facebook virus

[method]

Caute, chytil som Facebook virus. Pomozete mi prosim?

Logfile of random's system information tool 1.09 (written by random/random)
Run by Elenka at 2011-08-21 19:33:50
Microsoft Windows 7 Home Premium
System drive C: has 115 GB (75%) free of 153 GB
Total RAM: 3824 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:33:53, on 21. 8. 2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
C:\Windows\update.tray-3-0\svchost.exe
C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Elenka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll
O2 - BHO: UrlHelper Class - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [NBAgent] "c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
O4 - HKLM\..\Run: [TSleepSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-3-0\svchost.exe
O4 - HKLM\..\Run: [5223750.exe] "C:\Windows\Temp\5223750.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [2526475.exe] "C:\Windows\TEMP\2526475.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.5\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Pridať do blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Pridať do blogu v programe Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: Ochrana HDD TOSHIBA (Thpsrv) - Unknown owner - C:\Windows\system32\ThpSrv.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 11743 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
winlogon.exe
C:\Windows\system32\WLANExt.exe 2996256
\??\C:\Windows\system32\conhost.exe "-1060688101-20356532001689046619-13114692001587632982-161420649517914880421731601739
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"
C:\Windows\system32\ThpSrv.exe
C:\Windows\system32\TODDSrv.exe
"C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
"C:\Program Files\TOSHIBA\TECO\TecoService.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\update.1\svchost.exe srv
WLIDSvcM.exe 1176
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe"
"C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe"
"C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe"
"C:\Program Files\TOSHIBA\TECO\Teco.exe" /r
"C:\Windows\System32\ThpSrv.exe" /logon
"C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxext.exe -Embedding
C:\Windows\system32\igfxsrvc.exe -Embedding
C:\Windows\sysdriver32.exe srv
"C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
"C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" /START
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
"C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe"
"C:\Windows\update.tray-3-0\svchost.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Windows\update.5.0\svchost.exe srv
"C:\Windows\update.5.0\svchost.exe" stand
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe"
"C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe"
"C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe"
"C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe"
"C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe"
"C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel=5172.043083C0.1408312966 /prefetch:12
C:\Windows\system32\rundll32.exe "C:\Users\Elenka\AppData\Local\Google\Chrome\APPLIC~1\130782~1.112\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Elenka\AppData\Local\Google\Chrome\Application\13.0.782.112\gcswf32.dll" --lang=sk --channel=5172.046BD1C0.1408738322 --flash-broker=5372 /prefetch:4
"C:\Users\Elenka\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=sk --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/ --disable-client-side-phishing-detection --channel=5172.042B29A0.1097110367 /prefetch:3
C:\Windows\servicing\TrustedInstaller.exe
taskeng.exe {336D4018-B634-49B9-AB3E-2E5320B5121F}
C:\Windows\system32\sppsvc.exe
C:\Windows\update.2\svchost.exe srv
"C:\Windows\update.2\svchost.exe" stand
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Users\Elenka\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
UrlHelper Class - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [2011-06-01 1793432]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}]
Searchqu Toolbar - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll [2011-05-31 88976]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
UrlHelper Class - C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll [2011-06-01 1236376]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-06-23 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{99079a25-328f-4bd4-be04-00955acaa0a7} - Searchqu Toolbar - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll [2011-05-31 88976]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-05-11 161304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-05-11 386584]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-05-11 414744]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-04-06 10144288]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-03-11 2107176]
"TPwrMain"=C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [2010-05-25 505768]
"HSON"=C:\Program Files\TOSHIBA\TBS\HSON.exe [2009-03-09 52600]
"SmoothView"=C:\Program Files\Toshiba\SmoothView\SmoothView.exe [2009-08-13 570680]
"00TCrdMain"=C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [2010-05-10 915320]
"SmartFaceVWatcher"=C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2009-10-19 238080]
"Teco"=C:\Program Files\TOSHIBA\TECO\Teco.exe [2010-04-23 1504608]
"TosSENotify"=C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [2010-02-05 709976]
"ThpSrv"=C:\Windows\system32\thpsrv /logon []
"TosWaitSrv"=C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [2010-05-10 705432]
"TosVolRegulator"=C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [2009-11-11 24376]
"Toshiba Registration"=C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [2010-04-19 136136]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe /hide /waitservice []
"KONICA MINOLTA PagePro 1400W STD"=C:\Windows\system32\MSTMON_Y.EXE [2006-04-11 269312]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 136176]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ICQ"=C:\Program Files (x86)\ICQ7.5\ICQ.exe [2011-08-01 124480]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"NBAgent"=c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [2010-03-09 1086760]
"TOSDCR"=C:\Program Files\TOSHIBA\PasswordUtility\TOSDCR.exe []
"TWebCamera"=C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2010-05-01 2454840]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START []
"ToshibaServiceStation"=C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [2009-10-06 1294136]
"TSleepSrv"=C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [2010-04-01 252728]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"DATAMNGR"=C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [2011-06-01 1546640]
"wxpdrv"=C:\Windows\services32.exe [2011-08-19 1215488]
"tray_ico"= []
