Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

FB-vir, prosím o pomoc

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

FB-vir, prosím o pomoc

#1 Příspěvek od callenthe »

Logfile of random's system information tool 1.09 (written by random/random)
Run by Adam at 2011-08-29 15:11:47
Microsoft Windows 7 Ultimate
System drive C: has 347 GB (84%) free of 412 GB
Total RAM: 3071 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:11:56, on 29.8.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\update.tray-2-0\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Adam\Downloads\RSIT.exe
C:\Program Files\trend micro\Adam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [2545534.exe] "C:\Windows\Temp\2545534.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-2-0\svchost.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Adam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe (file missing)
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 7327 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default

prefs.js - "browser.startup.homepage" - "www.google.cz"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7, gb@toolbar:1.0.0, {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5, {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b, {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2, {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1, engine@conduit.com:3.3.3.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
NPOFF12.DLL
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\extensions\
DTToolbar@toolbarnet.com
engine@conduit.com
gb@toolbar
{872b5b88-9db5-4310-bdd0-ac189557e5f5}
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\searchplugins\
daemon-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [2009-10-09 1699328]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-04-06 102400]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"wxpdrv"=C:\Windows\services32.exe [2011-08-20 1182208]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe rezerv []
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe rezerv []
"l1rezerv.exe"=C:\Windows\l1rezerv.exe []
"2545534.exe"=C:\Windows\Temp\2545534.exe []
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice []
"tray_ico"= []
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"tray_ico0"=C:\Windows\update.tray-2-0\svchost.exe [2011-08-20 1182208]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-08-02 4910912]

C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutorun"=0
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"msacm.msaudio1"=msaud32.acm

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-29 15:11:48 ----D---- C:\Program Files\trend micro
2011-08-29 15:11:47 ----D---- C:\rsit
2011-08-29 10:49:00 ----HD---- C:\Windows\update.tray-2-0-lnk
2011-08-29 10:49:00 ----HD---- C:\Windows\update.tray-2-0
2011-08-29 10:46:55 ----SHD---- C:\Config.Msi
2011-08-29 10:34:20 ----D---- C:\Users\Adam\AppData\Roaming\AVG
2011-08-29 10:33:19 ----AD---- C:\ProgramData\TEMP
2011-08-29 07:31:13 ----D---- C:\Program Files\AVG
2011-08-28 20:22:30 ----HD---- C:\Windows\update.tray-12-0-lnk
2011-08-28 20:22:30 ----HD---- C:\Windows\update.tray-12-0
2011-08-28 20:13:36 ----HD---- C:\ProgramData\Common Files
2011-08-28 20:13:31 ----D---- C:\ProgramData\MFAData
2011-08-28 19:27:02 ----HD---- C:\Windows\update.tray-7-0-lnk
2011-08-28 19:27:02 ----HD---- C:\Windows\update.tray-7-0
2011-08-28 19:24:44 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-08-28 19:24:43 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-08-28 19:24:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-08-28 19:24:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-08-28 19:24:36 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-08-28 19:24:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-08-28 19:24:23 ----A---- C:\Windows\avastSS.scr
2011-08-28 19:24:22 ----A---- C:\Windows\system32\aswBoot.exe
2011-08-28 16:07:03 ----D---- C:\Users\Adam\AppData\Roaming\vlc
2011-08-27 17:31:48 ----A---- C:\Windows\system32\tzres.dll
2011-08-27 17:27:06 ----D---- C:\Windows\Sun
2011-08-27 17:26:35 ----HD---- C:\Windows\update.8.1
2011-08-20 19:39:42 ----D---- C:\Program Files\CCleaner
2011-08-20 19:38:35 ----D---- C:\Program Files\Google
2011-08-20 19:29:28 ----D---- C:\Windows\ufa
2011-08-20 19:29:28 ----D---- C:\Windows\rpcminer
2011-08-20 19:29:28 ----D---- C:\Windows\phoenix
2011-08-20 19:28:40 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-20 19:28:27 ----A---- C:\Windows\unrar.exe
2011-08-20 19:28:17 ----HD---- C:\Windows\update.5.0
2011-08-20 19:27:18 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-20 19:26:11 ----HD---- C:\Windows\update.2
2011-08-20 19:25:35 ----HD---- C:\Windows\update.7.1
2011-08-20 19:25:21 ----A---- C:\Windows\iplist.txt
2011-08-20 19:24:29 ----A---- C:\Windows\front_ip_list.txt
2011-08-20 19:24:23 ----D---- C:\Windows\av_ico
2011-08-20 19:22:55 ----HD---- C:\Windows\update.1
2011-08-20 19:22:40 ----HD---- C:\Windows\update.tray-9-0-lnk
2011-08-20 19:22:40 ----HD---- C:\Windows\update.tray-9-0
2011-08-20 19:22:40 ----HD---- C:\Windows\update.tray-14-0-lnk
2011-08-20 19:22:40 ----HD---- C:\Windows\update.tray-14-0
2011-08-20 11:20:44 ----A---- C:\Windows\winlog-ids.txt
2011-08-20 11:20:44 ----A---- C:\Windows\winlog-dirs.txt
2011-08-20 11:20:40 ----A---- C:\Windows\services32.exe
2011-08-10 21:56:24 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 21:56:24 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\url.dll
2011-08-10 21:56:21 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 21:56:20 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 19:29:43 ----D---- C:\Windows\system32\URTTEMP
2011-08-10 16:19:27 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 16:19:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 16:19:25 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-08-10 16:19:18 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 16:19:17 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 16:19:12 ----A---- C:\Windows\system32\odbcjt32.dll
2011-08-10 16:19:12 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 00:09:09 ----D---- C:\ProgramData\Electronic Arts
2011-08-10 00:09:09 ----D---- C:\ProgramData\EA Core
2011-08-05 14:29:49 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-08-05 09:04:57 ----D---- C:\Users\Adam\AppData\Roaming\OpenCandy
2011-08-05 09:04:38 ----D---- C:\Program Files\DAEMON Tools Lite

