Pomalé PC

[sapito]

PC jde pomalu a načítání stránek na netu také.
Prosím o kontrolu. Díky Sapito

Logfile of random's system information tool 1.09 (written by random/random)
Run by Owner at 2011-07-09 21:50:14
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 79 GB (69%) free of 114 GB
Total RAM: 4085 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:50:22, on 9.7.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WDDMService - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD File Management Engine (WDFME) - Unknown owner - C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
O23 - Service: WD File Management Shadow Engine (WDSC) - Unknown owner - C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6517 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll" /prefetch:1
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe"
"C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe"
"C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe"
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
C:\Windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe"
"C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe" /c /a /s UserSession
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=4008.51fe40.350084654 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" "Mozilla.Firefox.5.0" -omnijar C:\Program Files (x86)\Mozilla Firefox\omni.jar 4008 \\.\pipe\gecko-crash-server-pipe.4008 plugin
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\helppane.exe -Embedding
"C:\Users\Owner\Desktop\xxe-perso-4_9_1-setup.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\qfsgofwj.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll [2011-04-29 436152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL [2011-03-31 210872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-25 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll [2011-04-29 436152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 385560]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 363544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29 497648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe /c []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-02 11545192]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [2011-04-22 247728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~2\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2003-10-17 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk]
C:\PROGRA~2\PDFCRE~1\PDFCRE~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk]
C:\PROGRA~1\WESTER~1\WDSMAR~1\WDDRIV~1\WDDMST~1.EXE [2011-03-09 4236288]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 261120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-07-09 21:47:29 ----D---- C:\rsit
2011-07-09 21:47:29 ----D---- C:\Program Files\trend micro
2011-07-08 00:42:43 ----D---- C:\Program Files (x86)\FileHippo.com
2011-06-30 19:54:27 ----D---- C:\Users\Owner\AppData\Roaming\WMHelp
2011-06-30 19:54:01 ----D---- C:\Windows\Downloaded Installations
2011-06-30 19:53:37 ----D---- C:\Program Files (x86)\EzTools
2011-06-30 19:40:19 ----D---- C:\Users\Owner\AppData\Roaming\XMLmind
2011-06-30 19:35:33 ----D---- C:\Program Files (x86)\XMLmind_XML_Editor
2011-06-30 19:04:26 ----D---- C:\Program Files (x86)\RustemSoft
2011-06-29 07:10:29 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-06-29 07:10:29 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-06-29 07:10:29 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-06-29 07:10:29 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-06-29 07:10:29 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-06-29 07:10:26 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-06-29 07:10:26 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-06-29 07:10:26 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-06-29 07:10:26 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-06-29 07:10:26 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-06-29 07:10:26 ----A---- C:\Windows\system32\tquery.dll
2011-06-29 07:10:26 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-06-29 07:10:26 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-06-29 07:10:26 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-06-29 07:10:26 ----A---- C:\Windows\system32\mssvp.dll
2011-06-29 07:10:26 ----A---- C:\Windows\system32\mssrch.dll
2011-06-29 07:10:26 ----A---- C:\Windows\system32\mssph.dll
2011-06-29 07:10:25 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-06-29 07:10:25 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-06-29 07:10:25 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-06-29 07:10:25 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-06-29 07:10:25 ----A---- C:\Windows\system32\mssphtb.dll
2011-06-29 07:10:25 ----A---- C:\Windows\system32\msscntrs.dll
2011-06-26 02:48:45 ----D---- C:\winnt
2011-06-26 02:33:22 ----D---- C:\AppServ
2011-06-26 02:11:31 ----A---- C:\Windows\SYSWOW64\libenchant_myspell.dll
2011-06-26 02:10:17 ----A---- C:\Windows\SYSWOW64\php5.dll
2011-06-26 01:39:41 ----D---- C:\ProgramData\MySQL
2011-06-25 22:27:07 ----D---- C:\Users\Owner\AppData\Roaming\PSpad
2011-06-25 22:27:01 ----D---- C:\Program Files (x86)\PSPad editor