"tray_ico0"=C:\Windows\update.tray-3-0\svchost.exe [2011-08-19 1215488]
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"5223750.exe"=C:\Windows\Temp\5223750.exe [2011-08-21 258048]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-21 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-21 258048]
"2526475.exe"=C:\Windows\TEMP\2526475.exe [2011-08-21 634880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-04-30 269824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-21 19:33:50 ----D---- C:\rsit
2011-08-21 19:33:50 ----D---- C:\Program Files\trend micro
2011-08-21 19:32:19 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-21 19:31:44 ----HD---- C:\Windows\update.2
2011-08-21 19:28:21 ----D---- C:\Windows\ufa
2011-08-21 19:28:21 ----D---- C:\Windows\rpcminer
2011-08-21 19:28:21 ----D---- C:\Windows\phoenix
2011-08-21 19:24:38 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-21 19:24:19 ----A---- C:\Windows\unrar.exe
2011-08-21 19:24:01 ----HD---- C:\Windows\update.5.0
2011-08-21 19:23:41 ----D---- C:\Windows\av_ico
2011-08-21 19:23:30 ----A---- C:\Windows\iplist.txt
2011-08-21 19:23:15 ----A---- C:\Windows\sysdriver32_.exe
2011-08-21 19:23:00 ----A---- C:\Windows\sysdriver32.exe
2011-08-21 19:22:45 ----A---- C:\Windows\front_ip_list.txt
2011-08-19 10:21:40 ----HD---- C:\Windows\update.1
2011-08-19 10:21:35 ----HD---- C:\Windows\update.tray-3-0-lnk
2011-08-19 10:21:35 ----HD---- C:\Windows\update.tray-3-0
2011-08-19 10:11:38 ----A---- C:\Windows\winlog-ids.txt
2011-08-19 10:11:38 ----A---- C:\Windows\winlog-dirs.txt
2011-08-19 10:11:33 ----A---- C:\Windows\services32.exe
2011-08-12 15:22:06 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-12 15:22:05 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-12 15:22:04 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-12 15:22:04 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-12 15:22:04 ----A---- C:\Windows\system32\ieui.dll
2011-08-12 15:22:04 ----A---- C:\Windows\system32\iertutil.dll
2011-08-12 15:22:03 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-12 15:22:03 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-08-12 15:22:03 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-08-12 15:22:03 ----A---- C:\Windows\system32\url.dll
2011-08-12 15:22:03 ----A---- C:\Windows\system32\jscript9.dll
2011-08-12 15:22:02 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-12 15:22:02 ----A---- C:\Windows\system32\urlmon.dll
2011-08-12 15:22:02 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-12 15:22:02 ----A---- C:\Windows\system32\jscript.dll
2011-08-12 15:22:01 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-12 15:22:01 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-12 15:22:01 ----A---- C:\Windows\system32\wininet.dll
2011-08-12 15:22:00 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-12 15:21:58 ----A---- C:\Windows\system32\mshtml.dll
2011-08-12 15:21:57 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-12 15:21:57 ----A---- C:\Windows\system32\ieframe.dll
2011-08-11 08:30:59 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-11 08:30:59 ----A---- C:\Windows\system32\xmllite.dll
2011-08-11 08:30:58 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-11 08:30:58 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-11 08:30:58 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-11 08:30:58 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-11 08:30:57 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-11 08:30:57 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-11 08:30:57 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-11 08:30:57 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-11 08:30:57 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-11 08:30:56 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-11 08:30:47 ----A---- C:\Windows\system32\wow64.dll
2011-08-11 08:30:47 ----A---- C:\Windows\system32\winsrv.dll
2011-08-11 08:30:47 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-11 08:30:47 ----A---- C:\Windows\system32\kernel32.dll
2011-08-11 08:30:47 ----A---- C:\Windows\system32\conhost.exe
2011-08-11 08:30:46 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-11 08:30:46 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-11 08:30:46 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-11 08:30:46 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-11 08:30:46 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-11 08:30:46 ----A---- C:\Windows\system32\wow64win.dll
2011-08-11 08:30:46 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-11 08:30:46 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-11 08:30:45 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-11 08:30:44 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-11 08:30:43 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-11 08:30:43 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-11 08:30:43 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-11 08:30:41 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-11 08:30:40 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-11 08:30:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-11 08:30:36 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-07-31 14:43:51 ----D---- C:\ProgramData\boost_interprocess
2011-07-29 16:19:08 ----D---- C:\Program Files (x86)\Windows iLivid Toolbar
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MUINST_Y.EXE
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MTAG32_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MSTMON_Y.EXE
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MSTMON_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MSPOOL_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MLMON__Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MIMF32_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MICM___Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MGDI32_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MCOINS_Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\system32\MCMM___Y.DLL
2011-07-26 09:25:39 ----A---- C:\Windows\MSUMLT_Y.INI
2011-07-26 09:25:39 ----A---- C:\Windows\MSTMON_Y.INI
2011-07-26 09:25:39 ----A---- C:\Windows\MREADM_Y.TXT
2011-07-24 21:02:26 ----D---- C:\Program Files (x86)\Microsoft Works
2011-07-24 21:02:06 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2011-07-24 20:59:50 ----D---- C:\Program Files\Microsoft Office
2011-07-24 20:59:46 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-07-24 20:59:01 ----D---- C:\ProgramData\Microsoft Help
2011-07-24 20:58:05 ----RHD---- C:\MSOCache
2011-07-24 20:53:55 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-07-24 20:53:47 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2011-07-24 20:53:24 ----D---- C:\Users\Elenka\AppData\Roaming\DAEMON Tools Lite
2011-07-24 20:53:24 ----D---- C:\ProgramData\DAEMON Tools Lite

