Kontrola logu ComboFix

[Syntex]

Ahoj,
mam tu PC a při startu se automaticky nespustí explorer, takže se musí zadávat ručně. Už si s tim nevim moc rady, tak zkusim poslat log z Combofixu.
Díky moc..

ComboFix 10-01-04.01 - *** 05.01.2010 18:20:21.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.3582.2787 [GMT 1:00]
Spuštěný z: c:\users\***\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
C:\install.exe
c:\users\***\AppData\Roaming\Microsoft\dll.exe
c:\users\***\AppData\Roaming\Microsoft\svchost.exe
c:\users\***\ocai.exe
c:\users\***\qky.exe
c:\users\***\secupdat.dat
c:\users\***\tahj.exe
c:\windows\system\update.exe
c:\windows\system32\atrb.exe
c:\windows\system32\secupdat.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-05 do 2010-01-05 )))))))))))))))))))))))))))))))
.

2010-01-05 17:06 . 2010-01-05 17:06 -------- d-----w- c:\program files\Trend Micro
2010-01-03 08:25 . 2010-01-03 14:09 -------- d-----w- C:\Filmy
2009-12-15 00:21 . 2009-12-15 00:21 5144576 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2009-12-14 23:47 . 2009-12-14 23:47 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-14 23:47 . 2009-12-14 23:47 368640 ----a-w- c:\windows\system32\atieclxx.exe
2009-12-14 23:46 . 2009-12-14 23:46 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2009-12-14 23:45 . 2009-12-14 23:45 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-14 23:44 . 2009-12-14 23:44 11776 ----a-w- c:\windows\system32\atimuixx.dll
2009-12-14 23:44 . 2009-12-14 23:44 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-14 23:41 . 2009-12-14 23:41 3056640 ----a-w- c:\windows\system32\atidxx32.dll
2009-12-14 23:13 . 2009-12-14 23:13 13487616 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\atimpc32.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2009-12-14 22:54 . 2009-12-14 22:54 225280 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-14 22:50 . 2009-12-14 22:50 53248 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-14 22:49 . 2009-12-14 22:49 53248 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-14 22:48 . 2009-12-14 22:48 3629056 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-14 22:39 . 2009-12-14 22:39 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 17:23 . 2007-01-08 21:10 610548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-05 17:23 . 2007-01-08 21:10 120950 ----a-w- c:\windows\system32\perfc005.dat
2010-01-05 15:48 . 2009-11-21 11:20 -------- d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2010-01-05 15:12 . 2009-07-13 10:40 -------- d-----w- c:\program files\Steam
2010-01-02 09:43 . 2009-11-13 14:40 -------- d-----w- c:\programdata\BioWare
2010-01-02 09:33 . 2009-07-07 14:19 -------- d-----w- c:\programdata\Media Center Programs
2010-01-02 09:33 . 2009-11-13 14:13 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-02 09:15 . 2009-07-02 14:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 23:45 . 2009-05-16 03:22 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2009-12-14 23:45 . 2009-05-16 03:22 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-14 23:25 . 2009-05-16 03:08 3618304 ----a-w- c:\windows\system32\atiumdag.dll
2009-12-14 23:07 . 2009-11-25 02:37 2902016 ----a-w- c:\windows\system32\atiumdva.dll
2009-12-01 20:30 . 2009-07-13 10:40 -------- d-----w- c:\program files\Common Files\Steam
2009-12-01 15:53 . 2009-07-01 18:56 -------- d-----w- c:\program files\SpeedFan
2009-11-21 14:21 . 2009-11-21 14:10 31112 ----a-w- c:\windows\DIIUnin.dat
2009-11-21 14:10 . 2009-11-21 14:10 94208 ----a-w- c:\windows\DIIUnin.exe
2009-11-21 14:10 . 2009-11-21 14:10 2829 ----a-w- c:\windows\DIIUnin.pif
2009-11-21 08:24 . 2009-11-21 08:23 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-11-21 07:35 . 2009-11-21 07:35 -------- d-----w- c:\program files\GamePark
2009-11-17 11:15 . 2009-09-17 09:52 -------- d-----w- c:\users\***\AppData\Roaming\Ubisoft
2009-11-15 18:55 . 2009-11-15 18:55 -------- d-----w- c:\users\***\AppData\Roaming\PeerNetworking
2009-11-15 17:28 . 2009-07-01 19:28 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-14 20:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-11-13 20:20 . 2009-11-13 20:20 -------- d-----w- c:\program files\Software602
2009-11-08 08:29 . 2009-07-05 07:09 -------- d-----w- c:\program files\Miranda IM
2009-11-07 09:02 . 2009-11-07 09:02 -------- d-----w- c:\users\***\AppData\Roaming\runic games
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-05 20:34 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-02 17:05 . 2009-11-02 17:05 167064 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-02 17:05 . 2009-11-02 17:05 71832 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-10-29 09:17 . 2008-11-07 13:26 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-22 15:59 . 2009-10-22 15:59 196565 ----a-w- c:\windows\system32\atiicdxx.dat
2009-10-17 12:39 . 2009-10-17 12:39 28160 ---h--w- c:\users\***\pgqkkue.exe
2009-10-16 10:19 . 2008-11-08 14:21 872448 ----a-w- c:\windows\system32\rapture3d_oal.dll
2009-10-15 11:44 . 2008-11-08 14:20 809560 ----a-r- c:\windows\system32\tmp3229.tmp
2009-10-15 11:44 . 2008-11-08 14:18 809560 ----a-r- c:\windows\system32\tmp31EA.tmp
2009-10-08 21:08 . 2009-11-05 14:23 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08 . 2009-11-05 14:23 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07 . 2009-11-05 14:23 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-07 18:09 . 2009-10-07 18:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-07-31 18:00 . 2009-07-31 18:00 21133528 ----a-w- c:\program files\DivXInstaller.exe
2009-07-17 19:33 . 2009-07-17 19:33 1914000 ----a-w- c:\program files\install_flash_player_10_active_x.exe
2009-02-14 11:35 . 2009-11-08 12:39 25244 ----a-w- c:\program files\608 - Red Hot Catholic Love.srt
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-04-02 15:00 . 2008-04-02 14:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Steam"="c:\program files\steam\steam.exe" [2009-10-24 1217808]
"RGSC"="c:\games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2009-07-27 306088]
"AtiTrayTools"="c:\program files\Ray Adams\ATI Tray Tools\atitray.exe" [2009-07-28 663040]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-04-02 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-02 1008184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe" [2009-02-25 24576]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RefreshLock"="c:\users\***\Desktop\RefreshLock.exe" [2003-10-15 193536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-05-04 36864]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-14 98304]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wUBfWXZn"= {F41322BC-5EB9-8816-541F-F638C39F9430} - c:\windows\system32\kea.dll [2009-04-11 32768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(b):73,64,39,29,22,ff,c9,01