2011-06-25 19:21:18 ----D---- C:\Users\Owner\AppData\Roaming\Opera
2011-06-25 19:21:08 ----D---- C:\Program Files (x86)\Opera
2011-06-25 01:53:08 ----A---- C:\Windows\SYSWOW64\javaws.exe
2011-06-25 01:53:08 ----A---- C:\Windows\SYSWOW64\javaw.exe
2011-06-25 01:53:08 ----A---- C:\Windows\SYSWOW64\java.exe
2011-06-25 01:52:50 ----D---- C:\Program Files (x86)\Java
2011-06-18 01:14:43 ----A---- C:\Windows\SYSWOW64\TubeFinder.exe
2011-06-18 01:14:42 ----D---- C:\Users\Owner\AppData\Roaming\FreeFLVConverter
2011-06-18 01:14:42 ----A---- C:\Windows\SYSWOW64\VB6STKIT.DLL
2011-06-18 01:14:42 ----A---- C:\Windows\SYSWOW64\VB6FR.DLL
2011-06-18 01:14:42 ----A---- C:\Windows\SYSWOW64\PCCLPFR.DLL
2011-06-18 01:14:42 ----A---- C:\Windows\SYSWOW64\MSCMCFR.DLL
2011-06-18 01:14:42 ----A---- C:\Windows\SYSWOW64\CMDLGFR.DLL
2011-06-18 01:11:16 ----D---- C:\Program Files (x86)\VDownloader
2011-06-18 00:55:47 ----D---- C:\Users\Owner\AppData\Roaming\Movier
2011-06-16 15:13:32 ----A---- C:\Windows\system32\mshtmled.dll
2011-06-16 15:13:31 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-06-16 15:13:31 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-06-16 15:13:31 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-06-16 15:13:31 ----A---- C:\Windows\system32\iertutil.dll
2011-06-16 15:13:30 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-06-16 15:13:30 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-06-16 15:13:30 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-06-16 15:13:30 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-06-16 15:13:30 ----A---- C:\Windows\system32\urlmon.dll
2011-06-16 15:13:30 ----A---- C:\Windows\system32\jscript9.dll
2011-06-16 15:13:30 ----A---- C:\Windows\system32\jscript.dll
2011-06-16 15:13:30 ----A---- C:\Windows\system32\ieui.dll
2011-06-16 15:13:28 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-06-16 15:13:28 ----A---- C:\Windows\system32\mshtml.dll
2011-06-16 15:13:28 ----A---- C:\Windows\system32\ieframe.dll
2011-06-16 14:59:40 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-06-16 14:59:40 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-06-16 14:59:40 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-06-16 14:59:40 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-06-16 14:59:40 ----A---- C:\Windows\system32\drivers\afd.sys
2011-06-16 14:59:38 ----A---- C:\Windows\system32\win32k.sys
2011-06-16 14:59:37 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-06-16 14:59:37 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-06-16 14:59:37 ----A---- C:\Windows\system32\drivers\srv.sys
2011-06-16 14:59:36 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-06-16 14:59:36 ----A---- C:\Windows\system32\oleaut32.dll
2011-06-16 14:59:34 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-06-16 14:59:34 ----A---- C:\Windows\system32\inetcomm.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\url.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-06-11 09:01:27 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\wininet.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\wextract.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\webcheck.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\vbscript.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\url.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\pngfilt.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\occache.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\msrating.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\msls31.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\mshtmler.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\mshta.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\msfeedssync.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\msfeeds.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\licmgr10.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\jsproxy.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\inseng.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\imgutil.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iexpress.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieUnatt.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iesysprep.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iesetup.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iernonce.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iepeers.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\iedkcs32.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieapfltr.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieapfltr.dat
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieakui.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieaksie.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ieakeng.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\ie4uinit.exe
2011-06-11 09:01:27 ----A---- C:\Windows\system32\icardie.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\dxtrans.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\dxtmsft.dll
2011-06-11 09:01:27 ----A---- C:\Windows\system32\admparse.dll
2011-06-11 08:43:25 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2011-06-11 08:43:25 ----A---- C:\Windows\system32\d3d10_1.dll