======List of files/folders modified in the last 1 month======

2011-08-21 19:33:50 ----RD---- C:\Program Files
2011-08-21 19:33:46 ----D---- C:\Windows\Temp
2011-08-21 19:32:19 ----D---- C:\Windows
2011-08-21 19:32:10 ----D---- C:\Windows\system32\drivers\etc
2011-08-21 19:25:32 ----D---- C:\Windows\system32\config
2011-08-21 19:24:07 ----D---- C:\Users\Elenka\AppData\Roaming\ICQ
2011-08-21 19:22:15 ----A---- C:\Windows\SYSWOW64\log.txt
2011-08-19 09:30:14 ----SHD---- C:\System Volume Information
2011-08-18 20:43:31 ----SD---- C:\Users\Elenka\AppData\Roaming\Microsoft
2011-08-18 20:36:42 ----D---- C:\Windows\System32
2011-08-18 20:36:41 ----D---- C:\Windows\inf
2011-08-18 20:36:41 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-15 22:19:10 ----D---- C:\Windows\Microsoft.NET
2011-08-15 22:19:09 ----RSD---- C:\Windows\assembly
2011-08-14 11:50:42 ----D---- C:\Windows\winsxs
2011-08-12 16:09:16 ----D---- C:\Windows\SysWOW64
2011-08-12 16:09:15 ----D---- C:\Windows\system32\drivers
2011-08-12 16:09:14 ----D---- C:\Windows\SYSWOW64\migration
2011-08-12 16:09:14 ----D---- C:\Windows\system32\migration
2011-08-12 16:09:14 ----D---- C:\Windows\AppPatch
2011-08-12 16:09:14 ----D---- C:\Program Files\Internet Explorer
2011-08-12 16:09:14 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-12 15:30:52 ----SHD---- C:\Windows\Installer
2011-08-12 15:30:11 ----D---- C:\Windows\system32\catroot2
2011-08-12 15:30:11 ----D---- C:\Windows\system32\catroot
2011-08-12 15:28:46 ----A---- C:\Windows\system32\MRT.exe
2011-08-08 15:35:40 ----D---- C:\Windows\system32\Tasks
2011-08-02 19:33:54 ----D---- C:\Program Files (x86)\ICQ7.5
2011-08-02 19:32:56 ----HD---- C:\ProgramData
2011-08-02 10:22:29 ----D---- C:\Program Files (x86)\Common Files
2011-08-02 10:22:27 ----RD---- C:\Program Files (x86)
2011-08-02 10:16:43 ----D---- C:\Windows\system32\wdi
2011-07-26 09:29:47 ----D---- C:\Windows\system32\DriverStore
2011-07-25 16:21:39 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-07-25 16:05:42 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-07-25 16:02:16 ----RSD---- C:\Windows\Fonts
2011-07-25 16:00:08 ----A---- C:\Windows\win.ini
2011-07-24 22:17:03 ----D---- C:\Windows\Prefetch
2011-07-24 21:02:22 ----D---- C:\Program Files (x86)\MSBuild
2011-07-24 21:02:16 ----D---- C:\Program Files (x86)\Microsoft Office
2011-07-24 21:02:04 ----D---- C:\Windows\ShellNew
2011-07-24 21:01:38 ----SD---- C:\ProgramData\Microsoft
2011-07-24 21:01:38 ----D---- C:\Program Files (x86)\Microsoft.NET

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-03-24 540696]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-06-19 213888]
R0 Thpdrv;TOSHIBA HDD Protection Driver; C:\Windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver; C:\Windows\system32\DRIVERS\Thpevm.SYS [2009-06-29 14784]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ.SYS [2009-07-14 26840]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-24 254528]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-12-21 170640]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-12-21 50624]
R2 risdpcie;risdpcie; C:\Windows\system32\DRIVERS\risdpe64.sys [2010-03-19 81920]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver; C:\Windows\system32\DRIVERS\TVALZFL.sys [2009-06-19 14472]
R3 BCM43XX;Broadcom 802.11 - ovládač sieťového adaptéru; C:\Windows\system32\DRIVERS\bcmwl664.sys [2010-11-12 3058168]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2010-01-14 295088]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-12-21 34144]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-04-30 10331840]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-04-06 2337440]
R3 IntcDAud;Intel(R) Zvuk pre obrazovky; C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 271872]
R3 PGEffect;Pangu effect driver; C:\Windows\system32\DRIVERS\pgeffect.sys [2009-06-22 35008]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-03-11 316464]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\Windows\system32\DRIVERS\tdcmdpst.sys [2009-07-30 27784]
R3 tosrfec;Bluetooth ACPI; C:\Windows\system32\DRIVERS\tosrfec.sys [2009-07-13 19824]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2009-06-20 1394688]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2010-02-24 78336]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2010-02-24 181248]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 109056]
S3 Ser2pl;Prolific Serial port driver; C:\Windows\system32\DRIVERS\ser2pl64.sys [2008-01-31 93184]
S3 Tosrfcom;Tosrfcom; C:\Windows\system32\drivers\Tosrfcom.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-03-03 268824]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2010-01-15 935208]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-21 352768]
R2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-21 634880]
R2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-21 258048]
R2 Thpsrv;Ochrana HDD TOSHIBA; C:\Windows\system32\ThpSrv.exe [2009-10-21 531520]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\Windows\system32\TODDSrv.exe [2009-07-28 140632]
R2 TosCoSrv;TOSHIBA Power Saver; C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe [2010-05-25 489384]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [2010-04-23 259440]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
R2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe [2011-08-19 1215488]
R3 TMachInfo;TMachInfo; C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-05 137560]
R3 TPCHSrv;TPCH Service; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2010-05-10 836016]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe []
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2010-04-12 196976]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-07-19 1255736]

