27,392 --a------ c:\windows\system32\drivers\ULCDRHlp.sys
2009-03-13 19:55 . 2005-04-27 16:36 245,408 --a------ c:\windows\system32\unicows.dll
2009-03-13 19:54 . 2009-03-15 13:47 <DIR> d-------- c:\program files\WinFast
2009-03-13 19:50 . 2004-12-22 05:34 34,789 -ra------ c:\windows\system32\drivers\wf88tune.sys
2009-03-13 19:49 . 2004-12-22 05:34 10,324 -ra------ c:\windows\system32\drivers\WF88XBAR.sys
2009-03-13 19:48 . 2004-12-22 05:34 208,851 -ra------ c:\windows\system32\drivers\wf88vcap.sys
2009-03-13 19:41 . 2009-03-13 19:41 <DIR> d-------- c:\program files\Common Files\NacreWare
2009-03-13 19:41 . 2009-03-13 19:41 <DIR> d-------- c:\program files\AMC2000
2009-03-13 19:15 . 2009-03-13 19:15 <DIR> d-------- C:\OpenCandy
2009-03-13 19:02 . 2009-03-13 19:02 <DIR> d-------- c:\program files\Unlocker
2009-03-13 18:52 . 2009-03-13 18:52 <DIR> d-------- c:\windows\system32\WinFox
2009-03-13 18:52 . 2003-09-05 09:57 9,469 --a------ c:\windows\system32\drivers\WINFOXIO.sys
2009-03-13 18:32 . 2009-03-13 20:07 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ArcSoft
2009-03-13 18:30 . 2009-03-16 18:57 <DIR> d-------- C:\WinFast WorkArea
2009-03-13 18:29 . 2009-03-13 18:52 <DIR> d-------- c:\windows\system32\WinFast
2009-03-13 18:29 . 2009-03-13 18:29 <DIR> d-------- c:\program files\Common Files\Ulead Systems
2009-03-13 18:29 . 2009-03-13 19:55 <DIR> d-------- c:\program files\Common Files\ArcSoft
2009-03-13 18:29 . 2009-03-14 20:45 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ArcSoft
2009-03-13 18:25 . 2009-03-13 18:25 <DIR> d-------- c:\windows\WinFast
2009-03-13 18:23 . 2009-03-13 18:23 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\CyberLink
2009-03-13 12:08 . 2009-03-13 12:19 <DIR> d-------- c:\program files\Zoner
2009-03-13 12:08 . 2009-03-13 12:21 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Zoner
2009-03-13 11:54 . 2009-03-13 11:54 <DIR> d-------- c:\program files\Godlike Developers
2009-03-13 11:51 . 2009-03-13 11:51 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\CyberLink
2009-03-13 11:50 . 2009-03-13 11:50 <DIR> d-------- c:\program files\CyberLink
2009-03-13 09:23 . 2009-03-13 09:23 <DIR> d-------- C:\PPK_CD
2009-03-13 08:55 . 2009-03-13 09:07 <DIR> d-------- c:\program files\AutoPlay Menu Builder
2009-03-13 08:39 . 2009-03-13 08:39 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\XemiComputers
2009-03-13 08:38 . 2009-03-13 08:38 <DIR> d-------- c:\program files\XemiComputers
2009-03-13 08:35 . 2009-03-19 17:18 <DIR> d-------- c:\windows\system32\oodag
2009-03-13 08:35 . 2009-03-20 19:34 53,152 --a------ c:\windows\system32\oodbs.lor
2009-03-13 08:34 . 2009-03-13 08:34 0 --a------ c:\windows\oodcnt.INI
2009-03-13 08:29 . 2009-03-13 08:30 <DIR> d-------- c:\program files\RegCleaner
2009-03-13 08:28 . 2009-03-13 08:28 <DIR> d-------- c:\program files\CCleaner
2009-03-13 08:21 . 2009-03-13 08:21 <DIR> d-------- C:\totalcmd
2009-03-13 08:21 . 2009-03-15 22:38 1,247 --a------ c:\windows\wincmd.ini
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF
2009-03-13 07:53 . 2009-03-13 08:17 <DIR> d-------- c:\program files\OO Software
2009-03-13 07:53 . 2009-03-13 07:53 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\OO Software
2009-03-13 07:52 . 2009-03-13 07:52 <DIR> d-------- c:\program files\MSECache
2009-03-13 07:51 . 2009-03-13 07:51 <DIR> d-------- c:\program files\LeechGet 2007

