Kontrola logu, zamrzá explorer (průzkumník)

[camel13]

Už sem to řešil včera s Rudym, něco se zlepšilo, už je rychlej náběh, ale po chvíli zatuhne explorer (nemyslím IE) a nejde pustit ani TaskManager. Jdu spustit combofix...

tady je dnešní log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Photon at 2010-01-19 13:50:16
Microsoft® Windows Vista™ Business Service Pack 2, v.113
System drive C: has 41 GB (38%) free of 106 GB
Total RAM: 3326 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:50:31, on 19.1.2010
Platform: Windows Vista SP2, v.113 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Photon\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Photon\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Photon\AppData\Local\Google\Chrome\Application\chrome.exe
D:\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Photon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RtHDVCpl] "C:\Windows\RtHDVCpl.exe"
O4 - HKLM\..\Run: [Skytel] "C:\Windows\Skytel.exe"
O4 - HKLM\..\Run: [WheelMouse] "C:\Program Files\A4Tech\Mouse\Amoumain.exe"
O4 - HKLM\..\Run: [CHotkey] "C:\Windows\mHotkey.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [FontExpertType1Loader] "C:\Program Files\FontExpert\Type1Loader.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [Google Update] "C:\Users\Photon\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [QuickGammaLoader] C:\Program Files\QuickGamma\QuickGammaLoader.exe
O4 - HKCU\..\Run: [QuickGammaResume] C:\Program Files\QuickGamma\QuickGammaResume.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/f ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\acaptuser32.dll C:\Windows\system32\guard32.dll
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\Windows\SYSTEM32\astsrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd - C:\Program Files\DU Meter\DUMeterSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IPCLAMP by cebas Computer GmbH (IPClampService) - Unknown owner - C:\PROGRA~1\cebas\ip-clamp\ipclamp.exe
O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe (file missing)
O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit (mi-raysat_3dsmax2010_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe
O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7933 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2330161282-2524942542-2077496310-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2330161282-2524942542-2077496310-1000UA.job
C:\Windows\tasks\User_Feed_Synchronization-{39C786C8-8DA4-4132-8487-F8F9BE873AF3}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{601ED020-FB6C-11D3-87D8-0050DA59922B}]
WsftpBrowserHelper Class - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll [2004-08-18 118830]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-20 6144000]
"Skytel"=C:\Windows\Skytel.exe [2007-11-20 1826816]
"WheelMouse"=C:\Program Files\A4Tech\Mouse\Amoumain.exe [2007-05-15 204800]
"CHotkey"=C:\Windows\mHotkey.exe [2002-07-05 491008]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-02-27 38768]
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-02-27 640376]
"FontExpertType1Loader"=C:\Program Files\FontExpert\Type1Loader.exe [2009-03-03 294152]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-14 98304]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-01-18 1800464]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Photon\AppData\Local\Google\Update\GoogleUpdate.exe [2008-10-09 133104]
"DU Meter"=C:\Program Files\DU Meter\DUMeter.exe [2008-06-10 2645528]
"QuickGammaLoader"=C:\Program Files\QuickGamma\QuickGammaLoader.exe [2009-08-14 98816]
"QuickGammaResume"=C:\Program Files\QuickGamma\QuickGammaResume.exe [2009-08-14 98816]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe -launchedbylogin []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
?????? []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\Windows\System32\acaptuser32.dll C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit -
.js - open -
.txt - open -