-----------------EOF-----------------

[Rudy]

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[method]

Malwarebytes' Anti-Malware 1.51.1.1800
http://www.malwarebytes.org

Verzia databázy: 7528

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

21. 8. 2011 20:25:41
mbam-log-2011-08-21 (20-25-27).txt

Typ kontroly: Úplná kontrola (C:\|D:\|)
Objektov kontrolovaných: 304194
Uplynutý čas: 26 min, 38 sek

Infikované služby pamäte: 8
Infikované moduly pamäte: 0
Infikované registračné kľúče: 9
Infikované registračné hodnoty: 11
Infikované položky registračných dát: 3
Infikované priečinky: 1
Infikované súbory: 37

Infikované služby pamäte:
c:\Windows\update.1\svchost.exe (Trojan.Dropper) -> 2064 -> No action taken.
c:\Windows\sysdriver32.exe (Trojan.Agent) -> 3308 -> No action taken.
c:\Windows\update.tray-3-0\svchost.exe (Trojan.Dropper) -> 4304 -> No action taken.
c:\Windows\l1rezerv.exe (Trojan.Agent) -> 4452 -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 700 -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 3772 -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> 2944 -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> 3376 -> No action taken.

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.

Infikované registračné hodnoty:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Agent) -> Value: sysdriver32.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l1rezerv.exe (Trojan.Agent) -> Value: l1rezerv.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wxpdrv (Trojan.Dropper) -> Value: wxpdrv -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5223750.exe (Trojan.Agent) -> Value: 5223750.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Agent) -> Value: sysdriver32_.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37715863-loader2.exe (Trojan.Agent) -> Value: 37715863-loader2.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8519523.exe (Trojan.Agent) -> Value: 8519523.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2526475.exe (Trojan.Agent) -> Value: 2526475.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované položky registračných dát:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované priečinky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.

Infikované súbory:
c:\Windows\update.1\svchost.exe (Trojan.Dropper) -> No action taken.
c:\Windows\sysdriver32.exe (Trojan.Agent) -> No action taken.
c:\Windows\update.tray-3-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\Windows\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\Windows\services32.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\5223750.exe (Trojan.Agent) -> No action taken.
c:\Windows\sysdriver32_.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\37715863-loader2.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\8519523.exe (Trojan.Agent) -> No action taken.
c:\Users\Elenka\AppData\Local\Google\Chrome\user data\Default\Cache\f_00156f (Trojan.Dropper) -> No action taken.
c:\Users\Elenka\downloads\flash-player (1).exe (Trojan.Dropper) -> No action taken.
c:\Users\Elenka\downloads\flash-player.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\41177647.exe (Trojan.Downloader) -> No action taken.
c:\Windows\Temp\4712_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\5728483.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\7576168.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\8803532.exe (Trojan.Agent) -> No action taken.
c:\Windows\update.tray-3-0-lnk\svchost.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\1492309.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\2526475.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\9082591.exe (Trojan.Agent) -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.

[method]

Zda sa mi, ze vsetko co mi mbam nasiel mozem premazat. Je to tak?

[Rudy]

Ano, smažte. Pak restartujte PC a na dočištění dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[method]