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-20 19:08 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-20 16:04 196,608 ----a-w c:\windows\system32\drivers\nStandard.bin
2009-03-19 16:10 --------- d-----w c:\documents and settings\All Users\Data aplikací\ESET
2009-03-18 18:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-13 10:50 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-12 19:56 --------- d-----w c:\program files\MozBackup
2009-03-12 19:54 --------- d-----w c:\documents and settings\Pavel\Data aplikací\Thunderbird
2009-03-12 19:40 --------- d-----w c:\program files\Opera
2009-03-12 19:26 --------- d-----w c:\documents and settings\All Users\Data aplikací\WinZip
2009-03-12 19:17 315,392 ----a-w c:\windows\HideWin.exe
2009-03-12 19:17 --------- d-----w c:\program files\Realtek
2009-03-12 19:15 --------- d-----w c:\program files\Intel
2009-03-12 19:12 --------- d-----w c:\program files\My Company Name
2009-03-12 19:12 --------- d-----w c:\program files\ASUS
2009-03-12 19:05 --------- d-----w c:\program files\microsoft frontpage
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 13:24 56,280 ----a-w c:\windows\system32\drivers\epfwtdi.sys
2009-02-06 13:24 33,096 ----a-w c:\windows\system32\drivers\epfwndis.sys
2009-02-06 13:24 130,952 ----a-w c:\windows\system32\drivers\epfw.sys
2009-02-06 13:23 106,208 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-02-06 13:19 113,448 ----a-w c:\windows\system32\drivers\eamon.sys
2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus C40 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2001-01-19 68608]
"Active Desktop Calendar"="c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe" [2009-02-15 4486656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2008-11-03 2540800]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2008-06-20 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Pavel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
PopTray.lnk - c:\program files\PopTray\PopTray.exe [2006-05-06 1666048]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2009-03-15 127488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 oodisr;O&O DiskImage Snapshot/Restore Driver;c:\windows\system32\drivers\oodisr.sys [2009-01-20 95752]
R0 oodisrh;oodisrh;c:\windows\system32\drivers\oodisrh.sys [2009-01-20 28680]
R0 oodivd;O&O DiskImage VirtualDisk Driver;c:\windows\system32\drivers\oodivd.sys [2009-01-20 133640]
R0 oodivdh;oodivdh;c:\windows\system32\drivers\oodivdh.sys [2009-01-20 31240]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-02-06 727720]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [2009-03-13 208851]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [2009-03-13 10324]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [2009-03-13 34789]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2008-04-13 69120]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - EKRN

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

ShellIconOverlayIdentifiers-{14A94384-BBED-47ed-86C0-6BF63FD892D0} - (no file)

.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/" onclick="window.open(this.href);return false;
IE: Analyzovat LeechGetem - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\Parser.html
IE: Download LeechGetem - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\AddUrl.html
IE: Download s průvodcem LeechGetu - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\Wizard.html
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\dxbz3o4s.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz" onclick="window.open(this.href);return false;
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;
Rootkit scan 2009-03-20 20:20:33
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C40 Series = c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "c:\windows\system32\E_S57A.tmp"? ?7~??6~????????Z?6~????*?6~????h?????????????????????????????????????????????????????????????9~0?6~????*?6~??7~????w?8~h???????????????,?i???7~????h??????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2009-03-20 20:21:08
ComboFix-quarantined-files.txt 2009-03-20 19:21:06

Před spuštěním: Volných bajtů: 297 153 355 776
Po spuštění: Volných bajtů: 297,143,967,744

261 --- E O F --- 2009-03-16 14:46:47

Příspěvek od **jaro3** » 20 bře 2009 21:31

Vypni zase rez. ochrany u ESS.
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\REGBK00.ZIP
c:\windows\XXLGSC

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 21:40

Tady je log z ComboFixu:

ComboFix 09-03-19.02 - Pavel 2009-03-20 21:30:07.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1586 [GMT 1:00]
Spuštěný z: c:\documents and settings\Pavel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Pavel\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
c:\windows\REGBK00.ZIP
c:\windows\XXLGSC
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\REGBK00.ZIP
c:\windows\XXLGSC

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-20 do 2009-03-20 )))))))))))))))))))))))))))))))
.