R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [8.9.2008 18:32 18336]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [15.12.2009 0:46 172032]
R2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\System32\drivers\nxsIO32.sys [2.7.2009 16:57 2208]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [2.7.2009 15:22 721904]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\games\Dragon Age\bin_ship\daupdatersvc.service.exe [2.1.2010 10:27 25832]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2.4.2008 15:56 21504]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\pq2flc6j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-QIP2005 - c:\program files\QIP\qip.exe
HKCU-Run-Windows Updates - c:\windows\system\Update.exe
HKCU-Run-PlayNC Launcher - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-Windows Updates - c:\windows\system\Update.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-Team Fortress 2_is1 - c:\games\Team Fortress 22\unins000.exe
AddRemove-polo-AT_MAIN - c:\games\Polo Cup (AT)\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-05 18:26
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\***\AppData\Local\Temp\GYN1F43.tmp"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:02,73,d9,11,d4,7d,67,4c,8d,c0,a2,07,2e,ed,44,ec,f3,19,50,b6,9a,84,99,
00,f2,bd,46,50,37,df,52,c6,c5,59,d3,59,73,88,ed,b4,d4,fa,f1,d7,88,76,10,a9,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,8f,97,d9,00,b9,34,60,08,fa,c8,b4,dd,60,8d,1a,fb,e2,af,2a,08,
af,b3,6e,e0,24,f3,b2,fe,6f,1e,3d,0b,85,01,e8,ce,b4,18,59,ee,5f,e7,67,e5,74,\
"rkeysecu"=hex:96,df,75,d1,14,35,48,1d,20,81,53,6c,2a,c4,a8,53