hotovo


ComboFix 11-08-21.01 - Elenka . 08. 2011 0:13.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3824.2364 [GMT 2:00]
Running from: c:\users\Elenka\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((( Files Created from 2011-07-21 to 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 22:17 . 2011-08-21 22:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-21 22:17 . 2011-08-21 22:17 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-08-21 17:57 . 2011-08-21 17:57 -------- d-----w- c:\users\Elenka\AppData\Roaming\Malwarebytes
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:56 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:56 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 17:36 . 2011-08-21 17:37 -------- d--h--w- c:\windows\update.7.1
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- C:\rsit
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- c:\program files\trend micro
2011-08-21 17:28 . 2011-08-21 17:28 -------- d-----w- c:\windows\ufa
2011-08-21 17:24 . 2011-08-21 17:28 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 17:23 . 2011-08-21 17:23 -------- d-----w- c:\windows\av_ico
2011-08-19 08:21 . 2011-08-21 22:04 -------- d--h--w- c:\windows\update.tray-3-0
2011-08-19 08:21 . 2011-08-21 22:04 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-08-19 07:30 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{87A1510C-1202-4892-B05A-6548684C3E49}\mpengine.dll
2011-08-10 14:57 . 2011-08-10 14:57 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-31 12:43 . 2011-07-31 12:43 -------- d-----w- c:\programdata\boost_interprocess
2011-07-29 14:19 . 2011-07-29 14:19 -------- d-----w- c:\program files (x86)\Windows iLivid Toolbar
2011-07-29 14:18 . 2011-07-29 14:18 -------- d-----w- c:\users\Elenka\AppData\Local\PackageAware
2011-07-26 07:25 . 2006-04-11 12:05 225792 ----a-w- c:\windows\system32\MUINST_Y.EXE
2011-07-26 07:25 . 2006-04-11 12:03 55296 ----a-w- c:\windows\system32\MCOINS_Y.DLL
2011-07-26 07:25 . 2006-04-11 11:49 144384 ----a-w- c:\windows\system32\MLMON__Y.DLL
2011-07-26 07:25 . 2006-04-11 07:36 269312 ----a-w- c:\windows\system32\MSTMON_Y.EXE
2011-07-26 07:25 . 2006-04-10 12:47 1185280 ----a-w- c:\windows\system32\MSTMON_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:57 56320 ----a-w- c:\windows\system32\Spool\prtprocs\x64\MIMFPR_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 76800 ----a-w- c:\windows\system32\MICM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 93184 ----a-w- c:\windows\system32\MCMM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 59392 ----a-w- c:\windows\system32\MIMF32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 50688 ----a-w- c:\windows\system32\MTAG32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 107008 ----a-w- c:\windows\system32\MGDI32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:54 119296 ----a-w- c:\windows\system32\MSPOOL_Y.DLL
2011-07-25 13:58 . 2011-07-25 13:58 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-07-24 19:02 . 2011-07-25 14:01 -------- d-----w- c:\program files (x86)\Microsoft Works
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\users\Elenka\AppData\Local\Microsoft Help
2011-07-24 18:59 . 2011-08-12 13:30 -------- d-----w- c:\programdata\Microsoft Help
2011-07-24 18:58 . 2011-07-24 18:58 -------- d-----r- C:\MSOCache
2011-07-24 18:53 . 2011-07-24 18:53 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:55 -------- d-----w- c:\users\Elenka\AppData\Roaming\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\programdata\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-19 20:13 . 2011-07-19 20:13 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 448512 ----a-w- c:\windows\system32\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 222208 ----a-w- c:\windows\system32\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 160256 ----a-w- c:\windows\system32\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 1492992 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 12288 ----a-w- c:\windows\system32\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 114176 ----a-w- c:\windows\system32\admparse.dll
2011-07-19 20:13 . 2011-07-19 20:13 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-07-19 20:12 . 2011-07-19 20:12 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-07-19 20:12 . 2011-07-19 20:12 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 4068864 ----a-w- c:\windows\system32\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-07-19 20:12 . 2011-07-19 20:12 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 229888 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 206848 ----a-w- c:\windows\system32\mfps.dll
2011-07-19 20:12 . 2011-07-19 20:12 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1495040 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 144384 ----a-w- c:\windows\system32\cdd.dll
2011-07-19 20:12 . 2011-07-19 20:12 135168 ----a-w- c:\windows\SysWow64\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1133568 ----a-w- c:\windows\system32\FntCache.dll
2011-07-19 20:12 . 2011-07-19 20:12 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-07-16 04:32 . 2011-08-11 06:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-11 02:56 . 2011-07-19 07:05 3134464 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 17:14 . 2011-07-19 07:05 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 11:21 . 2011-07-19 07:06 404992 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-05-24 10:34 . 2011-07-19 07:06 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-05-24 10:34 . 2011-07-19 07:06 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-05-24 10:34 . 2011-07-19 07:06 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:32 . 2011-07-19 07:06 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"ICQ"="c:\program files (x86)\ICQ7.5\ICQ.exe" [2011-08-01 124480]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NBAgent"="c:\program files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" [2010-03-09 1086760]
"TOSDCR"="c:\program files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-05-01 2454840]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 ddservice;ddservice;c:\windows\update.7.1\svchostdriver.exe [2011-08-21 382464]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-23 259440]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Zvuk pre obrazovky;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-05 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-05-10 836016]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001Core.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001UA.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
2011-06-01 20:44 1793432 ----a-w- c:\progra~2\WI3C8A~1\Datamngr\x64\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-11 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-11 414744]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-05 709976]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2010-04-19 136136]
"KONICA MINOLTA PagePro 1400W STD"="c:\windows\system32\MSTMON_Y.EXE" [2006-04-11 269312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\x64\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\x64\IEBHO.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.searchqu.com/406
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 195.34.133.21 212.186.211.21
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico1 - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SmartFaceVWatcher - c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-egui - c:\program files\ESET\ESET Smart Security\egui.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
.
**************************************************************************
.
Completion time: 2011-08-22 00:23:59 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-21 22:23
.
Pre-Run: 120 566 841 344 bytes free
Post-Run: 120 103 133 184 bytes free
.
- - End Of File - - D03582372A30C25ED8825134D40D99E0

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\unrar.exe

Driver::
ddservice

Folder::
c:\windows\update.7.1
c:\windows\ufa
c:\windows\update.tray-3-0
c:\windows\update.tray-3-0-lnk