======List of files/folders modified in the last 1 month======

2011-08-29 15:11:56 ----D---- C:\Windows\Prefetch
2011-08-29 15:11:50 ----D---- C:\Windows\Temp
2011-08-29 15:11:48 ----RD---- C:\Program Files
2011-08-29 15:07:02 ----D---- C:\Windows\system32\config
2011-08-29 11:43:32 ----D---- C:\Windows
2011-08-29 11:24:54 ----D---- C:\Windows\system32\drivers\etc
2011-08-29 11:20:32 ----SHD---- C:\Windows\Installer
2011-08-29 11:20:24 ----D---- C:\Windows\system32\drivers
2011-08-29 11:20:12 ----HD---- C:\ProgramData
2011-08-29 11:01:54 ----D---- C:\Windows\SoftwareDistribution
2011-08-29 10:58:05 ----SHD---- C:\System Volume Information
2011-08-29 10:47:37 ----D---- C:\Windows\system32\DriverStore
2011-08-29 10:47:37 ----D---- C:\Windows\system32\catroot
2011-08-29 10:47:37 ----D---- C:\Windows\inf
2011-08-29 10:47:36 ----D---- C:\Windows\system32\catroot2
2011-08-29 10:36:18 ----D---- C:\Windows\Downloaded Program Files
2011-08-29 10:33:20 ----D---- C:\Windows\system32\Tasks
2011-08-29 10:28:06 ----D---- C:\Windows\system32\LogFiles
2011-08-29 10:15:34 ----D---- C:\Windows\AppCompat
2011-08-28 20:35:14 ----D---- C:\Windows\system32\wdi
2011-08-28 19:24:22 ----D---- C:\Windows\System32
2011-08-28 16:40:26 ----D---- C:\ProgramData\MAGIX
2011-08-28 16:39:53 ----D---- C:\Program Files\Common Files
2011-08-28 16:04:44 ----D---- C:\Users\Adam\AppData\Roaming\Skype
2011-08-27 18:08:31 ----D---- C:\Windows\winsxs
2011-08-27 18:08:26 ----D---- C:\Windows\system32\cs-CZ
2011-08-20 19:41:27 ----D---- C:\Users\Adam\AppData\Roaming\DAEMON Tools Lite
2011-08-20 19:41:25 ----D---- C:\Users\Adam\AppData\Roaming\uTorrent
2011-08-20 19:40:40 ----D---- C:\Windows\Logs
2011-08-20 19:40:40 ----D---- C:\Windows\debug
2011-08-20 19:38:39 ----D---- C:\Windows\Tasks
2011-08-20 12:07:21 ----D---- C:\ProgramData\Skype
2011-08-18 19:48:49 ----D---- C:\Program Files\Mozilla Firefox
2011-08-18 17:44:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-13 14:05:13 ----D---- C:\Windows\Microsoft.NET
2011-08-13 14:05:12 ----RSD---- C:\Windows\assembly
2011-08-11 09:07:35 ----D---- C:\Windows\system32\migration
2011-08-11 09:07:35 ----D---- C:\Program Files\Internet Explorer
2011-08-10 21:57:32 ----D---- C:\ProgramData\Microsoft Help
2011-08-10 21:55:12 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 19:30:23 ----D---- C:\Windows\Registration
2011-08-08 15:52:04 ----D---- C:\World of Warcraft
2011-08-05 09:04:57 ----D---- C:\Program Files\DAEMON Tools Toolbar

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\Windows\System32\drivers\sfhlp02.sys [2005-02-23 6656]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6x.sys [2010-07-12 54112]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys [2011-03-01 34896]
R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys [2011-04-05 297168]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-05 232512]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 137144]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 95384]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-07-14 117248]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-03-09 107024]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-11-27 58368]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]
S0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\Windows\System32\drivers\sfdrv01.sys [2005-03-03 48640]
S0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\Windows\System32\drivers\sfsync02.sys [2004-12-03 20544]
S1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
S1 MpKsl0806cd50;MpKsl0806cd50; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl0806cd50.sys []
S1 MpKsl0931948f;MpKsl0931948f; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A56D38E8-4C93-4540-BAD4-630275590083}\MpKsl0931948f.sys []
S1 MpKsl10e102a9;MpKsl10e102a9; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5956773A-4483-44A0-A4C1-57639D78F60D}\MpKsl10e102a9.sys []
S1 MpKsl14536795;MpKsl14536795; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{47F70567-5DD9-4868-8FF9-CFCEE2786D61}\MpKsl14536795.sys []
S1 MpKsl18ef9d6f;MpKsl18ef9d6f; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl18ef9d6f.sys []
S1 MpKsl1b870b40;MpKsl1b870b40; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{371644D2-7FC2-4BE8-900F-064B3687126B}\MpKsl1b870b40.sys []
S1 MpKsl29c7c2e3;MpKsl29c7c2e3; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl29c7c2e3.sys []
S1 MpKsl29e03d80;MpKsl29e03d80; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl29e03d80.sys []
S1 MpKsl31b33eb1;MpKsl31b33eb1; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl31b33eb1.sys []
S1 MpKsl3d8991d4;MpKsl3d8991d4; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5A3782A3-D443-4290-AB56-0B3CE1A686ED}\MpKsl3d8991d4.sys []
S1 MpKsl3fb44388;MpKsl3fb44388; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E112BE0-C4FE-499B-AFDC-C029808D32BB}\MpKsl3fb44388.sys []
S1 MpKsl5478fedb;MpKsl5478fedb; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CDA79F8C-54E6-4EA6-8AD4-E68B95FA821E}\MpKsl5478fedb.sys []
S1 MpKsl62d666af;MpKsl62d666af; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl62d666af.sys []
S1 MpKsl6aaf7b58;MpKsl6aaf7b58; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A03C927B-B904-4CEA-B798-CB7B40AE226A}\MpKsl6aaf7b58.sys []
S1 MpKsl6ad9310d;MpKsl6ad9310d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2283F489-A3F1-45A6-ABE5-65A008FFE07A}\MpKsl6ad9310d.sys []
S1 MpKsl7634feb8;MpKsl7634feb8; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6ED08C80-08C5-4D6E-8081-6943022E41E3}\MpKsl7634feb8.sys []
S1 MpKslb66569a3;MpKslb66569a3; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3C713A99-6CF8-423E-8B29-4425CBAD0B8C}\MpKslb66569a3.sys []
S1 MpKslbd144001;MpKslbd144001; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A10B5403-D24A-439D-BDA0-A4BD35F94D45}\MpKslbd144001.sys []
S1 MpKsleba7dac5;MpKsleba7dac5; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{79DAE702-9964-4A06-A12D-5A4F4ADC12A0}\MpKsleba7dac5.sys []
S1 MpKslee5f2736;MpKslee5f2736; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{BC7597F4-C215-44E5-BFDD-4F7CB089EBFD}\MpKslee5f2736.sys []
S1 MpKslf927a876;MpKslf927a876; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8E3CB110-C33B-427D-839C-8D0F95EFB472}\MpKslf927a876.sys []
S1 prodrv03;Star Force copy protection driver v3; C:\Windows\System32\drivers\prodrv03.sys [2011-02-11 115968]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-14 134480]
S3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
S3 AVGIDSShim;AVGIDSShim; C:\Windows\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 21968]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 FLASHSYS;FLASHSYS; \??\C:\Program Files\MSI\Live Update 4\LU4\FLASHSYS.sys [2007-12-14 9216]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-04-07 172032]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-28 355840]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe srv []
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-20 136176]
S2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe srv []
S2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe srv []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-06-10 31064]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe []
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-20 136176]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-06 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Danstahr
Přítel fóra
Přítel fóra
Příspěvky: 1069
Registrován: 28 říj 2006 20:23
Bydliště: Londýn
Kontaktovat uživatele:
Kontaktovat uživatele Danstahr