======List of files/folders created in the last 3 months======

2010-01-19 11:10:56 ----D---- C:\Program Files\DAEMON Tools Lite
2010-01-19 00:16:28 ----D---- C:\32788R22FWJFW
2010-01-18 20:00:16 ----D---- C:\ProgramData\Comodo
2010-01-18 20:00:16 ----A---- C:\Windows\system32\guard32.dll
2010-01-18 19:32:01 ----A---- C:\ComboFix.txt
2010-01-18 19:31:16 ----SHD---- C:\$RECYCLE.BIN
2010-01-18 19:23:25 ----A---- C:\Windows\SWXCACLS.exe
2010-01-18 18:04:25 ----A---- C:\Windows\PEV.exe
2010-01-18 18:04:25 ----A---- C:\Windows\MBR.exe
2010-01-18 17:13:09 ----A---- C:\Windows\ntbtlog.txt
2010-01-18 16:00:43 ----D---- C:\rsit
2010-01-18 14:43:41 ----HDC---- C:\ProgramData\{5F45A6CC-3DA5-4253-9769-87318172490F}
2010-01-16 12:08:38 ----D---- C:\Windows\Sun
2010-01-04 16:47:21 ----A---- C:\Windows\system32\ASTSRV.EXE
2010-01-04 00:19:56 ----D---- C:\Program Files\WIBU-SYSTEMS
2010-01-04 00:19:56 ----D---- C:\Program Files\WIBUKEY
2010-01-04 00:18:06 ----D---- C:\Program Files\Chaos Group
2010-01-03 23:19:29 ----D---- C:\Program Files\Common Files\Autodesk Shared
2010-01-03 23:17:41 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-01-03 23:17:40 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-01-03 23:17:39 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-01-03 23:17:39 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-01-03 23:17:39 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-01-03 23:17:39 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-01-03 23:17:37 ----A---- C:\Windows\system32\d3dx9_34.dll
2009-12-24 23:04:23 ----D---- C:\Program Files\TopCD
2009-12-20 02:04:30 ----D---- C:\Program Files\AviFixJoiner
2009-12-20 01:59:46 ----D---- C:\Users\Photon\AppData\Roaming\DivX
2009-11-28 23:12:55 ----D---- C:\Program Files\DivX
2009-11-28 23:12:55 ----D---- C:\Program Files\Common Files\DivX Shared
2009-11-22 14:47:07 ----D---- C:\Users\Photon\AppData\Roaming\ColorSchemer
2009-11-22 14:46:58 ----A---- C:\Windows\system32\lcms.dll
2009-11-22 14:46:58 ----A---- C:\Windows\system32\gdiplus.dll
2009-11-22 14:46:56 ----D---- C:\Program Files\ColorSchemer Studio 2
2009-11-14 01:47:32 ----A---- C:\Windows\system32\dpl100.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\divx_xx16.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\divx_xx11.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\divx_xx0c.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\divx_xx0a.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\divx_xx07.dll
2009-11-14 01:47:28 ----A---- C:\Windows\system32\DivX.dll
2009-11-10 19:51:46 ----D---- C:\Netgear
2009-11-10 12:56:04 ----A---- C:\Windows\system32\javaws.exe
2009-11-10 12:56:04 ----A---- C:\Windows\system32\javaw.exe
2009-11-10 12:56:04 ----A---- C:\Windows\system32\java.exe
2009-10-30 17:13:14 ----D---- C:\Program Files\Zeallsoft