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhnhěte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[method]

hotovo


ComboFix 11-08-21.01 - Elenka . 08. 2011 19:31:07.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3824.2269 [GMT 2:00]
Running from: c:\users\Elenka\Desktop\ComboFix.exe
Command switches used :: c:\users\Elenka\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\ufa
c:\windows\unrar.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ddservice
.
.
((((((((((((((((((((((((( Files Created from 2011-07-22 to 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-21 17:57 . 2011-08-21 17:57 -------- d-----w- c:\users\Elenka\AppData\Roaming\Malwarebytes
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:56 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:56 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- C:\rsit
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- c:\program files\trend micro
2011-08-21 17:23 . 2011-08-21 17:23 -------- d-----w- c:\windows\av_ico
2011-08-19 07:30 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{87A1510C-1202-4892-B05A-6548684C3E49}\mpengine.dll
2011-08-10 14:57 . 2011-08-10 14:57 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-31 12:43 . 2011-07-31 12:43 -------- d-----w- c:\programdata\boost_interprocess
2011-07-29 14:19 . 2011-07-29 14:19 -------- d-----w- c:\program files (x86)\Windows iLivid Toolbar
2011-07-29 14:18 . 2011-07-29 14:18 -------- d-----w- c:\users\Elenka\AppData\Local\PackageAware
2011-07-26 07:25 . 2006-04-11 12:05 225792 ----a-w- c:\windows\system32\MUINST_Y.EXE
2011-07-26 07:25 . 2006-04-11 12:03 55296 ----a-w- c:\windows\system32\MCOINS_Y.DLL
2011-07-26 07:25 . 2006-04-11 11:49 144384 ----a-w- c:\windows\system32\MLMON__Y.DLL
2011-07-26 07:25 . 2006-04-11 07:36 269312 ----a-w- c:\windows\system32\MSTMON_Y.EXE
2011-07-26 07:25 . 2006-04-10 12:47 1185280 ----a-w- c:\windows\system32\MSTMON_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:57 56320 ----a-w- c:\windows\system32\Spool\prtprocs\x64\MIMFPR_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 76800 ----a-w- c:\windows\system32\MICM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 93184 ----a-w- c:\windows\system32\MCMM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 59392 ----a-w- c:\windows\system32\MIMF32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 50688 ----a-w- c:\windows\system32\MTAG32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 107008 ----a-w- c:\windows\system32\MGDI32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:54 119296 ----a-w- c:\windows\system32\MSPOOL_Y.DLL
2011-07-25 13:58 . 2011-07-25 13:58 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-07-24 19:02 . 2011-07-25 14:01 -------- d-----w- c:\program files (x86)\Microsoft Works
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\users\Elenka\AppData\Local\Microsoft Help
2011-07-24 18:59 . 2011-08-12 13:30 -------- d-----w- c:\programdata\Microsoft Help
2011-07-24 18:58 . 2011-07-24 18:58 -------- d-----r- C:\MSOCache
2011-07-24 18:53 . 2011-07-24 18:53 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:55 -------- d-----w- c:\users\Elenka\AppData\Roaming\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\programdata\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-19 20:13 . 2011-07-19 20:13 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 448512 ----a-w- c:\windows\system32\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 222208 ----a-w- c:\windows\system32\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 160256 ----a-w- c:\windows\system32\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 1492992 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 12288 ----a-w- c:\windows\system32\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 114176 ----a-w- c:\windows\system32\admparse.dll
2011-07-19 20:13 . 2011-07-19 20:13 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-07-19 20:12 . 2011-07-19 20:12 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-07-19 20:12 . 2011-07-19 20:12 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 4068864 ----a-w- c:\windows\system32\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-07-19 20:12 . 2011-07-19 20:12 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 229888 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 206848 ----a-w- c:\windows\system32\mfps.dll
2011-07-19 20:12 . 2011-07-19 20:12 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1495040 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 144384 ----a-w- c:\windows\system32\cdd.dll
2011-07-19 20:12 . 2011-07-19 20:12 135168 ----a-w- c:\windows\SysWow64\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1133568 ----a-w- c:\windows\system32\FntCache.dll
2011-07-19 20:12 . 2011-07-19 20:12 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-07-16 04:32 . 2011-08-11 06:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-11 02:56 . 2011-07-19 07:05 3134464 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_22.19.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-23 04:50 . 2011-08-22 09:40 43548 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-22 17:27 34036 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-07-18 23:16 . 2011-07-19 20:22 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-07-18 23:16 . 2011-08-22 10:46 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-07-18 23:16 . 2011-08-22 10:46 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-07-18 23:16 . 2011-07-19 20:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-22 10:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-19 20:22 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2011-08-22 10:42 88688 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-07-18 15:59 . 2011-08-22 17:27 7408 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2574094893-3751011069-2714102146-1001_UserData.bin
+ 2011-08-22 17:36 . 2011-08-22 17:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-21 22:19 . 2011-08-21 22:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-22 17:36 . 2011-08-22 17:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-08-21 22:19 . 2011-08-21 22:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-18 20:22 . 2011-08-22 14:48 253742 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:01 . 2011-08-21 22:18 390348 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-22 17:35 390348 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-08-21 20:44 . 2011-08-21 22:18 581468 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2574094893-3751011069-2714102146-1001-12288.dat
+ 2011-08-21 20:44 . 2011-08-22 17:35 581468 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2574094893-3751011069-2714102146-1001-12288.dat
- 2009-07-14 02:34 . 2011-08-21 17:35 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-08-22 12:23 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"ICQ"="c:\program files (x86)\ICQ7.5\ICQ.exe" [2011-08-01 124480]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NBAgent"="c:\program files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" [2010-03-09 1086760]
"TOSDCR"="c:\program files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-05-01 2454840]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-23 259440]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Zvuk pre obrazovky;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-05 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-05-10 836016]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001Core.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001UA.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"combofix"="c:\combofix\CF14845.cfxxe" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-11 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-11 414744]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-05 709976]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2010-04-19 136136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [BU]
"KONICA MINOLTA PagePro 1400W STD"="c:\windows\system32\MSTMON_Y.EXE" [2006-04-11 269312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\x64\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\x64\IEBHO.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.searchqu.com/406
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 195.34.133.21 212.186.211.21
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
.
**************************************************************************
.
Completion time: 2011-08-22 19:39:55 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-22 17:39
ComboFix2.txt 2011-08-22 12:13
ComboFix3.txt 2011-08-21 22:23
.
Pre-Run: 120 702 205 952 bytes free
Post-Run: 120 401 772 544 bytes free
.
- - End Of File - - 399D43E0F022758924BE38E23750A87A
Upload was successful