Re: FB-vir, prosím o pomoc

#2 Příspěvek od Danstahr »

Dobré odpoledne :welcome:,

:arrow: Stáhněte MBAM a vložte sem jeho log podle návodu zde, při výběru skenu zvolte Úplný sken.

Zatím nic nemažte, MBAM může mít falešné detekce!
Koupím trochu času, cenu respektuji.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#3 Příspěvek od callenthe »

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 5214

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

29.8.2011 16:58:45
mbam-log-2011-08-29 (16-58-40).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 253758
Uplynulý čas: 23 minut, 20 sekund

Infikované procesy v paměti: 1
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
c:\Windows\update.tray-2-0\svchost.exe (Trojan.Agent) -> 2940 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Agent) -> Value: tray_ico0 -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Windows\update.tray-2-0\svchost.exe (Trojan.Agent) -> No action taken.
Nahoru
Uživatelský avatar
Danstahr
Přítel fóra
Přítel fóra
Příspěvky: 1069
Registrován: 28 říj 2006 20:23
Bydliště: Londýn
Kontaktovat uživatele:
Kontaktovat uživatele Danstahr

Re: FB-vir, prosím o pomoc

#4 Příspěvek od Danstahr »

:arrow: Nalezenou infekci nechte MBAMem smazat.

:!: Pozor! Tato utilita má velkou schopnost mazat a její použití je určeno výhradně členům týmu tohoto fóra. Svévolné použití může vést ke zboření a reinstalaci systému :!:

:arrow: Stáhněte ComboFix a uložte jej na Plochu.

:arrow: Vypněte všechny rezidentní štíty antivirů a všechny programy běžící na pozadí.
:arrow: Spusťte ComboFix s administrátorským oprávněním.
:arrow: Potvrďte licenční podmínky a případně i instalaci konzoly pro zotavení
:arrow: Během skenu nechte počítač naprosto v klidu.
:arrow: Sken trvá zhruba 15 minut, ale doba se může lišit v závislosti na stavu systému
:arrow: Po dokončení skenu se zobrazí log (pokud by se neotevřel, lze jej nalézt na systémovém disku jako ComboFix.txt), obsah logu vložte sem
:arrow: :!: ComboFixu si do dalšího pokynu nevšímejte :!:
Koupím trochu času, cenu respektuji.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#5 Příspěvek od callenthe »