2009-03-20 21:05 . 2009-03-20 21:05 60 --a------ c:\windows\system32\E_S1E6.tmp
2009-03-20 20:52 . 2009-03-20 20:53 <DIR> d-------- c:\windows\LastGood
2009-03-20 20:52 . 2009-03-20 20:52 <DIR> d-------- c:\program files\ESET
2009-03-20 19:47 . 2009-03-20 19:47 <DIR> d-------- c:\program files\Trend Micro
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\windows\Easy CD-DA Extractor 12
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\program files\Easy CD-DA Extractor 12
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-19 23:05 . 2009-03-19 23:05 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Easy CD-DA Extractor
2009-03-19 19:18 . 2009-03-19 20:00 184 --a------ c:\windows\MyDrivers.ini
2009-03-19 19:15 . 2009-03-19 19:15 <DIR> d-------- c:\program files\My Drivers
2009-03-19 17:11 . 2009-03-19 17:11 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ESET
2009-03-19 00:11 . 2009-03-19 00:11 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-19 00:02 . 2009-03-19 00:02 <DIR> d-a------ c:\windows\system32\vcmgcd32.dll
2009-03-19 00:02 . 2009-03-19 00:02 <DIR> d-a------ c:\windows\system32\iifgfgf.dll
2009-03-18 23:58 . 2008-04-14 07:52 147,968 --a------ c:\windows\R.COM
2009-03-18 23:58 . 2008-04-14 07:52 137,216 --a------ c:\windows\system32\T.COM
2009-03-18 23:58 . 2009-03-19 18:10 27 --a------ c:\windows\Lic.xxx
2009-03-18 20:05 . 2009-03-18 20:05 <DIR> d-------- c:\program files\Common Files\Adobe
2009-03-18 19:53 . 2009-03-18 19:53 <DIR> d-------- c:\program files\ScanButton 3.0
2009-03-18 19:53 . 2009-03-18 19:53 <DIR> d-------- c:\program files\MiraScan
2009-03-18 19:53 . 2002-02-26 14:34 172,032 --------- c:\windows\scanusdX.dll
2009-03-18 19:53 . 2000-05-22 17:46 151,552 -r------- c:\windows\UnUSBDrv.exe
2009-03-18 19:53 . 2000-03-03 15:18 147,456 -r------- c:\windows\CHECKING.DLL
2009-03-18 19:53 . 1999-08-24 21:55 66,560 --------- c:\windows\system32\WNASPI32.DLL
2009-03-18 19:53 . 2001-09-27 11:04 53,248 --------- c:\windows\stiaspi.dll
2009-03-18 19:53 . 1998-09-30 19:00 5,741 --------- c:\windows\gulp.vxd
2009-03-18 13:19 . 2009-03-20 08:35 1,905 --a------ c:\windows\diagwrn.xml
2009-03-18 13:19 . 2009-03-20 08:35 1,905 --a------ c:\windows\diagerr.xml
2009-03-18 08:56 . 2009-03-18 08:56 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Alawar
2009-03-18 08:55 . 2009-03-18 08:55 <DIR> d-------- c:\program files\Roboball
2009-03-17 13:53 . 2009-03-17 13:53 <DIR> d-------- c:\program files\Foxit Software
2009-03-17 13:53 . 2009-03-17 13:53 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Foxit
2009-03-17 12:33 . 2009-03-17 12:33 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ICQ Toolbar
2009-03-17 11:00 . 2009-03-17 11:11 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\SolSuite
2009-03-17 11:00 . 2009-03-17 11:00 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\TreeCardGames
2009-03-17 10:59 . 2009-03-17 11:01 <DIR> d-------- c:\program files\SolSuite
2009-03-17 10:52 . 2009-03-17 10:52 <DIR> d--h----- c:\program files\Seznam
2009-03-16 17:18 . 2009-03-16 17:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Ulead Systems
2009-03-16 16:31 . 2009-03-16 16:33 <DIR> d-------- c:\program files\ABBYY FineReader 7.0 Professional Edition
2009-03-16 15:47 . 2009-03-16 15:47 <DIR> d-------- c:\windows\system32\NtmsData
2009-03-16 07:41 . 2009-03-16 07:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LightScribe
2009-03-16 07:40 . 2009-03-16 07:41 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Nero
2009-03-16 07:31 . 2009-03-16 07:31 4,767 --a------ c:\windows\Irremote.ini
2009-03-16 07:30 . 2009-03-16 07:30 <DIR> d-------- c:\program files\Windows Sidebar
2009-03-16 07:22 . 2009-03-16 07:31 <DIR> d-------- c:\program files\Nero
2009-03-16 07:22 . 2009-03-16 07:38 <DIR> d-------- c:\program files\Common Files\Nero
2009-03-16 07:22 . 2009-03-16 07:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Nero
2009-03-16 07:21 . 2009-03-16 07:22 <DIR> d-------- c:\program files\Common Files\LightScribe
2009-03-16 07:02 . 2009-03-16 07:04 <DIR> d-------- c:\program files\ICQ6.5
2009-03-16 06:59 . 2009-03-19 11:55 <DIR> d-------- c:\program files\ICQToolbar
2009-03-16 06:58 . 2009-03-16 07:02 <DIR> d-------- c:\program files\ICQ6
2009-03-16 06:58 . 2009-03-16 15:14 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ICQ
2009-03-15 22:35 . 2009-03-20 20:46 2,686 --a------ c:\windows\TRNCOM.INI
2009-03-15 22:34 . 2009-03-20 20:46 <DIR> d-------- C:\TRANSLAT
2009-03-15 22:34 . 2009-03-20 20:46 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LangSoft