[Rudy]

Ještě se jeden objevil. Spusťte, prosím Combofix ještě jednou tímto skriptem:

Folder::
c:\windows\av_ico

[method]

hotovo


ComboFix 11-08-21.01 - Elenka . 08. 2011 20:34:18.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3824.2337 [GMT 2:00]
Running from: c:\users\Elenka\Desktop\ComboFix.exe
Command switches used :: c:\users\Elenka\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_NOD_SS_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
.
.
((((((((((((((((((((((((( Files Created from 2011-07-22 to 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-22 18:37 . 2011-08-22 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-22 18:37 . 2011-08-22 18:37 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-08-21 17:57 . 2011-08-21 17:57 -------- d-----w- c:\users\Elenka\AppData\Roaming\Malwarebytes
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:56 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:56 . 2011-08-21 17:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:56 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- C:\rsit
2011-08-21 17:33 . 2011-08-21 17:33 -------- d-----w- c:\program files\trend micro
2011-08-19 07:30 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{87A1510C-1202-4892-B05A-6548684C3E49}\mpengine.dll
2011-08-10 14:57 . 2011-08-10 14:57 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-31 12:43 . 2011-07-31 12:43 -------- d-----w- c:\programdata\boost_interprocess
2011-07-29 14:19 . 2011-07-29 14:19 -------- d-----w- c:\program files (x86)\Windows iLivid Toolbar
2011-07-29 14:18 . 2011-07-29 14:18 -------- d-----w- c:\users\Elenka\AppData\Local\PackageAware
2011-07-26 07:25 . 2006-04-11 12:05 225792 ----a-w- c:\windows\system32\MUINST_Y.EXE
2011-07-26 07:25 . 2006-04-11 12:03 55296 ----a-w- c:\windows\system32\MCOINS_Y.DLL
2011-07-26 07:25 . 2006-04-11 11:49 144384 ----a-w- c:\windows\system32\MLMON__Y.DLL
2011-07-26 07:25 . 2006-04-11 07:36 269312 ----a-w- c:\windows\system32\MSTMON_Y.EXE
2011-07-26 07:25 . 2006-04-10 12:47 1185280 ----a-w- c:\windows\system32\MSTMON_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:57 56320 ----a-w- c:\windows\system32\Spool\prtprocs\x64\MIMFPR_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 76800 ----a-w- c:\windows\system32\MICM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 93184 ----a-w- c:\windows\system32\MCMM___Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 59392 ----a-w- c:\windows\system32\MIMF32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 50688 ----a-w- c:\windows\system32\MTAG32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:55 107008 ----a-w- c:\windows\system32\MGDI32_Y.DLL
2011-07-26 07:25 . 2006-03-09 09:54 119296 ----a-w- c:\windows\system32\MSPOOL_Y.DLL
2011-07-25 13:58 . 2011-07-25 13:58 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-07-24 19:02 . 2011-07-25 14:01 -------- d-----w- c:\program files (x86)\Microsoft Works
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-07-24 18:59 . 2011-07-24 18:59 -------- d-----w- c:\users\Elenka\AppData\Local\Microsoft Help
2011-07-24 18:59 . 2011-08-12 13:30 -------- d-----w- c:\programdata\Microsoft Help
2011-07-24 18:58 . 2011-07-24 18:58 -------- d-----r- C:\MSOCache
2011-07-24 18:53 . 2011-07-24 18:53 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:55 -------- d-----w- c:\users\Elenka\AppData\Roaming\DAEMON Tools Lite
2011-07-24 18:53 . 2011-07-24 18:53 -------- d-----w- c:\programdata\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-19 20:13 . 2011-07-19 20:13 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-07-19 20:13 . 2011-07-19 20:13 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-07-19 20:13 . 2011-07-19 20:13 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-07-19 20:13 . 2011-07-19 20:13 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-07-19 20:13 . 2011-07-19 20:13 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-07-19 20:13 . 2011-07-19 20:13 448512 ----a-w- c:\windows\system32\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-07-19 20:13 . 2011-07-19 20:13 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-07-19 20:13 . 2011-07-19 20:13 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-07-19 20:13 . 2011-07-19 20:13 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-07-19 20:13 . 2011-07-19 20:13 222208 ----a-w- c:\windows\system32\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-07-19 20:13 . 2011-07-19 20:13 160256 ----a-w- c:\windows\system32\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-07-19 20:13 . 2011-07-19 20:13 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-07-19 20:13 . 2011-07-19 20:13 1492992 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-07-19 20:13 . 2011-07-19 20:13 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-07-19 20:13 . 2011-07-19 20:13 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 12288 ----a-w- c:\windows\system32\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-07-19 20:13 . 2011-07-19 20:13 114176 ----a-w- c:\windows\system32\admparse.dll
2011-07-19 20:13 . 2011-07-19 20:13 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-07-19 20:13 . 2011-07-19 20:13 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-07-19 20:13 . 2011-07-19 20:13 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-07-19 20:12 . 2011-07-19 20:12 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-07-19 20:12 . 2011-07-19 20:12 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-07-19 20:12 . 2011-07-19 20:12 4068864 ----a-w- c:\windows\system32\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2011-07-19 20:12 . 2011-07-19 20:12 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-07-19 20:12 . 2011-07-19 20:12 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 229888 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 206848 ----a-w- c:\windows\system32\mfps.dll