ComboFix 11-08-29.01 - Adam 29.08.2011 17:10:49.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3071.2050 [GMT 2:00]
Spuštěný z: c:\users\Adam\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\IsUn0405.exe
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\services32.exe
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.1\svchost.exe
c:\windows\update.2
c:\windows\update.5.0
c:\windows\update.5.0\svchost.exe
c:\windows\update.7.1
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ddservice
-------\Service_srvbtcclient
-------\Service_srviecheck
-------\Service_srvsysdriver32
-------\Service_wxpdrivers
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 15:15 . 2011-08-29 15:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 14:34 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-29 14:34 . 2011-08-29 14:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-29 14:34 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-29 13:11 . 2011-08-29 13:11 -------- d-----w- c:\program files\trend micro
2011-08-29 13:11 . 2011-08-29 13:11 -------- d-----w- C:\rsit
2011-08-29 09:20 . 2011-08-29 09:20 -------- d-----w- c:\users\Adam\AppData\Local\ESET
2011-08-29 08:49 . 2011-08-29 15:02 -------- d--h--w- c:\windows\update.tray-2-0
2011-08-29 08:49 . 2011-08-29 08:49 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-08-29 08:34 . 2011-08-29 09:00 -------- d-----w- c:\users\Adam\AppData\Roaming\AVG
2011-08-29 05:31 . 2011-08-29 08:33 -------- d-----w- c:\program files\AVG
2011-08-28 18:22 . 2011-08-29 15:05 -------- d--h--w- c:\windows\update.tray-12-0-lnk
2011-08-28 18:22 . 2011-08-29 08:15 -------- d--h--w- c:\windows\update.tray-12-0
2011-08-28 18:13 . 2011-08-28 18:13 -------- d--h--w- c:\programdata\Common Files
2011-08-28 18:13 . 2011-08-29 08:30 -------- d-----w- c:\programdata\MFAData
2011-08-28 17:27 . 2011-08-29 08:15 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-28 17:27 . 2011-08-28 17:27 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-28 17:24 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-28 17:24 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-28 17:24 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-28 17:24 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-28 17:24 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-28 17:24 . 2011-07-04 11:32 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-28 17:24 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-28 17:24 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-28 14:07 . 2011-08-29 13:54 -------- d-----w- c:\users\Adam\AppData\Roaming\vlc
2011-08-27 15:32 . 2011-08-16 06:48 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94733663-7751-4C40-9D1F-420A5434478F}\mpengine.dll
2011-08-27 15:31 . 2011-07-09 04:30 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:27 . 2011-08-27 15:27 -------- d-----w- c:\windows\Sun
2011-08-27 15:26 . 2011-08-27 15:26 -------- d--h--w- c:\windows\update.8.1
2011-08-20 17:39 . 2011-08-20 17:39 -------- d-----w- c:\program files\CCleaner
2011-08-20 17:38 . 2011-08-20 18:45 -------- d-----w- c:\users\Adam\AppData\Local\Google
2011-08-20 17:38 . 2011-08-20 17:39 -------- d-----w- c:\program files\Google
2011-08-20 17:29 . 2011-08-29 12:44 -------- d-----w- c:\windows\ufa
2011-08-20 17:28 . 2011-08-29 12:44 246272 ----a-w- c:\windows\unrar.exe
2011-08-20 17:24 . 2011-08-29 08:50 -------- d-----w- c:\windows\av_ico
2011-08-20 17:22 . 2011-08-29 08:15 -------- d--h--w- c:\windows\update.tray-9-0
2011-08-20 17:22 . 2011-08-29 08:15 -------- d--h--w- c:\windows\update.tray-14-0
2011-08-20 17:22 . 2011-08-20 17:22 -------- d--h--w- c:\windows\update.tray-9-0-lnk
2011-08-20 17:22 . 2011-08-20 17:22 -------- d--h--w- c:\windows\update.tray-14-0-lnk
2011-08-20 09:23 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8989A249-1614-45E2-85EC-A38C105D1400}\mpengine.dll
2011-08-11 07:20 . 2010-11-30 09:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0896B457-58F4-40AA-ABB1-C194339E7386}\gapaengine.dll
2011-08-11 07:09 . 2011-08-11 17:11 -------- d-----w- c:\users\Adam\AppData\Local\GameSpy
2011-08-11 07:09 . 2011-08-11 16:24 -------- d-----w- c:\users\Adam\AppData\Local\ApplicationHistory
2011-08-10 17:29 . 2011-08-10 17:29 -------- d-----w- c:\windows\system32\URTTEMP
2011-08-09 22:10 . 2011-07-13 03:39 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-08-09 22:09 . 2011-08-09 22:09 -------- d-----w- c:\programdata\Electronic Arts
2011-08-09 22:09 . 2011-08-09 22:09 -------- d-----w- c:\programdata\EA Core
2011-08-05 12:29 . 2011-08-05 12:29 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-08-05 07:04 . 2011-08-05 12:22 -------- d-----w- c:\users\Adam\AppData\Local\OpenCandy
2011-08-05 07:04 . 2011-08-05 07:04 -------- d-----w- c:\users\Adam\AppData\Roaming\OpenCandy
2011-08-05 07:04 . 2011-08-05 12:29 -------- d-----w- c:\program files\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 06:54 . 2011-05-19 05:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-12 02:44 . 2011-03-01 15:27 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-10 17:28 . 2010-11-11 12:54 22328 ----a-w- c:\users\Adam\AppData\Roaming\PnkBstrK.sys
2011-06-11 02:37 . 2011-07-13 11:50 2332672 ----a-w- c:\windows\system32\win32k.sys
2011-08-18 17:48 . 2011-04-29 18:48 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-10-09 1699328]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