======List of files/folders modified in the last 3 months======

2010-01-19 13:43:10 ----D---- C:\Windows\temp
2010-01-19 13:23:17 ----D---- C:\Users\Photon\AppData\Roaming\Skype
2010-01-19 12:56:21 ----D---- C:\Users\Photon\AppData\Roaming\skypePM
2010-01-19 12:56:11 ----D---- C:\Windows\Prefetch
2010-01-19 12:55:26 ----SHD---- C:\Windows\Installer
2010-01-19 12:55:26 ----D---- C:\Config.Msi
2010-01-19 12:55:11 ----D---- C:\Windows\system32\Tasks
2010-01-19 12:55:09 ----RD---- C:\Program Files\Skype
2010-01-19 12:47:59 ----D---- C:\ProgramData
2010-01-19 12:47:59 ----D---- C:\Program Files\Common Files
2010-01-19 12:45:17 ----D---- C:\Program Files\Stardock
2010-01-19 12:44:57 ----RSD---- C:\Windows\assembly
2010-01-19 12:43:51 ----SHD---- C:\System Volume Information
2010-01-19 12:43:51 ----D---- C:\Program Files\Adobe
2010-01-19 12:43:13 ----D---- C:\Program Files\cebas
2010-01-19 12:43:00 ----D---- C:\Program Files\Avira
2010-01-19 12:41:23 ----D---- C:\Users\Photon\AppData\Roaming\Adobe
2010-01-19 12:41:18 ----D---- C:\Program Files\Common Files\Adobe
2010-01-19 12:37:50 ----D---- C:\ProgramData\Adobe
2010-01-19 12:35:56 ----D---- C:\Windows\system32\drivers
2010-01-19 12:23:28 ----D---- C:\Windows\inf
2010-01-19 12:23:28 ----D---- C:\Program Files\Common Files\PX Storage Engine
2010-01-19 12:12:22 ----D---- C:\Windows\System32
2010-01-19 12:10:51 ----RD---- C:\Program Files
2010-01-19 12:10:51 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-19 09:46:58 ----AD---- C:\Windows
2010-01-18 23:43:26 ----D---- C:\Users\Photon\AppData\Roaming\uTorrent
2010-01-18 22:59:11 ----D---- C:\Program Files\UWC
2010-01-18 22:56:55 ----D---- C:\Windows\system32\WDI
2010-01-18 20:02:22 ----D---- C:\Windows\system32\catroot
2010-01-18 20:00:15 ----D---- C:\Program Files\COMODO
2010-01-18 19:32:03 ----D---- C:\Qoobox
2010-01-18 19:30:06 ----A---- C:\Windows\system.ini
2010-01-18 19:27:26 ----D---- C:\Windows\AppPatch
2010-01-18 19:22:36 ----D---- C:\Program Files\DAEMON Tools Toolbar
2010-01-18 19:15:43 ----D---- C:\Users\Photon\AppData\Roaming\Comodo
2010-01-18 19:05:23 ----D---- C:\Windows\ERDNT
2010-01-18 18:50:31 ----D---- C:\Boot
2010-01-18 18:50:30 ----D---- C:\Windows\system32\config
2010-01-18 14:44:36 ----D---- C:\Windows\Microsoft.NET
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-01-13 19:01:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-07 19:35:44 ----D---- C:\Windows\system32\catroot2
2010-01-04 00:18:09 ----D---- C:\Program Files\Common Files\ChaosGroup
2010-01-03 23:48:33 ----D---- C:\Program Files\Google
2010-01-03 23:47:36 ----D---- C:\Windows\Tasks
2010-01-03 23:31:10 ----D---- C:\ProgramData\FLEXnet
2010-01-03 23:18:32 ----D---- C:\ProgramData\Autodesk
2010-01-03 23:18:32 ----D---- C:\Program Files\Autodesk
2010-01-03 23:16:58 ----D---- C:\Windows\Logs
2010-01-03 23:16:46 ----D---- C:\Windows\winsxs
2010-01-02 15:35:18 ----D---- C:\ProgramData\TrackMania
2009-12-29 23:42:43 ----D---- C:\Windows\Minidump
2009-12-24 10:27:43 ----D---- C:\Downloads
2009-12-09 17:32:09 ----A---- C:\Windows\aopr.ini
2009-11-14 01:49:00 ----N---- C:\Windows\system32\vxblock.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxwave.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxsfs.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxmas.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxhpinst.exe
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxdrv.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\pxafs.dll
2009-11-14 01:49:00 ----N---- C:\Windows\system32\px.dll
2009-11-10 12:56:02 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2010-01-18 29520]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2008-10-17 351744]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2010-01-18 74328]
R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2006-11-10 18688]
R3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\Windows\system32\DRIVERS\Amusbprt.sys [2007-05-15 14336]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-18 7680]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2009-01-20 142848]
R3 ULCDRHlp;ULCDRHlp; C:\Windows\System32\Drivers\ULCDRHlp.sys [2004-12-23 27392]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmXlCore;Logitech Translation Layer Driver; C:\Windows\system32\drivers\WmXlCore.sys [2008-01-24 48904]
S1 Amfilter;A4Tech Mouse Filter Driver; C:\Windows\system32\DRIVERS\Amfilter.sys [2007-05-15 9216]
S1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2007-12-17 12400]
S1 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool.sys [2005-09-26 24064]
S1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2010-01-18 128376]
S2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys []
S2 Hardlock;Hardlock; C:\Windows\system32\drivers\hardlock.sys [2006-11-22 693760]
S2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2008-01-21 95744]
S3 AF15BDA;AF9015 BDA Filter; C:\Windows\system32\DRIVERS\AF15BDA.sys [2007-12-06 327296]
S3 aja7o2qk;aja7o2qk; C:\Windows\system32\drivers\aja7o2qk.sys []
S3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\Windows\system32\drivers\AtiHdmi.sys [2009-06-29 100368]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-15 5068800]
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver; \??\C:\Windows\system32\drivers\BVRPMPR5.SYS [2008-06-18 49904]
S3 catchme;catchme; \??\C:\Users\Photon\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-04-22 27672]
S3 epmntdrv;epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [2008-11-25 9728]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [2008-11-25 3072]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2009-01-03 10976]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2009-01-03 22368]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2008-10-17 236544]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-20 2143136]
S3 MA-620;Mobile Action MA-660 USB Infrared Adapter; C:\Windows\system32\DRIVERS\MA-620.sys [2006-04-08 27136]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2007-12-04 33792]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.0); C:\Windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 19968]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM); C:\Windows\system32\DRIVERS\s0017bus.sys [2008-05-27 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0017mdfl.sys [2008-05-27 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0017mdm.sys [2008-05-27 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0017mgmt.sys [2008-05-27 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS); C:\Windows\system32\DRIVERS\s0017nd5.sys [2008-05-27 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0017obex.sys [2008-05-27 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM); C:\Windows\system32\DRIVERS\s0017unic.sys [2008-05-27 117672]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2007-12-04 33792]
S3 teamviewervpn;TeamViewer VPN Adapter; C:\Windows\system32\DRIVERS\teamviewervpn.sys [2008-01-25 25088]
S3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys [2008-01-24 28168]
S3 WmHidLo;Logitech Gaming USB Filter Driver; C:\Windows\system32\drivers\WmHidLo.sys [2008-01-24 29192]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys [2008-01-24 14728]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-02-22 2217416]
S2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-07-15 172032]
S2 astcc;AST Service; C:\Windows\SYSTEM32\astsrv.exe [2008-11-26 57344]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-01-18 723632]
S2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2007-10-16 1094936]
S2 DUMeterSvc;DU Meter Service; C:\Program Files\DU Meter\DUMeterSvc.exe [2008-06-08 1386008]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-03 135664]
S2 IPClampService;IPCLAMP by cebas Computer GmbH; C:\PROGRA~1\cebas\ip-clamp\ipclamp.exe [2007-11-20 45700]
S2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S2 Marvell RAID;Marvell RAID Event Agent; C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2007-09-06 57344]
S2 mi-raysat_3dsMax2008_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit; C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe []
S2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit; C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-03-12 86016]
S2 MRUWebService;MRU Web Service; C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe [2007-06-18 20539]
S2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
S2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2009-05-22 241734]
S2 SNMP;@%SystemRoot%\system32\snmp.exe,-3; C:\Windows\System32\snmp.exe [2008-01-21 47616]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-09-24 34312]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-21 523776]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-29 655624]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2008-10-17 918016]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-21 21504]
S4 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-21 21504]