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\
.
Celkový čas: 2010-01-05 18:29:08
ComboFix-quarantined-files.txt 2010-01-05 17:29

Před spuštěním: 3 934 842 880
Po spuštění: 8 967 114 752

- - End Of File - - CBB777C8F2D0C5B972F5F16D24060BE2

[jan.svoboda]

Ahoj... no slušnej bordel. Kde jsi k tomu přišel? Ještě vlož log z HijackThis.

Stáhni jej třeba odtud http://go.trendmicro.com/free-tools/hij ... ckThis.exe a spusť, klikni na Do a system scan and save a log, po chvíli se zobrazí log v Poznámkovém dokumentu, jeho obsah sem vlož.

//EDIT: PS: Tu přezdívku na PC nemusíš mazat, protože by ses ještě hodně moc namazal ze všech logů atd. A mě je to fakticky jedno

[Syntex]

Já jsem k tomu nepřišel Jméno můžu nechat, takových lidé s takovým jménem je

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:50:25, on 5.1.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\explorer.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\WerFault.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Michal\Desktop\Rapget.RS_Public_v1.0.4.0_cz\RapgetRS.exe
C:\Program Files\Mozilla Firefox 3.6 Beta 1\firefox.exe
C:\Games\Miranda\miranda32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTunerWrapper.exe" /S
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RefreshLock] C:\Users\Michal\Desktop\RefreshLock.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HPUsageTracking] c:\Program Files\HP\HP UT\bin\hppusg.exe "c:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [RGSC] C:\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: wUBfWXZn - {F41322BC-5EB9-8816-541F-F638C39F9430} - C:\Windows\system32\kea.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Windows\system32\IoctlSvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 5331 bytes

[jan.svoboda]

Omlouvám se za prodlevu v odpovědi, úplně jsem tě přehlídnul

Tak jo. HijackThis log je taky dost poznamenanej havětí.

Znáš GarenaPEngine?
Otevři Poznámkový blok a vlož do něj tento skript (kromě Kód):

Kód: Vybrat vše

KillAll::

File::
c:\windows\system32\ezsidmv.dat
c:\windows\system32\kea.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wUBfWXZn"=-

Ulož na plochu jako CFScript.txt. Pak jej myší přetáhni nad ikonu ComboFix a pusť. CF se spustí a vykoná příkazy ze skriptu.

[Syntex]

Tady to je.

ComboFix 10-01-04.01 - Michal 07.01.2010 20:56:52.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.3582.2735 [GMT 1:00]
Spuštěný z: c:\users\Michal\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Michal\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\kea.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat
c:\windows\system32\kea.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-07 do 2010-01-07 )))))))))))))))))))))))))))))))
.