R1 MpKsl0806cd50;MpKsl0806cd50;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl0806cd50.sys [x]
R1 MpKsl0931948f;MpKsl0931948f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A56D38E8-4C93-4540-BAD4-630275590083}\MpKsl0931948f.sys [x]
R1 MpKsl10e102a9;MpKsl10e102a9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5956773A-4483-44A0-A4C1-57639D78F60D}\MpKsl10e102a9.sys [x]
R1 MpKsl14536795;MpKsl14536795;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{47F70567-5DD9-4868-8FF9-CFCEE2786D61}\MpKsl14536795.sys [x]
R1 MpKsl18ef9d6f;MpKsl18ef9d6f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl18ef9d6f.sys [x]
R1 MpKsl1b870b40;MpKsl1b870b40;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{371644D2-7FC2-4BE8-900F-064B3687126B}\MpKsl1b870b40.sys [x]
R1 MpKsl29c7c2e3;MpKsl29c7c2e3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl29c7c2e3.sys [x]
R1 MpKsl29e03d80;MpKsl29e03d80;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl29e03d80.sys [x]
R1 MpKsl31b33eb1;MpKsl31b33eb1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl31b33eb1.sys [x]
R1 MpKsl3d8991d4;MpKsl3d8991d4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5A3782A3-D443-4290-AB56-0B3CE1A686ED}\MpKsl3d8991d4.sys [x]
R1 MpKsl3fb44388;MpKsl3fb44388;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E112BE0-C4FE-499B-AFDC-C029808D32BB}\MpKsl3fb44388.sys [x]
R1 MpKsl5478fedb;MpKsl5478fedb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDA79F8C-54E6-4EA6-8AD4-E68B95FA821E}\MpKsl5478fedb.sys [x]
R1 MpKsl62d666af;MpKsl62d666af;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl62d666af.sys [x]
R1 MpKsl6aaf7b58;MpKsl6aaf7b58;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A03C927B-B904-4CEA-B798-CB7B40AE226A}\MpKsl6aaf7b58.sys [x]
R1 MpKsl6ad9310d;MpKsl6ad9310d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2283F489-A3F1-45A6-ABE5-65A008FFE07A}\MpKsl6ad9310d.sys [x]
R1 MpKsl7634feb8;MpKsl7634feb8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6ED08C80-08C5-4D6E-8081-6943022E41E3}\MpKsl7634feb8.sys [x]
R1 MpKslb66569a3;MpKslb66569a3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3C713A99-6CF8-423E-8B29-4425CBAD0B8C}\MpKslb66569a3.sys [x]
R1 MpKslbd144001;MpKslbd144001;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A10B5403-D24A-439D-BDA0-A4BD35F94D45}\MpKslbd144001.sys [x]
R1 MpKsleba7dac5;MpKsleba7dac5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{79DAE702-9964-4A06-A12D-5A4F4ADC12A0}\MpKsleba7dac5.sys [x]
R1 MpKslee5f2736;MpKslee5f2736;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BC7597F4-C215-44E5-BFDD-4F7CB089EBFD}\MpKslee5f2736.sys [x]
R1 MpKslf927a876;MpKslf927a876;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8E3CB110-C33B-427D-839C-8D0F95EFB472}\MpKslf927a876.sys [x]
R1 prodrv03;Star Force copy protection driver v3;c:\windows\System32\drivers\prodrv03.sys [2011-02-11 115968]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-20 136176]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 21968]
R3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FLASHSYS.sys [2007-12-14 9216]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-20 136176]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-06 1343400]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2010-07-12 54112]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-04-04 297168]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-05 232512]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-07 172032]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-12-21 137144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 95384]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-27 58368]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-20 17:38]
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-20 17:38]
.
.
------- Doplňkový sken -------
.
uStart Page = my.daemon-search.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Adam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{E714E565-6FE6-47BD-BF74-4C9606F52422}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-wxpdrv - c:\windows\services32.exe
HKLM-Run-l1rezerv.exe - c:\windows\l1rezerv.exe
HKLM-Run-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico1 - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
SafeBoot-MsMpSvc
AddRemove-Flying Heroes - c:\program files\Take2\Flying Heroes\Uninst.isu
AddRemove-Strojčasu - c:\windows\IsUn0405.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3948431126-3677543672-433762227-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:8c,cc,17,71,ca,f8,3c,de,82,00,df,ce,4d,14,e6,1c,f6,58,88,4f,22,c1,e9,
b3,50,f5,4c,e9,f7,f6,14,2f,f1,a5,60,7e,f1,c2,26,32,9b,66,0b,43,02,23,18,03,\
"??"=hex:a6,46,69,a7,e8,66,99,ab,66,8f,76,49,28,ba,e6,66
.
[HKEY_USERS\S-1-5-21-3948431126-3677543672-433762227-1000\Software\SecuROM\License information*]
"datasecu"=hex:75,8b,5e,4c,3c,cc,39,88,50,cf,64,29,7f,66,07,df,bb,aa,c5,d9,1c,
c9,80,ff,8a,4b,4a,b1,e2,fc,4a,c2,c7,a4,24,4b,7e,19,e5,1d,6b,44,bf,0b,d2,9e,\
"rkeysecu"=hex:92,e1,39,15,c6,12,81,ef,67,eb,0a,5a,53,de,4d,7b
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 17:19:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 15:19
.
Před spuštěním: Volných bajtů: 361 944 641 536
Po spuštění: Volných bajtů: 361 768 087 552
.
- - End Of File - - 29A611B7BFE7D5DB63F0899F48CA65E3
Nahoru
Uživatelský avatar
Danstahr
Přítel fóra
Přítel fóra
Příspěvky: 1069
Registrován: 28 říj 2006 20:23
Bydliště: Londýn
Kontaktovat uživatele:
Kontaktovat uživatele Danstahr