2009-03-15 22:33 . 2009-03-20 20:46 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\LangSoft
2009-03-15 22:22 . 2009-03-15 22:22 <DIR> d-------- C:\CloneDVDTemp
2009-03-15 22:17 . 2009-03-15 22:17 135,772 ---h----- C:\treeinfo.wc
2009-03-15 14:39 . 2009-03-15 14:39 <DIR> d-------- c:\program files\Common Files\EPSON
2009-03-15 14:39 . 2000-06-07 01:01 169,472 --a------ c:\windows\system32\EBAPI2.dll
2009-03-15 14:38 . 2009-03-15 14:38 <DIR> d-------- c:\program files\EPSON
2009-03-15 14:36 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-03-15 14:36 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-03-15 12:18 . 2009-03-18 19:53 <DIR> d-------- c:\windows\usbbin
2009-03-15 12:18 . 2001-10-24 12:24 61,440 --a--c--- c:\windows\system32\dllcache\acerscad.dll
2009-03-15 12:18 . 2001-10-24 12:24 61,440 --a------ c:\windows\system32\AcerScaD.dll
2009-03-15 12:18 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-03-15 12:18 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-03-15 10:28 . 2009-03-15 10:28 <DIR> d-------- c:\program files\LeechGet 2009
2009-03-15 10:26 . 2009-03-15 10:26 <DIR> d-------- c:\program files\VistaCodecPack
2009-03-15 10:26 . 2009-03-15 10:26 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\VistaCodecs
2009-03-15 09:36 . 2009-03-15 09:36 <DIR> d-------- c:\windows\system32\Futuremark
2009-03-15 09:36 . 2009-03-15 09:36 <DIR> d-------- c:\program files\Common Files\Futuremark Shared
2009-03-15 09:36 . 2008-09-17 15:14 27,672 -ra------ c:\windows\system32\drivers\Entech.sys
2009-03-13 23:36 . 2009-03-13 23:36 <DIR> d-------- c:\documents and settings\Božena\Data aplikací\CyberLink
2009-03-13 21:03 . 2008-04-14 07:52 221,184 --a------ c:\windows\system32\wmpns.dll
2009-03-13 20:31 . 2009-03-13 20:31 <DIR> d-------- c:\documents and settings\Božena\Data aplikací\ArcSoft
2009-03-13 20:11 . 2004-12-23 17:27 27,392 --a------ c:\windows\system32\drivers\ULCDRHlp.sys
2009-03-13 19:55 . 2005-04-27 16:36 245,408 --a------ c:\windows\system32\unicows.dll
2009-03-13 19:54 . 2009-03-15 13:47 <DIR> d-------- c:\program files\WinFast
2009-03-13 19:50 . 2004-12-22 05:34 34,789 -ra------ c:\windows\system32\drivers\wf88tune.sys
2009-03-13 19:49 . 2004-12-22 05:34 10,324 -ra------ c:\windows\system32\drivers\WF88XBAR.sys
2009-03-13 19:48 . 2004-12-22 05:34 208,851 -ra------ c:\windows\system32\drivers\wf88vcap.sys
2009-03-13 19:41 . 2009-03-13 19:41 <DIR> d-------- c:\program files\Common Files\NacreWare
2009-03-13 19:41 . 2009-03-13 19:41 <DIR> d-------- c:\program files\AMC2000
2009-03-13 19:15 . 2009-03-13 19:15 <DIR> d-------- C:\OpenCandy
2009-03-13 19:02 . 2009-03-13 19:02 <DIR> d-------- c:\program files\Unlocker
2009-03-13 18:52 . 2009-03-13 18:52 <DIR> d-------- c:\windows\system32\WinFox
2009-03-13 18:52 . 2003-09-05 09:57 9,469 --a------ c:\windows\system32\drivers\WINFOXIO.sys
2009-03-13 18:32 . 2009-03-13 20:07 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\ArcSoft
2009-03-13 18:30 . 2009-03-16 18:57 <DIR> d-------- C:\WinFast WorkArea
2009-03-13 18:29 . 2009-03-13 18:52 <DIR> d-------- c:\windows\system32\WinFast
2009-03-13 18:29 . 2009-03-13 18:29 <DIR> d-------- c:\program files\Common Files\Ulead Systems
2009-03-13 18:29 . 2009-03-13 19:55 <DIR> d-------- c:\program files\Common Files\ArcSoft
2009-03-13 18:29 . 2009-03-14 20:45 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ArcSoft
2009-03-13 18:25 . 2009-03-13 18:25 <DIR> d-------- c:\windows\WinFast
2009-03-13 18:23 . 2009-03-13 18:23 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\CyberLink
2009-03-13 12:08 . 2009-03-13 12:19 <DIR> d-------- c:\program files\Zoner
2009-03-13 12:08 . 2009-03-13 12:21 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\Zoner
2009-03-13 11:54 . 2009-03-13 11:54 <DIR> d-------- c:\program files\Godlike Developers
2009-03-13 11:51 . 2009-03-13 11:51 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\CyberLink
2009-03-13 11:50 . 2009-03-13 11:50 <DIR> d-------- c:\program files\CyberLink
2009-03-13 09:23 . 2009-03-13 09:23 <DIR> d-------- C:\PPK_CD
2009-03-13 08:55 . 2009-03-13 09:07 <DIR> d-------- c:\program files\AutoPlay Menu Builder
2009-03-13 08:39 . 2009-03-13 08:39 <DIR> d-------- c:\documents and settings\Pavel\Data aplikací\XemiComputers
2009-03-13 08:38 . 2009-03-13 08:38 <DIR> d-------- c:\program files\XemiComputers
2009-03-13 08:35 . 2009-03-19 17:18 <DIR> d-------- c:\windows\system32\oodag
2009-03-13 08:35 . 2009-03-20 20:48 54,534 --a------ c:\windows\system32\oodbs.lor