-----------------EOF-----------------

[camel13]

A výsledek combofixu:

ComboFix 10-01-18.02 - Photon 19.01.2010 14:27:54.5.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1250.420.1029.18.3326.2362 [GMT 1:00]
Spuštěný z: c:\users\Photon\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-19 do 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-19 13:34 . 2010-01-19 13:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-19 13:34 . 2010-01-19 13:34 -------- d-----w- c:\users\Photon\AppData\Local\temp
2010-01-19 13:34 . 2010-01-19 13:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-18 22:48 . 2010-01-18 22:48 -------- d-----w- c:\users\Photon\AppData\Local\COMODO
2010-01-18 19:04 . 2010-01-19 12:37 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-01-18 19:00 . 2010-01-18 19:00 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-01-18 15:00 . 2010-01-18 15:00 -------- d-----w- C:\rsit
2010-01-18 13:44 . 2010-01-13 18:55 3143696 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\Impulse_setup.exe
2010-01-16 11:08 . 2010-01-16 11:08 -------- d-----w- c:\windows\Sun
2010-01-04 15:47 . 2008-11-26 11:12 57344 ----a-w- c:\windows\system32\ASTSRV.EXE
2010-01-03 23:19 . 2010-01-03 23:19 -------- d-----w- c:\program files\WIBUKEY
2010-01-03 23:19 . 2010-01-03 23:19 -------- d-----w- c:\program files\WIBU-SYSTEMS
2010-01-03 23:18 . 2010-01-03 23:18 -------- d-----w- c:\program files\Chaos Group
2010-01-03 22:19 . 2010-01-03 22:20 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-01-03 22:17 . 2008-07-31 09:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2010-01-03 22:17 . 2008-07-31 09:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2010-01-03 22:17 . 2008-07-31 09:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
2010-01-03 22:17 . 2008-07-12 07:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-01-03 22:17 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-01-03 22:17 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-01-03 22:17 . 2007-05-16 15:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
2009-12-24 22:04 . 2010-01-14 13:14 -------- d-----w- c:\program files\TopCD