Re: FB-vir, prosím o pomoc

#6 Příspěvek od Danstahr »

:arrow: Otevřete Poznámkový blok, vložte do něj následující text a uložte soubor na Plochu jako CFScript.txt. Pak soubor přetáhněte na ikonu ComboFixu (viz obrázek). Po restartu se otevře log, ten sem vložte.

Obrázek

Kód: Vybrat vše

killall::

file::
c:\windows\unrar.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

folder::
c:\windows\update.tray-2-0
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-12-0
c:\windows\update.tray-7-0
c:\windows\update.8.1
c:\windows\update.tray-7-0-lnk
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-9-0
c:\windows\update.tray-14-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-14-0-lnk

registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=-
"GrooveMonitor"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
"SunJavaUpdateSched"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000

driver::
gupdate
gupdatem

reboot::
Koupím trochu času, cenu respektuji.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#7 Příspěvek od callenthe »

ComboFix 11-08-29.03 - Adam 30.08.2011 7:08.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3071.1976 [GMT 2:00]
Spuštěný z: c:\users\Adam\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Adam\Desktop\CFScript.txt.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\av_ico\ico_Essentials_start.ico
c:\windows\av_ico\ico_mcafee_start.ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.8.1
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-12-0-lnk\svchost.exe
c:\windows\update.tray-12-0
c:\windows\update.tray-14-0-lnk
c:\windows\update.tray-14-0-lnk\svchost.exe
c:\windows\update.tray-14-0
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0-lnk\svchost.exe
c:\windows\update.tray-2-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0-lnk\svchost.exe
c:\windows\update.tray-7-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-9-0-lnk\svchost.exe
c:\windows\update.tray-9-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-30 )))))))))))))))))))))))))))))))
.
.
2011-08-30 05:12 . 2011-08-30 05:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 14:34 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-29 14:34 . 2011-08-29 14:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-29 14:34 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-29 13:11 . 2011-08-29 13:11 -------- d-----w- c:\program files\trend micro
2011-08-29 13:11 . 2011-08-29 13:11 -------- d-----w- C:\rsit
2011-08-29 09:20 . 2011-08-29 09:20 -------- d-----w- c:\users\Adam\AppData\Local\ESET
2011-08-29 08:34 . 2011-08-29 09:00 -------- d-----w- c:\users\Adam\AppData\Roaming\AVG
2011-08-29 05:31 . 2011-08-29 08:33 -------- d-----w- c:\program files\AVG
2011-08-28 18:13 . 2011-08-28 18:13 -------- d--h--w- c:\programdata\Common Files
2011-08-28 18:13 . 2011-08-29 08:30 -------- d-----w- c:\programdata\MFAData
2011-08-28 17:24 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-28 17:24 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-28 17:24 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-28 17:24 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-28 17:24 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-28 17:24 . 2011-07-04 11:32 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-28 17:24 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-28 17:24 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-28 14:07 . 2011-08-29 13:54 -------- d-----w- c:\users\Adam\AppData\Roaming\vlc
2011-08-27 15:32 . 2011-08-16 06:48 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94733663-7751-4C40-9D1F-420A5434478F}\mpengine.dll
2011-08-27 15:31 . 2011-07-09 04:30 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:27 . 2011-08-27 15:27 -------- d-----w- c:\windows\Sun
2011-08-20 17:39 . 2011-08-20 17:39 -------- d-----w- c:\program files\CCleaner
2011-08-20 17:38 . 2011-08-20 18:45 -------- d-----w- c:\users\Adam\AppData\Local\Google
2011-08-20 17:38 . 2011-08-20 17:39 -------- d-----w- c:\program files\Google
2011-08-20 09:23 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8989A249-1614-45E2-85EC-A38C105D1400}\mpengine.dll
2011-08-11 07:20 . 2010-11-30 09:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0896B457-58F4-40AA-ABB1-C194339E7386}\gapaengine.dll
2011-08-11 07:09 . 2011-08-11 17:11 -------- d-----w- c:\users\Adam\AppData\Local\GameSpy
2011-08-11 07:09 . 2011-08-11 16:24 -------- d-----w- c:\users\Adam\AppData\Local\ApplicationHistory
2011-08-10 17:29 . 2011-08-10 17:29 -------- d-----w- c:\windows\system32\URTTEMP
2011-08-09 22:10 . 2011-07-13 03:39 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-08-09 22:09 . 2011-08-09 22:09 -------- d-----w- c:\programdata\Electronic Arts
2011-08-09 22:09 . 2011-08-09 22:09 -------- d-----w- c:\programdata\EA Core
2011-08-05 12:29 . 2011-08-05 12:29 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-08-05 07:04 . 2011-08-05 12:22 -------- d-----w- c:\users\Adam\AppData\Local\OpenCandy
2011-08-05 07:04 . 2011-08-05 07:04 -------- d-----w- c:\users\Adam\AppData\Roaming\OpenCandy
2011-08-05 07:04 . 2011-08-05 12:29 -------- d-----w- c:\program files\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 06:54 . 2011-05-19 05:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-12 02:44 . 2011-03-01 15:27 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-10 17:28 . 2010-11-11 12:54 22328 ----a-w- c:\users\Adam\AppData\Roaming\PnkBstrK.sys
2011-06-11 02:37 . 2011-07-13 11:50 2332672 ----a-w- c:\windows\system32\win32k.sys
2011-08-18 17:48 . 2011-04-29 18:48 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-10-09 1699328]
.
c:\users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
R1 MpKsl0806cd50;MpKsl0806cd50;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl0806cd50.sys [x]
R1 MpKsl0931948f;MpKsl0931948f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A56D38E8-4C93-4540-BAD4-630275590083}\MpKsl0931948f.sys [x]
R1 MpKsl10e102a9;MpKsl10e102a9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5956773A-4483-44A0-A4C1-57639D78F60D}\MpKsl10e102a9.sys [x]
R1 MpKsl14536795;MpKsl14536795;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{47F70567-5DD9-4868-8FF9-CFCEE2786D61}\MpKsl14536795.sys [x]
R1 MpKsl18ef9d6f;MpKsl18ef9d6f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl18ef9d6f.sys [x]
R1 MpKsl1b870b40;MpKsl1b870b40;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{371644D2-7FC2-4BE8-900F-064B3687126B}\MpKsl1b870b40.sys [x]
R1 MpKsl29c7c2e3;MpKsl29c7c2e3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl29c7c2e3.sys [x]
R1 MpKsl29e03d80;MpKsl29e03d80;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl29e03d80.sys [x]
R1 MpKsl31b33eb1;MpKsl31b33eb1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl31b33eb1.sys [x]
R1 MpKsl3d8991d4;MpKsl3d8991d4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5A3782A3-D443-4290-AB56-0B3CE1A686ED}\MpKsl3d8991d4.sys [x]
R1 MpKsl3fb44388;MpKsl3fb44388;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E112BE0-C4FE-499B-AFDC-C029808D32BB}\MpKsl3fb44388.sys [x]
R1 MpKsl5478fedb;MpKsl5478fedb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDA79F8C-54E6-4EA6-8AD4-E68B95FA821E}\MpKsl5478fedb.sys [x]
R1 MpKsl62d666af;MpKsl62d666af;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl62d666af.sys [x]
R1 MpKsl6aaf7b58;MpKsl6aaf7b58;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A03C927B-B904-4CEA-B798-CB7B40AE226A}\MpKsl6aaf7b58.sys [x]
R1 MpKsl6ad9310d;MpKsl6ad9310d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2283F489-A3F1-45A6-ABE5-65A008FFE07A}\MpKsl6ad9310d.sys [x]
R1 MpKsl7634feb8;MpKsl7634feb8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6ED08C80-08C5-4D6E-8081-6943022E41E3}\MpKsl7634feb8.sys [x]
R1 MpKslb66569a3;MpKslb66569a3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3C713A99-6CF8-423E-8B29-4425CBAD0B8C}\MpKslb66569a3.sys [x]
R1 MpKslbd144001;MpKslbd144001;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A10B5403-D24A-439D-BDA0-A4BD35F94D45}\MpKslbd144001.sys [x]
R1 MpKsleba7dac5;MpKsleba7dac5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{79DAE702-9964-4A06-A12D-5A4F4ADC12A0}\MpKsleba7dac5.sys [x]
R1 MpKslee5f2736;MpKslee5f2736;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BC7597F4-C215-44E5-BFDD-4F7CB089EBFD}\MpKslee5f2736.sys [x]
R1 MpKslf927a876;MpKslf927a876;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8E3CB110-C33B-427D-839C-8D0F95EFB472}\MpKslf927a876.sys [x]
R1 prodrv03;Star Force copy protection driver v3;c:\windows\System32\drivers\prodrv03.sys [2011-02-11 115968]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 21968]
R3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FLASHSYS.sys [2007-12-14 9216]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-06 1343400]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2010-07-12 54112]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-04-04 297168]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-05 232512]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-07 172032]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-12-21 137144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 95384]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-27 58368]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]
.
.
.
------- Doplňkový sken -------
.
uStart Page = my.daemon-search.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Adam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{E714E565-6FE6-47BD-BF74-4C9606F52422}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3948431126-3677543672-433762227-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:8c,cc,17,71,ca,f8,3c,de,82,00,df,ce,4d,14,e6,1c,f6,58,88,4f,22,c1,e9,
b3,50,f5,4c,e9,f7,f6,14,2f,f1,a5,60,7e,f1,c2,26,32,9b,66,0b,43,02,23,18,03,\
"??"=hex:a6,46,69,a7,e8,66,99,ab,66,8f,76,49,28,ba,e6,66
.
[HKEY_USERS\S-1-5-21-3948431126-3677543672-433762227-1000\Software\SecuROM\License information*]
"datasecu"=hex:75,8b,5e,4c,3c,cc,39,88,50,cf,64,29,7f,66,07,df,bb,aa,c5,d9,1c,
c9,80,ff,8a,4b,4a,b1,e2,fc,4a,c2,c7,a4,24,4b,7e,19,e5,1d,6b,44,bf,0b,d2,9e,\
"rkeysecu"=hex:92,e1,39,15,c6,12,81,ef,67,eb,0a,5a,53,de,4d,7b
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2011-08-30 07:16:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-30 05:16
ComboFix2.txt 2011-08-29 15:19
.
Před spuštěním: Volných bajtů: 362 226 257 920
Po spuštění: Volných bajtů: 362 111 930 368
.
- - End Of File - - 5B0C60379548DBB91AAA7426898DB90F
Nahoru
Uživatelský avatar
Danstahr
Přítel fóra
Přítel fóra
Příspěvky: 1069
Registrován: 28 říj 2006 20:23
Bydliště: Londýn
Kontaktovat uživatele:
Kontaktovat uživatele Danstahr