2009-03-13 08:34 . 2009-03-13 08:34 0 --a------ c:\windows\oodcnt.INI
2009-03-13 08:29 . 2009-03-13 08:30 <DIR> d-------- c:\program files\RegCleaner
2009-03-13 08:28 . 2009-03-13 08:28 <DIR> d-------- c:\program files\CCleaner
2009-03-13 08:21 . 2009-03-13 08:21 <DIR> d-------- C:\totalcmd
2009-03-13 08:21 . 2009-03-15 22:38 1,247 --a------ c:\windows\wincmd.ini
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF
2009-03-13 08:21 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF
2009-03-13 07:53 . 2009-03-13 08:17 <DIR> d-------- c:\program files\OO Software
2009-03-13 07:53 . 2009-03-13 07:53 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\OO Software
2009-03-13 07:52 . 2009-03-13 07:52 <DIR> d-------- c:\program files\MSECache
2009-03-13 07:51 . 2009-03-13 07:51 <DIR> d-------- c:\program files\LeechGet 2007
2009-03-13 07:50 . 2009-03-13 07:50 <DIR> d-------- c:\program files\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-20 20:17 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-20 16:04 196,608 ----a-w c:\windows\system32\drivers\nStandard.bin
2009-03-19 16:10 --------- d-----w c:\documents and settings\All Users\Data aplikací\ESET
2009-03-18 18:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-13 10:50 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-12 19:56 --------- d-----w c:\program files\MozBackup
2009-03-12 19:54 --------- d-----w c:\documents and settings\Pavel\Data aplikací\Thunderbird
2009-03-12 19:40 --------- d-----w c:\program files\Opera
2009-03-12 19:26 --------- d-----w c:\documents and settings\All Users\Data aplikací\WinZip
2009-03-12 19:17 315,392 ----a-w c:\windows\HideWin.exe
2009-03-12 19:17 --------- d-----w c:\program files\Realtek
2009-03-12 19:15 --------- d-----w c:\program files\Intel
2009-03-12 19:12 --------- d-----w c:\program files\My Company Name
2009-03-12 19:12 --------- d-----w c:\program files\ASUS
2009-03-12 19:05 --------- d-----w c:\program files\microsoft frontpage
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 13:24 56,280 ----a-w c:\windows\system32\drivers\epfwtdi.sys
2009-02-06 13:24 33,096 ----a-w c:\windows\system32\drivers\epfwndis.sys
2009-02-06 13:24 130,952 ----a-w c:\windows\system32\drivers\epfw.sys
2009-02-06 13:23 106,208 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-02-06 13:19 113,448 ----a-w c:\windows\system32\drivers\eamon.sys
2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-03-20_20.20.46,23 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-20 18:45:31 10,134 ----a-r c:\windows\Installer\{C22F45F8-3BDF-4D0A-99FC-C901E4303E41}\callmsi.exe
+ 2009-03-20 19:53:08 10,134 ----a-r c:\windows\Installer\{C22F45F8-3BDF-4D0A-99FC-C901E4303E41}\callmsi.exe
- 2009-03-20 18:45:31 97,360 ----a-r c:\windows\Installer\{C22F45F8-3BDF-4D0A-99FC-C901E4303E41}\egui.exe
+ 2009-03-20 19:53:08 97,360 ----a-r c:\windows\Installer\{C22F45F8-3BDF-4D0A-99FC-C901E4303E41}\egui.exe
+ 2009-03-20 19:49:03 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_594.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus C40 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2001-01-19 68608]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2009-03-20 26624]
"Active Desktop Calendar"="c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe" [2009-02-15 4486656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2008-11-03 2540800]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2008-06-20 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Pavel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
PopTray.lnk - c:\program files\PopTray\PopTray.exe [2006-05-06 1666048]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2009-03-15 127488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 oodisr;O&O DiskImage Snapshot/Restore Driver;c:\windows\system32\drivers\oodisr.sys [2009-01-20 95752]
R0 oodisrh;oodisrh;c:\windows\system32\drivers\oodisrh.sys [2009-01-20 28680]
R0 oodivd;O&O DiskImage VirtualDisk Driver;c:\windows\system32\drivers\oodivd.sys [2009-01-20 133640]
R0 oodivdh;oodivdh;c:\windows\system32\drivers\oodivdh.sys [2009-01-20 31240]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-02-06 727720]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [2009-03-13 208851]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [2009-03-13 10324]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [2009-03-13 34789]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2008-04-13 69120]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - EKRN