======List of files/folders modified in the last 1 month======

2011-07-09 21:50:17 ----D---- C:\Windows\Temp
2011-07-09 21:50:15 ----D---- C:\Windows\Prefetch
2011-07-09 21:47:29 ----RD---- C:\Program Files
2011-07-09 14:59:09 ----D---- C:\Windows\system32\config
2011-07-09 12:13:51 ----D---- C:\Windows\System32
2011-07-09 12:13:51 ----D---- C:\Windows\inf
2011-07-09 12:13:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-09 11:59:21 ----SHD---- C:\System Volume Information
2011-07-09 09:16:39 ----HD---- C:\ProgramData
2011-07-09 08:38:18 ----D---- C:\Users\Owner\AppData\Roaming\Adobe
2011-07-09 08:19:18 ----D---- C:\ProgramData\Adobe
2011-07-09 08:03:04 ----D---- C:\Windows
2011-07-08 20:11:40 ----SHD---- C:\Windows\Installer
2011-07-08 20:11:40 ----SD---- C:\Users\Owner\AppData\Roaming\Microsoft
2011-07-08 20:11:38 ----RD---- C:\Program Files (x86)
2011-07-08 20:11:37 ----D---- C:\Windows\SysWOW64
2011-07-08 07:15:22 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2011-07-08 07:15:21 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-07-06 00:06:27 ----D---- C:\Users\Owner\AppData\Roaming\IrfanView
2011-06-30 20:00:48 ----D---- C:\Windows\system32\catroot2
2011-06-30 19:54:44 ----D---- C:\Windows\winsxs
2011-06-29 23:37:06 ----D---- C:\Users\Owner\AppData\Roaming\vlc
2011-06-29 15:02:37 ----D---- C:\Program Files (x86)\Microsoft Office
2011-06-29 14:57:19 ----D---- C:\Windows\Fonts
2011-06-29 07:10:18 ----D---- C:\Windows\system32\catroot
2011-06-28 19:48:37 ----D---- C:\Windows\SoftwareDistribution
2011-06-28 19:43:43 ----D---- C:\Windows\system32\drivers
2011-06-28 19:43:42 ----SD---- C:\ProgramData\Microsoft
2011-06-27 20:06:23 ----D---- C:\ProgramData\Microsoft Help
2011-06-27 09:55:31 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-06-26 02:51:06 ----D---- C:\Windows\system32\Tasks
2011-06-25 01:53:18 ----D---- C:\Program Files (x86)\Common Files
2011-06-25 01:52:52 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2011-06-25 01:18:21 ----D---- C:\Windows\system32\NDF
2011-06-24 10:34:24 ----D---- C:\Users\Owner\AppData\Roaming\GHISLER
2011-06-23 11:30:38 ----D---- C:\Windows\Microsoft.NET
2011-06-23 11:30:37 ----RSD---- C:\Windows\assembly
2011-06-16 23:51:35 ----D---- C:\Windows\debug
2011-06-16 15:53:50 ----D---- C:\Program Files\Internet Explorer
2011-06-16 15:53:50 ----D---- C:\Program Files (x86)\Internet Explorer
2011-06-16 15:16:24 ----A---- C:\Windows\system32\MRT.exe
2011-06-16 15:14:07 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-06-16 15:13:08 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-06-13 22:07:18 ----D---- C:\Windows\Logs
2011-06-11 10:28:24 ----D---- C:\Windows\rescache
2011-06-11 09:40:35 ----D---- C:\Windows\SYSWOW64\migration
2011-06-11 09:40:35 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-06-11 09:40:35 ----D---- C:\Windows\system32\cs-CZ
2011-06-11 09:40:34 ----D---- C:\Windows\SYSWOW64\en-US
2011-06-11 09:40:34 ----D---- C:\Windows\system32\migration
2011-06-11 09:40:34 ----D---- C:\Windows\system32\en-US
2011-06-11 09:40:34 ----D---- C:\Windows\PolicyDefinitions
2011-06-11 08:43:41 ----D---- C:\Windows\system32\DriverStore