Re: FB-vir, prosím o pomoc

#8 Příspěvek od Danstahr »

:arrow: Jaký antivir používáte? Vidím tam stopy po všem možném, tak abychom to vyklidili a nainstalovali ten správný (více antivirů v jednom PC nedělá dobrotu).

:arrow: Jak se chová PC teď?
Koupím trochu času, cenu respektuji.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#9 Příspěvek od callenthe »

PC už nepadá, jinak používat budu Avast, ostatní mám tedy odinstalovat ?
Nahoru
Uživatelský avatar
Danstahr
Přítel fóra
Přítel fóra
Příspěvky: 1069
Registrován: 28 říj 2006 20:23
Bydliště: Londýn
Kontaktovat uživatele:
Kontaktovat uživatele Danstahr

Re: FB-vir, prosím o pomoc

#10 Příspěvek od Danstahr »

Odinstalujte úplně všechny a dejte log z RSIT, ať uklidíme zbytky.
Koupím trochu času, cenu respektuji.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#11 Příspěvek od callenthe »

Logfile of random's system information tool 1.09 (written by random/random)
Run by Adam at 2011-08-30 12:53:40
Microsoft Windows 7 Ultimate
System drive C: has 327 GB (79%) free of 412 GB
Total RAM: 3071 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:54:01, on 30.8.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Users\Adam\Downloads\RSIT.exe
C:\Program Files\trend micro\Adam.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Adam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

--
End of file - 4222 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default

prefs.js - "browser.startup.homepage" - "www.google.cz"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7, gb@toolbar:1.0.0, {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5, {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b, {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2, {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1, engine@conduit.com:3.3.3.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
NPOFF12.DLL
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\extensions\
DTToolbar@toolbarnet.com
engine@conduit.com
gb@toolbar
{872b5b88-9db5-4310-bdd0-ac189557e5f5}
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\3o4yaeb9.default\searchplugins\
daemon-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [2009-10-09 1699328]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-05-05 203776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutorun"=0
"NoDriveTypeAutoRun"=255
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"msacm.msaudio1"=msaud32.acm