2010-01-07 20:03 . 2010-01-07 20:04 -------- d-----w- c:\users\Michal\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\all users.windows\AppData\Local\temp
2010-01-07 18:29 . 2010-01-07 18:29 -------- d-----w- c:\programdata\McAfee Security Scan
2010-01-07 18:29 . 2010-01-07 18:29 -------- d-----w- c:\program files\McAfee Security Scan
2010-01-05 17:06 . 2010-01-05 17:06 -------- d-----w- c:\program files\Trend Micro
2010-01-03 08:25 . 2010-01-06 18:31 -------- d-----w- C:\Filmy
2009-12-15 00:21 . 2009-12-15 00:21 5144576 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2009-12-14 23:47 . 2009-12-14 23:47 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-14 23:47 . 2009-12-14 23:47 368640 ----a-w- c:\windows\system32\atieclxx.exe
2009-12-14 23:46 . 2009-12-14 23:46 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2009-12-14 23:45 . 2009-12-14 23:45 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-14 23:44 . 2009-12-14 23:44 11776 ----a-w- c:\windows\system32\atimuixx.dll
2009-12-14 23:44 . 2009-12-14 23:44 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-14 23:41 . 2009-12-14 23:41 3056640 ----a-w- c:\windows\system32\atidxx32.dll
2009-12-14 23:13 . 2009-12-14 23:13 13487616 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\atimpc32.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2009-12-14 22:54 . 2009-12-14 22:54 225280 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-14 22:50 . 2009-12-14 22:50 53248 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-14 22:49 . 2009-12-14 22:49 53248 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-14 22:48 . 2009-12-14 22:48 3629056 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-14 22:39 . 2009-12-14 22:39 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 20:05 . 2009-07-13 10:40 -------- d-----w- c:\program files\Steam
2010-01-07 19:59 . 2007-01-08 21:10 610548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-07 19:59 . 2007-01-08 21:10 120950 ----a-w- c:\windows\system32\perfc005.dat
2010-01-07 19:31 . 2009-11-21 11:20 -------- d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2010-01-02 09:43 . 2009-11-13 14:40 -------- d-----w- c:\programdata\BioWare
2010-01-02 09:33 . 2009-07-07 14:19 -------- d-----w- c:\programdata\Media Center Programs
2010-01-02 09:33 . 2009-11-13 14:13 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-02 09:15 . 2009-07-02 14:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 23:45 . 2009-05-16 03:22 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2009-12-14 23:45 . 2009-05-16 03:22 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-14 23:25 . 2009-05-16 03:08 3618304 ----a-w- c:\windows\system32\atiumdag.dll
2009-12-14 23:07 . 2009-11-25 02:37 2902016 ----a-w- c:\windows\system32\atiumdva.dll
2009-12-01 20:30 . 2009-07-13 10:40 -------- d-----w- c:\program files\Common Files\Steam
2009-12-01 15:53 . 2009-07-01 18:56 -------- d-----w- c:\program files\SpeedFan
2009-11-21 14:21 . 2009-11-21 14:10 31112 ----a-w- c:\windows\DIIUnin.dat
2009-11-21 14:10 . 2009-11-21 14:10 94208 ----a-w- c:\windows\DIIUnin.exe
2009-11-21 14:10 . 2009-11-21 14:10 2829 ----a-w- c:\windows\DIIUnin.pif
2009-11-21 08:24 . 2009-11-21 08:23 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-11-21 07:35 . 2009-11-21 07:35 -------- d-----w- c:\program files\GamePark
2009-11-17 11:15 . 2009-09-17 09:52 -------- d-----w- c:\users\Michal\AppData\Roaming\Ubisoft
2009-11-15 18:55 . 2009-11-15 18:55 -------- d-----w- c:\users\Michal\AppData\Roaming\PeerNetworking
2009-11-15 17:28 . 2009-07-01 19:28 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-14 20:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-11-13 20:20 . 2009-11-13 20:20 -------- d-----w- c:\program files\Software602
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-05 20:34 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-02 17:05 . 2009-11-02 17:05 167064 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-02 17:05 . 2009-11-02 17:05 71832 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-10-29 09:17 . 2008-11-07 13:26 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-22 15:59 . 2009-10-22 15:59 196565 ----a-w- c:\windows\system32\atiicdxx.dat
2009-10-17 12:39 . 2009-10-17 12:39 28160 ---h--w- c:\users\Michal\pgqkkue.exe
2009-10-16 10:19 . 2008-11-08 14:21 872448 ----a-w- c:\windows\system32\rapture3d_oal.dll
2009-10-15 11:44 . 2008-11-08 14:20 809560 ----a-r- c:\windows\system32\tmp3229.tmp
2009-10-15 11:44 . 2008-11-08 14:18 809560 ----a-r- c:\windows\system32\tmp31EA.tmp
2009-07-31 18:00 . 2009-07-31 18:00 21133528 ----a-w- c:\program files\DivXInstaller.exe
2009-07-17 19:33 . 2009-07-17 19:33 1914000 ----a-w- c:\program files\install_flash_player_10_active_x.exe
2009-02-14 11:35 . 2009-11-08 12:39 25244 ----a-w- c:\program files\608 - Red Hot Catholic Love.srt
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-04-02 15:00 . 2008-04-02 14:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Steam"="c:\program files\steam\steam.exe" [2009-10-24 1217808]
"RGSC"="c:\games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2009-07-27 306088]
"AtiTrayTools"="c:\program files\Ray Adams\ATI Tray Tools\atitray.exe" [2009-07-28 663040]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-04-02 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-02 1008184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe" [2009-02-25 24576]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RefreshLock"="c:\users\Michal\Desktop\RefreshLock.exe" [2003-10-15 193536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-05-04 36864]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-14 98304]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(b):73,64,39,29,22,ff,c9,01