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-19 13:24 . 2008-09-22 23:48 8 ----a-w- c:\windows\mvraidver.dat
2010-01-19 13:20 . 2008-10-03 07:49 -------- d-----w- c:\program files\COMODO
2010-01-19 12:23 . 2008-09-28 15:58 -------- d-----w- c:\users\Photon\AppData\Roaming\Skype
2010-01-19 11:57 . 2008-09-23 13:35 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-01-19 11:57 . 2008-09-23 13:35 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-01-19 11:56 . 2008-09-28 16:03 -------- d-----w- c:\users\Photon\AppData\Roaming\skypePM
2010-01-19 11:55 . 2009-08-05 22:51 -------- d-----r- c:\program files\Skype
2010-01-19 11:45 . 2009-09-22 20:50 -------- d-----w- c:\program files\Stardock
2010-01-19 11:43 . 2009-09-07 12:05 -------- d-----w- c:\program files\cebas
2010-01-19 11:43 . 2008-09-23 10:49 -------- d-----w- c:\program files\Avira
2010-01-19 11:41 . 2008-09-23 13:44 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-19 11:23 . 2009-08-06 13:29 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-01-19 11:10 . 2008-09-22 23:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-19 10:01 . 2009-08-06 11:44 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-18 22:43 . 2008-09-26 14:54 -------- d-----w- c:\users\Photon\AppData\Roaming\uTorrent
2010-01-18 21:59 . 2009-10-13 11:12 -------- d-----w- c:\program files\UWC
2010-01-18 18:22 . 2009-08-06 12:04 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-01-18 18:15 . 2008-09-29 12:32 -------- d-----w- c:\users\Photon\AppData\Roaming\Comodo
2010-01-18 13:44 . 2010-01-18 13:43 -------- dc-h--w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}
2010-01-14 10:12 . 2009-10-04 12:47 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 18:51 . 2010-01-18 13:43 1119536 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\OFFLINE\86D01CB6\12FD35EB\impulse.dll
2010-01-13 18:51 . 2010-01-18 13:43 30000 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\OFFLINE\86D01CB6\757C30BC\SDSecurity.dll
2010-01-13 18:51 . 2010-01-18 13:43 468272 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\OFFLINE\86D01CB6\757C30BC\ImpulseNow.exe
2010-01-13 18:50 . 2010-01-18 13:43 491312 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\OFFLINE\86D01CB6\597810BF\Microsoft.WindowsAPICodePack.Shell.dll
2010-01-13 18:49 . 2010-01-18 13:43 87344 -c--a-w- c:\programdata\{5F45A6CC-3DA5-4253-9769-87318172490F}\OFFLINE\86D01CB6\597810BF\Microsoft.WindowsAPICodePack.dll
2010-01-13 18:01 . 2008-01-21 06:01 639010 ----a-w- c:\windows\system32\perfh005.dat
2010-01-13 18:01 . 2008-01-21 06:01 135772 ----a-w- c:\windows\system32\perfc005.dat
2010-01-10 13:38 . 2008-09-22 23:26 156072 ----a-w- c:\users\Photon\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-03 23:18 . 2008-11-12 22:28 -------- d-----w- c:\program files\Common Files\ChaosGroup
2010-01-03 23:18 . 2010-01-03 23:18 -------- d-----w- c:\program files\Chaos Group
2010-01-03 22:48 . 2008-09-24 11:52 -------- d-----w- c:\program files\Google
2010-01-03 22:31 . 2008-09-24 13:14 -------- d-----w- c:\programdata\FLEXnet
2010-01-03 22:18 . 2008-09-23 15:20 -------- d-----w- c:\programdata\Autodesk
2010-01-03 22:18 . 2008-09-23 15:19 -------- d-----w- c:\program files\Autodesk
2010-01-02 14:35 . 2008-09-23 10:06 -------- d-----w- c:\programdata\TrackMania
2009-12-27 13:19 . 2009-12-20 00:59 -------- d-----w- c:\users\Photon\AppData\Roaming\DivX
2009-12-20 01:04 . 2009-12-20 01:04 -------- d-----w- c:\program files\AviFixJoiner
2009-12-08 09:17 . 2009-05-28 13:57 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-28 22:14 . 2009-11-28 22:12 -------- d-----w- c:\program files\DivX
2009-11-28 22:13 . 2009-11-28 22:12 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-11-22 13:47 . 2009-11-22 13:47 -------- d-----w- c:\users\Photon\AppData\Roaming\ColorSchemer
2009-11-22 13:46 . 2009-11-22 13:46 -------- d-----w- c:\program files\ColorSchemer Studio 2
2009-11-14 00:49 . 2009-02-24 12:53 129784 ------w- c:\windows\system32\pxafs.dll
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2007-03-09 07:12 . 2007-03-09 07:12 27648 --sha-w- c:\windows\System32\AVSredirect.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-01-18_18.30.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2010-01-19 13:27 65756 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-01-19 13:27 89192 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-22 23:27 . 2010-01-19 13:27 12024 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2330161282-2524942542-2077496310-1000_UserData.bin
+ 2010-01-18 19:00 . 2010-01-18 19:00 74328 c:\windows\System32\DriverStore\FileRepository\inspect.inf_765856f1\inspect.sys
+ 2009-06-17 12:20 . 2009-06-17 12:20 12648 c:\windows\System32\drivers\psi_mf.sys
- 2008-09-22 23:25 . 2010-01-18 17:23 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-22 23:25 . 2010-01-19 13:24 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-09-22 23:25 . 2010-01-18 17:23 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-22 23:25 . 2010-01-19 13:24 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-22 23:25 . 2010-01-19 13:24 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-22 23:25 . 2010-01-18 17:23 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 10:25 . 2009-08-24 12:16 86016 c:\windows\inf\infpub.dat
+ 2006-11-02 10:25 . 2010-01-18 19:02 86016 c:\windows\inf\infpub.dat
+ 2008-09-23 08:39 . 2010-01-18 22:59 8560 c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2010-01-18 18:15 . 2010-01-18 18:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-01-19 13:24 . 2010-01-19 13:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-01-18 18:15 . 2010-01-18 18:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-01-19 13:24 . 2010-01-19 13:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-01-19 11:55 . 2010-01-19 11:55 794112 c:\windows\Installer\72283.msi
+ 2010-01-19 11:55 . 2010-01-19 11:55 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
- 2009-09-10 12:58 . 2009-09-10 12:58 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
- 2006-11-02 10:25 . 2009-08-24 12:16 143360 c:\windows\inf\infstrng.dat
+ 2006-11-02 10:25 . 2010-01-18 19:02 143360 c:\windows\inf\infstrng.dat
- 2006-11-02 10:25 . 2009-08-24 12:16 143360 c:\windows\inf\infstor.dat
+ 2006-11-02 10:25 . 2010-01-18 19:02 143360 c:\windows\inf\infstor.dat
+ 2008-09-23 13:56 . 2010-01-19 13:20 3231040 c:\windows\System32\FNTCACHE.DAT
- 2008-09-23 13:56 . 2010-01-18 16:24 3231040 c:\windows\System32\FNTCACHE.DAT
+ 2010-01-19 11:55 . 2010-01-19 11:55 1565696 c:\windows\Installer\72279.msi
+ 2010-01-18 14:28 . 2010-01-18 14:28 3628032 c:\windows\assembly\temp\V3DMV4DMV4\Fences.ni.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Photon\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-10-09 133104]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2008-06-10 2645528]
"QuickGammaLoader"="c:\program files\QuickGamma\QuickGammaLoader.exe" [2009-08-14 98816]
"QuickGammaResume"="c:\program files\QuickGamma\QuickGammaResume.exe" [2009-08-14 98816]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\windows\RtHDVCpl.exe" [2008-05-20 6144000]
"Skytel"="c:\windows\Skytel.exe" [2007-11-20 1826816]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
"CHotkey"="c:\windows\mHotkey.exe" [2002-07-05 491008]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"FontExpertType1Loader"="c:\program files\FontExpert\Type1Loader.exe" [2009-03-03 294152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-14 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