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [2011-01-27 450680]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [2011-03-15 912504]
R1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110701.001\BHDrvx64.sys [2011-05-19 1143416]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2011-05-12 481912]
R1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110708.032\IDSvia64.sys [2011-07-07 488056]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS [2011-03-31 40568]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [2011-01-27 171128]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [2011-03-22 382584]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2009-11-19 11576]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-12 136824]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-23 6180832]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-02 2536040]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110709.002\ENG64.SYS [2011-05-18 117880]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110709.002\EX64.SYS [2011-05-18 2011768]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS [2011-03-31 744568]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2011-05-12 174200]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
R3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2011-02-16 14464]
S3 ivusb;Initio Driver for USB Default Controller; C:\Windows\system32\DRIVERS\ivusb.sys [2010-07-29 29720]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9; C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
R2 NIS;Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]
R2 WDDMService;WDDMService; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2011-03-09 288768]
R2 WDFME;WD File Management Engine; C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [2011-03-09 1066896]
R2 WDSC;WD File Management Shadow Engine; C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [2011-03-09 491920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-05-12 1255736]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[sapito]

ComboFix 11-07-10.01 - Owner 10.07.2011 12:20:00.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4085.2490 [GMT 2:00]
Spuštěný z: c:\users\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-10 do 2011-07-10 )))))))))))))))))))))))))))))))
.
.
2011-07-10 10:34 . 2011-07-10 10:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-09 19:47 . 2011-07-09 19:50 -------- d-----w- c:\program files\trend micro
2011-07-09 19:47 . 2011-07-09 19:47 -------- d-----w- C:\rsit
2011-07-09 06:09 . 2011-06-07 17:10 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1C7A7267-4C65-4B52-8E62-4EAA426885E3}\mpengine.dll
2011-07-07 22:42 . 2011-07-08 05:13 -------- d-----w- c:\program files (x86)\FileHippo.com
2011-06-30 17:54 . 2011-06-30 17:54 -------- d-----w- c:\users\Owner\AppData\Roaming\WMHelp
2011-06-30 17:54 . 2011-06-30 17:54 -------- d-----w- c:\windows\Downloaded Installations
2011-06-30 17:53 . 2011-06-30 17:53 -------- d-----w- c:\program files (x86)\EzTools
2011-06-30 17:40 . 2011-06-30 17:40 -------- d-----w- c:\users\Owner\AppData\Local\RustemSoft
2011-06-30 17:40 . 2011-06-30 17:40 -------- d-----w- c:\users\Owner\AppData\Roaming\XMLmind
2011-06-30 17:35 . 2011-06-30 17:35 -------- d-----w- c:\program files (x86)\XMLmind_XML_Editor
2011-06-30 17:04 . 2011-06-30 18:03 -------- d-----w- c:\program files (x86)\RustemSoft
2011-06-27 07:55 . 2011-06-27 07:55 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-06-27 07:55 . 2011-06-27 07:55 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
2011-06-26 00:48 . 2011-06-26 01:15 -------- d-----w- C:\winnt
2011-06-26 00:33 . 2011-06-26 01:05 -------- d-----w- C:\AppServ
2011-06-26 00:11 . 2010-03-03 18:52 293888 ----a-w- c:\windows\SysWow64\libenchant_myspell.dll
2011-06-26 00:10 . 2010-03-03 18:52 5623808 ----a-w- c:\windows\SysWow64\php5.dll
2011-06-25 23:39 . 2011-06-25 23:39 -------- d-----w- c:\programdata\MySQL
2011-06-25 20:27 . 2011-06-25 20:29 -------- d-----w- c:\users\Owner\AppData\Roaming\PSpad
2011-06-25 20:27 . 2011-06-25 20:27 -------- d-----w- c:\program files (x86)\PSPad editor
2011-06-25 17:21 . 2011-06-25 17:23 -------- d-----w- c:\users\Owner\AppData\Local\Opera
2011-06-25 17:21 . 2011-06-25 17:23 -------- d-----w- c:\program files (x86)\Opera