2011-07-19 20:12 . 2011-07-19 20:12 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2011-07-19 20:12 . 2011-07-19 20:12 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-07-19 20:12 . 2011-07-19 20:12 1495040 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2011-07-19 20:12 . 2011-07-19 20:12 144384 ----a-w- c:\windows\system32\cdd.dll
2011-07-19 20:12 . 2011-07-19 20:12 135168 ----a-w- c:\windows\SysWow64\XpsRasterService.dll
2011-07-19 20:12 . 2011-07-19 20:12 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2011-07-19 20:12 . 2011-07-19 20:12 1133568 ----a-w- c:\windows\system32\FntCache.dll
2011-07-19 20:12 . 2011-07-19 20:12 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-07-16 04:32 . 2011-08-11 06:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-11 02:56 . 2011-07-19 07:05 3134464 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_22.19.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-23 04:50 . 2011-08-22 09:40 43548 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-22 17:38 34172 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-07-18 23:16 . 2011-07-19 20:22 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-07-18 23:16 . 2011-08-22 10:46 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-07-18 23:16 . 2011-08-22 10:46 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-07-18 23:16 . 2011-07-19 20:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-22 10:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-19 20:22 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2011-08-22 10:42 88688 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-07-18 15:59 . 2011-08-22 17:38 7698 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2574094893-3751011069-2714102146-1001_UserData.bin
+ 2011-08-22 18:38 . 2011-08-22 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-21 22:19 . 2011-08-21 22:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-22 18:38 . 2011-08-22 18:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-08-21 22:19 . 2011-08-21 22:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-18 20:22 . 2011-08-22 18:30 254238 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:01 . 2011-08-21 22:18 390348 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-22 18:37 390348 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-08-21 20:44 . 2011-08-21 22:18 581468 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2574094893-3751011069-2714102146-1001-12288.dat
+ 2011-08-21 20:44 . 2011-08-22 18:37 581468 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2574094893-3751011069-2714102146-1001-12288.dat
- 2009-07-14 02:34 . 2011-08-21 17:35 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-08-22 12:23 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"ICQ"="c:\program files (x86)\ICQ7.5\ICQ.exe" [2011-08-01 124480]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NBAgent"="c:\program files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" [2010-03-09 1086760]
"TOSDCR"="c:\program files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-05-01 2454840]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-23 259440]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Zvuk pre obrazovky;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-05 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-05-10 836016]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001Core.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2574094893-3751011069-2714102146-1001UA.job
- c:\users\Elenka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 20:21]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-11 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-11 414744]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-05 709976]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2010-04-19 136136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [BU]
"KONICA MINOLTA PagePro 1400W STD"="c:\windows\system32\MSTMON_Y.EXE" [2006-04-11 269312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\WI3C8A~1\Datamngr\x64\datamngr.dll c:\progra~2\WI3C8A~1\Datamngr\x64\IEBHO.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.searchqu.com/406
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 195.34.133.21 212.186.211.21
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
.
**************************************************************************
.
Completion time: 2011-08-22 20:41:52 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-22 18:41
ComboFix2.txt 2011-08-22 17:40
ComboFix3.txt 2011-08-22 12:13
ComboFix4.txt 2011-08-21 22:23
.
Pre-Run: 120 485 814 272 bytes free
Post-Run: 120 427 827 200 bytes free
.
- - End Of File - - 9A27185B1648EF92AC8BFB3E7A12CDF9

[Rudy]

Smazáno, log již vypadá čistý. Nastala nějaká změna?

[method]

Skusal som preinstalovat eset, ale po preinstalovani je stale nefunkcny. Spomalenie pocitaca som nezaregistroval ani predtym.

[Rudy]

FB virus je už pryč (alespoň z logu není patrný). Zkuste Eset nejprve odinstalovat pomocí uninstalleru: http://download.eset.com/special/ESETUninstaller.exe a pak proveďte novou instalaci.

[method]

Beriem spat, len mi nezbehla spravne instalacia. Na druhy pokus sa podarilo. Kedze aj predtym isiel pocitac relativne normalne, nevidim ziadnu zmenu. Ale uz ani MBAM nehlasi ziadne pokusy o nechcenu komunikaciu a aj ESET je uz nainstalovany.
Dakujem za pomoc a profesionalny pristup (toho sa casto nedockam od ludi, ktori su za to plateni ).

[Rudy]

Rádo se stalo!