R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [8.9.2008 18:32 18336]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [15.12.2009 0:46 172032]
R2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\System32\drivers\nxsIO32.sys [2.7.2009 16:57 2208]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\games\Dragon Age\bin_ship\daupdatersvc.service.exe [2.1.2010 10:27 25832]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2.4.2008 15:56 21504]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\pq2flc6j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)



**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\Michal\AppData\Local\Temp\GYN1F43.tmp"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:02,73,d9,11,d4,7d,67,4c,8d,c0,a2,07,2e,ed,44,ec,f3,19,50,b6,9a,84,99,
00,f2,bd,46,50,37,df,52,c6,c5,59,d3,59,73,88,ed,b4,d4,fa,f1,d7,88,76,10,a9,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,8f,97,d9,00,b9,34,60,08,fa,c8,b4,dd,60,8d,1a,fb,e2,af,2a,08,
af,b3,6e,e0,24,f3,b2,fe,6f,1e,3d,0b,85,01,e8,ce,b4,18,59,ee,5f,e7,67,e5,74,\
"rkeysecu"=hex:96,df,75,d1,14,35,48,1d,20,81,53,6c,2a,c4,a8,53

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3484)
c:\program files\Ray Adams\ATI Tray Tools\raphook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\lxbkcoms.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\conime.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\WerFault.exe
c:\games\GTA IV\Rockstar Games Social Club\1_1_3_0\RGSC.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Mozilla Firefox 3.6 Beta 1\firefox.exe
.
**************************************************************************
.
Celkový čas: 2010-01-07 21:12:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-07 20:12
ComboFix2.txt 2010-01-05 17:29

Před spuštěním: 2 115 674 112
Po spuštění: 1 976 487 936

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,5
- - End Of File - - 8922A8A04EFB35F85474558414F2E4E9


Zítra se snad k tomu dostanu.

[jan.svoboda]

Tenhle log vypadá dobře. Tak ještě vlož aktuální log z HijackThis. Jinak jak se chová PC, nejsou problémy?

[Syntex]

Původní problém odpadl, ten jsem vyřešil sám. Jinak snad je to OK.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:54:12, on 8.1.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Users\Michal\Desktop\RefreshLock.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox 3.6 Beta 1\firefox.exe
C:\Games\Miranda\miranda32.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTunerWrapper.exe" /S
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RefreshLock] C:\Users\Michal\Desktop\RefreshLock.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HPUsageTracking] c:\Program Files\HP\HP UT\bin\hppusg.exe "c:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [RGSC] C:\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Windows\system32\IoctlSvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 5577 bytes

[jan.svoboda]

Ještě fixni v HijackThis (označ vlevo vedle řádku a klikni na Fix it):

R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)

Jsou to jen neškodné zbytky. Pokud tedy s PC není problém, je to vše.

[Syntex]

Jo, díky moc. Ten PC se alespon pročistil.

[jan.svoboda]

Nemáš za co