R0 mv61xx;mv61xx;c:\windows\System32\drivers\mv61xx.sys [23.9.2008 0:46 143360]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [15.7.2009 3:14 172032]
R2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [5.7.2009 13:16 1386008]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [18.6.2007 21:33 20539]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [6.8.2009 12:44 721904]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.1.2010 23:47 135664]
S2 IPClampService;IPCLAMP by cebas Computer GmbH;c:\progra~1\cebas\ip-clamp\ipclamp.exe [7.9.2009 13:05 45700]
S2 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [6.9.2007 0:15 57344]
S2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [12.3.2009 17:36 86016]
S3 epmntdrv;epmntdrv;c:\windows\System32\epmntdrv.sys [4.2.2009 1:33 9728]
S3 EuGdiDrv;EuGdiDrv;c:\windows\System32\EuGdiDrv.sys [4.2.2009 1:33 3072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [3.1.2009 1:41 10976]
S3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [17.6.2009 13:20 12648]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\System32\drivers\RtTeam60.sys [23.9.2008 0:44 33792]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.0);c:\windows\System32\drivers\RtVlan60.sys [23.9.2008 0:45 19968]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [3.1.2009 1:15 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [3.1.2009 1:15 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [3.1.2009 1:15 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0016mgmt.sys [3.1.2009 1:15 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\System32\drivers\s0016nd5.sys [3.1.2009 1:15 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\System32\drivers\s0016obex.sys [3.1.2009 1:15 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\System32\drivers\s0016unic.sys [3.1.2009 1:15 115752]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\System32\drivers\s0017bus.sys [3.1.2009 1:15 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\System32\drivers\s0017mdfl.sys [3.1.2009 1:15 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\System32\drivers\s0017mdm.sys [3.1.2009 1:15 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0017mgmt.sys [3.1.2009 1:15 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\System32\drivers\s0017nd5.sys [3.1.2009 1:15 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\System32\drivers\s0017obex.sys [3.1.2009 1:15 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\System32\drivers\s0017unic.sys [3.1.2009 1:15 117672]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\System32\drivers\RtTeam60.sys [23.9.2008 0:44 33792]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\System32\drivers\teamviewervpn.sys [25.1.2008 10:12 25088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
ipripsvc REG_MULTI_SZ iprip
.
Obsah adresáře 'Naplánované úlohy'