2011-06-24 23:53 . 2011-06-24 23:53 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-06-24 23:52 . 2011-06-24 23:52 -------- d-----w- c:\program files (x86)\Java
2011-06-17 23:14 . 2010-02-25 19:50 315392 ----a-w- c:\windows\SysWow64\TubeFinder.exe
2011-06-17 23:14 . 2011-06-17 23:19 -------- d-----w- c:\users\Owner\AppData\Roaming\FreeFLVConverter
2011-06-17 23:14 . 2009-06-19 16:51 9728 ----a-w- c:\windows\SysWow64\PCCLPFR.DLL
2011-06-17 23:14 . 2009-06-19 16:51 84512 ----a-w- c:\windows\SysWow64\PICCLP32.OCX
2011-06-17 23:14 . 2009-06-19 16:51 364544 ----a-w- c:\windows\SysWow64\PropertyGrid.ocx
2011-06-17 23:14 . 2009-06-19 16:51 32768 ----a-w- c:\windows\SysWow64\CMDLGFR.DLL
2011-06-17 23:14 . 2009-06-19 16:51 24576 ----a-w- c:\windows\SysWow64\ControlSubX.ocx
2011-06-17 23:14 . 2009-06-19 16:51 152848 ----a-w- c:\windows\SysWow64\COMDLG32.OCX
2011-06-17 23:14 . 2009-06-19 16:51 141312 ----a-w- c:\windows\SysWow64\MSCMCFR.DLL
2011-06-17 23:14 . 2009-06-19 16:51 119568 ----a-w- c:\windows\SysWow64\VB6FR.DLL
2011-06-17 23:14 . 2009-06-19 16:51 101888 ----a-w- c:\windows\SysWow64\VB6STKIT.DLL
2011-06-17 23:11 . 2011-06-17 23:14 -------- d-----w- c:\program files (x86)\VDownloader
2011-06-17 22:55 . 2011-06-22 07:34 -------- d-----w- c:\users\Owner\AppData\Roaming\Movier
2011-06-16 12:59 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-16 12:59 . 2011-04-27 02:39 289280 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 12:59 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 12:59 . 2011-04-25 05:33 1923968 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-16 12:59 . 2011-04-25 02:34 499200 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-16 12:59 . 2011-05-28 03:06 3135488 ----a-w- c:\windows\system32\win32k.sys
2011-06-16 12:59 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-16 12:59 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-16 12:59 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-16 12:59 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-16 12:59 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-06-16 12:59 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-16 12:59 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-06-11 06:43 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2011-06-11 06:43 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 23:52 . 2011-05-12 08:21 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-06-16 06:51 . 2011-05-20 05:06 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-29 07:11 . 2011-06-08 06:34 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-06-08 06:34 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-24 17:14 . 2011-05-12 08:30 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-12 17:47 . 2011-05-12 17:44 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-05-12 11:42 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-05-12 11:42 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-04-22 22:15 . 2011-05-25 04:47 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]
R4 WDFME;WD File Management Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [2011-03-09 1066896]
R4 WDSC;WD File Management Shadow Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [2011-03-09 491920]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110701.001\BHDrvx64.sys [2011-05-19 1143416]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110708.032\IDSvia64.sys [2011-07-07 488056]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2011-03-09 288768]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-12 136824]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-20 12:17 302592 ----a-w- c:\windows\System32\cmd.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\qfsgofwj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-07-10 12:39:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-10 10:39
.
Před spuštěním: Volných bajtů: 83 089 125 376
Po spuštění: Volných bajtů: 82 687 385 600
.
- - End Of File - - FB81E278458C86AFB073193824CA1FA9

[Rudy]

Log vypadá OK. Odinstalujte WindowsDefender, může být v konfliktu s bezpečnostním balíkem Norton.

[sapito]

Díky, defender jsem vypnul, to by mohlo stačit. Nebo mám přímo odinstalovat?
Každopádně dík.

[Rudy]

Stačí, když je vypnutý. Nastala nějaká změna?

[sapito]

Připadá mi to celkem beze změny. Budu to nadále sledovat.

[Rudy]

Zkuste ještě PC vyčistit od balastu CCleanerem: http://www.viry.cz/forum/viewtopic.php?f=46&t=7478 .