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/" onclick="window.open(this.href);return false;
IE: Analyzovat LeechGetem - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\Parser.html
IE: Download LeechGetem - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\AddUrl.html
IE: Download s průvodcem LeechGetu - file://c" onclick="window.open(this.href);return false;:\program files\LeechGet 2007\\Wizard.html
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\dxbz3o4s.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz" onclick="window.open(this.href);return false;
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.proxy.type - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;
Rootkit scan 2009-03-20 21:30:47
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C40 Series = c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "c:\windows\system32\E_S1E6.tmp"? ?7~??6~????????Z?6~????*?6~????????????????????????????????????????????????????????????????????#?8~????????????????h?????????????????????????7~(???,?;~??????????????i?

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2009-03-20 21:31:23
ComboFix-quarantined-files.txt 2009-03-20 20:31:21
ComboFix2.txt 2009-03-20 19:21:08

Před spuštěním: Volných bajtů: 296 869 990 400
Po spuštění: Volných bajtů: 296,858,836,992

273 --- E O F --- 2009-03-16 14:46:47

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 21:41

A tady z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34:19, on 20.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\oodtray.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\PopTray\PopTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/" onclick="window.open(this.href);return false;
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [EPSON Stylus C40 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "C:\WINDOWS\system32\E_S1E6.tmp"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O8 - Extra context menu item: Analyzovat LeechGetem - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\Parser.html
O8 - Extra context menu item: Download LeechGetem - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\AddUrl.html
O8 - Extra context menu item: Download s průvodcem LeechGetu - file://C" onclick="window.open(this.href);return false;:\Program Files\LeechGet 2007\\Wizard.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 8413 bytes

Příspěvek od **jaro3** » 20 bře 2009 21:50

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O24 - Desktop Component 0: (no name) - (no file)

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Toto otestuj na Virustotal
c:\windows\system32\E_S1E6.tmp
Vlož sem pak odkaz výsledku.