2010-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 22:47]

2010-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 22:47]

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2330161282-2524942542-2077496310-1000Core.job
- c:\users\Photon\AppData\Local\Google\Update\GoogleUpdate.exe [2008-10-09 14:00]

2010-01-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2330161282-2524942542-2077496310-1000UA.job
- c:\users\Photon\AppData\Local\Google\Update\GoogleUpdate.exe [2008-10-09 14:00]

2010-01-19 c:\windows\Tasks\User_Feed_Synchronization-{39C786C8-8DA4-4132-8487-F8F9BE873AF3}.job
- c:\windows\system32\msfeedssync.exe [2009-03-29 11:31]
.
.
------- Doplňkový sken -------
.
uStart Page =
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: gemoney.cz\www
Trusted Zone: internetbanka.cz\ibs
Trusted Zone: internetbanka.cz\ra
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\DUMeterSvc]
"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2330161282-2524942542-2077496310-1000\Software\SecuROM\License information*]
"datasecu"=hex:4b,9f,5d,8f,fb,9b,5f,41,98,ba,b5,67,f7,f8,09,66,9b,3c,55,93,05,
e2,ff,02,b4,f1,8f,01,61,25,28,0c,0b,9e,64,aa,f8,60,d1,96,c1,73,4b,00,54,61,\
"rkeysecu"=hex:b6,95,46,f9,7c,52,23,65,6f,15,47,f1,22,33,84,b7

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-01-19 14:35:24
ComboFix-quarantined-files.txt 2010-01-19 13:35
ComboFix2.txt 2010-01-18 18:32
ComboFix3.txt 2010-01-18 18:06
ComboFix4.txt 2009-02-03 21:37
ComboFix5.txt 2010-01-19 13:26

Před spuštěním: Volných bajtů: 42 650 873 856
Po spuštění: Volných bajtů: 42 299 518 976

- - End Of File - - 3CABD4978F31F27DC9E689C7BB529796

[motji]

Dobrý večer

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.