Pavel Salák · Příspěvek od **Pavel Salák** » 20 bře 2009 22:15

Výsledek VirusTotal:

Soubor E_S1E6.tmp přijatý 2009.03.20 22:04:21 (CET)
Současný stav: Dokončeno
Výsledek: 0/39 (0%)
Formátované
Vytisknout výsledky Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.03.20 -
AhnLab-V3 5.0.0.2 2009.03.20 -
AntiVir 7.9.0.120 2009.03.20 -
Authentium 5.1.2.4 2009.03.20 -
Avast 4.8.1335.0 2009.03.20 -
AVG 8.5.0.283 2009.03.20 -
BitDefender 7.2 2009.03.20 -
CAT-QuickHeal 10.00 2009.03.20 -
ClamAV 0.94.1 2009.03.20 -
Comodo 1076 2009.03.20 -
DrWeb 4.44.0.09170 2009.03.20 -
eSafe 7.0.17.0 2009.03.19 -
eTrust-Vet 31.6.6409 2009.03.20 -
F-Prot 4.4.4.56 2009.03.20 -
F-Secure 8.0.14470.0 2009.03.20 -
Fortinet 3.117.0.0 2009.03.20 -
GData 19 2009.03.20 -
Ikarus T3.1.1.48.0 2009.03.20 -
K7AntiVirus 7.10.677 2009.03.20 -
Kaspersky 7.0.0.125 2009.03.20 -
McAfee 5559 2009.03.20 -
McAfee+Artemis 5559 2009.03.20 -
McAfee-GW-Edition 6.7.6 2009.03.20 -
Microsoft 1.4502 2009.03.20 -
NOD32 3952 2009.03.20 -
Norman 6.00.06 2009.03.20 -
nProtect 2009.1.8.0 2009.03.20 -
Panda 10.0.0.10 2009.03.20 -
PCTools 4.4.2.0 2009.03.20 -
Prevx1 V2 2009.03.20 -
Rising 21.21.42.00 2009.03.20 -
Sophos 4.39.0 2009.03.20 -
Sunbelt 3.2.1858.2 2009.03.20 -
Symantec 1.4.4.12 2009.03.20 -
TheHacker 6.3.3.1.286 2009.03.20 -
TrendMicro 8.700.0.1004 2009.03.20 -
VBA32 3.12.10.1 2009.03.20 -
ViRobot 2009.3.20.1658 2009.03.20 -
VirusBuster 4.6.5.0 2009.03.20 -
Rozšiřující informace
File size: 60 bytes
MD5...: 0d43c2884a955237189b7088e6a94fc9
SHA1..: cbe2b6e6b8a575d197e01ec2e0b5efd643e968ff
SHA256: 069c2a2787e253c2f1880c4d493c4f9a752e9aaf09792325a8a490b2c3021100
SHA512: f53ea497d6682ec080a6832518f1c9f63c0b2749d70dc215a0ff995dbfb2bcca
5ee50666fd9e616aa96c296022d18869c9f685ccab77772231e246900c8a8a5c
ssdeep: 3:cg15HQWFm2ygI7Q2cISq7JZkovn:cgvwCByg8jPSQhv
PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -

josefinka · Příspěvek od **josefinka** » 21 bře 2009 02:34

Zkus dát Detailní nastavení, pak v levém menu klepni na Personální Firewall, tam zadej- Automatický režim a dáš OK. Mám to taky tak nastavené a jede v poho. Mám Eset Smart security 4.0.314.0....Jinak z toho si hlavu nedělej pokud ti nepojede, ostatně Eset Nod 32 ho taky nemá a nic se neděje. Hlavně si zapni Windowsácký Firewall, většinou se při instalaci Eset vypíná, tak se raději mrkni jestli je zapnutý, zdravím...

PC-HELP.CZ

CNEWS

Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4

Re: Nastavení Eset 4