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-08-30 11:46:56 ----D---- C:\ProgramData\AVAST Software
2011-08-30 11:46:56 ----D---- C:\Program Files\AVAST Software
2011-08-30 11:22:50 ----D---- C:\ProgramData\Premium
2011-08-30 11:22:48 ----D---- C:\ProgramData\InstallMate
2011-08-30 07:16:28 ----D---- C:\Windows\temp
2011-08-30 07:16:26 ----A---- C:\ComboFix.txt
2011-08-30 07:14:13 ----SHD---- C:\$RECYCLE.BIN
2011-08-30 07:07:39 ----A---- C:\Windows\NIRCMD.exe
2011-08-29 17:09:35 ----A---- C:\Windows\zip.exe
2011-08-29 17:09:35 ----A---- C:\Windows\SWSC.exe
2011-08-29 17:09:35 ----A---- C:\Windows\SWREG.exe
2011-08-29 17:09:35 ----A---- C:\Windows\sed.exe
2011-08-29 17:09:35 ----A---- C:\Windows\PEV.exe
2011-08-29 17:09:35 ----A---- C:\Windows\MBR.exe
2011-08-29 17:09:35 ----A---- C:\Windows\grep.exe
2011-08-29 17:09:30 ----D---- C:\Windows\ERDNT
2011-08-29 17:09:28 ----D---- C:\Qoobox
2011-08-29 16:34:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-08-29 15:11:48 ----D---- C:\Program Files\trend micro
2011-08-29 15:11:47 ----D---- C:\rsit
2011-08-29 10:46:55 ----D---- C:\Config.Msi
2011-08-29 10:34:20 ----D---- C:\Users\Adam\AppData\Roaming\AVG
2011-08-29 10:33:19 ----AD---- C:\ProgramData\TEMP
2011-08-28 20:13:36 ----HD---- C:\ProgramData\Common Files
2011-08-28 20:13:31 ----D---- C:\ProgramData\MFAData
2011-08-28 16:07:03 ----D---- C:\Users\Adam\AppData\Roaming\vlc
2011-08-27 17:31:48 ----A---- C:\Windows\system32\tzres.dll
2011-08-27 17:27:06 ----D---- C:\Windows\Sun
2011-08-20 19:38:35 ----D---- C:\Program Files\Google
2011-08-10 21:56:24 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 21:56:24 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 21:56:23 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 21:56:22 ----A---- C:\Windows\system32\url.dll
2011-08-10 21:56:21 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 21:56:20 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 19:29:43 ----D---- C:\Windows\system32\URTTEMP
2011-08-10 16:19:27 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 16:19:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 16:19:25 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-08-10 16:19:18 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 16:19:17 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 16:19:15 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 16:19:15 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 16:19:14 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 16:19:13 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 16:19:12 ----A---- C:\Windows\system32\odbcjt32.dll
2011-08-10 16:19:12 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 16:19:11 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 00:09:09 ----D---- C:\ProgramData\Electronic Arts
2011-08-10 00:09:09 ----D---- C:\ProgramData\EA Core
2011-08-05 14:29:49 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-08-05 09:04:57 ----D---- C:\Users\Adam\AppData\Roaming\OpenCandy
2011-08-05 09:04:38 ----D---- C:\Program Files\DAEMON Tools Lite

======List of files/folders modified in the last 1 month======

2011-08-30 12:52:21 ----D---- C:\Windows\system32\config
2011-08-30 12:52:00 ----D---- C:\Windows\system32\drivers
2011-08-30 12:51:49 ----RD---- C:\Program Files
2011-08-30 12:46:51 ----D---- C:\Windows\System32
2011-08-30 12:46:51 ----D---- C:\Windows
2011-08-30 12:46:33 ----SHD---- C:\System Volume Information
2011-08-30 12:46:09 ----D---- C:\Windows\system32\Tasks
2011-08-30 11:49:05 ----D---- C:\Users\Adam\AppData\Roaming\uTorrent
2011-08-30 11:47:09 ----SHD---- C:\Windows\Installer
2011-08-30 11:46:56 ----D---- C:\ProgramData
2011-08-30 07:14:06 ----A---- C:\Windows\system.ini
2011-08-30 07:14:01 ----D---- C:\Windows\system32\drivers\etc
2011-08-30 07:12:26 ----D---- C:\Windows\Tasks
2011-08-30 07:11:34 ----D---- C:\Windows\system32\LogFiles
2011-08-30 07:10:50 ----D---- C:\Windows\AppPatch
2011-08-30 07:10:49 ----D---- C:\Program Files\Common Files
2011-08-29 17:38:21 ----D---- C:\Users\Adam\AppData\Roaming\Skype
2011-08-29 17:09:30 ----D---- C:\Windows\Prefetch
2011-08-29 11:01:54 ----D---- C:\Windows\SoftwareDistribution
2011-08-29 10:47:37 ----D---- C:\Windows\system32\DriverStore
2011-08-29 10:47:37 ----D---- C:\Windows\system32\catroot
2011-08-29 10:47:37 ----D---- C:\Windows\inf
2011-08-29 10:47:36 ----D---- C:\Windows\system32\catroot2
2011-08-29 10:36:18 ----D---- C:\Windows\Downloaded Program Files
2011-08-29 10:15:34 ----D---- C:\Windows\AppCompat
2011-08-28 20:35:14 ----D---- C:\Windows\system32\wdi
2011-08-28 16:40:26 ----D---- C:\ProgramData\MAGIX
2011-08-27 18:08:31 ----D---- C:\Windows\winsxs
2011-08-27 18:08:26 ----D---- C:\Windows\system32\cs-CZ
2011-08-20 19:41:27 ----D---- C:\Users\Adam\AppData\Roaming\DAEMON Tools Lite
2011-08-20 19:40:40 ----D---- C:\Windows\Logs
2011-08-20 19:40:40 ----D---- C:\Windows\debug
2011-08-20 12:07:21 ----D---- C:\ProgramData\Skype
2011-08-18 19:48:49 ----D---- C:\Program Files\Mozilla Firefox
2011-08-18 17:44:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-13 14:05:13 ----D---- C:\Windows\Microsoft.NET
2011-08-13 14:05:12 ----RSD---- C:\Windows\assembly
2011-08-11 09:07:35 ----D---- C:\Windows\system32\migration
2011-08-11 09:07:35 ----D---- C:\Program Files\Internet Explorer
2011-08-10 21:57:32 ----D---- C:\ProgramData\Microsoft Help
2011-08-10 21:55:12 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 19:30:23 ----D---- C:\Windows\Registration
2011-08-08 15:52:04 ----D---- C:\World of Warcraft
2011-08-05 09:04:57 ----D---- C:\Program Files\DAEMON Tools Toolbar

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\Windows\System32\drivers\sfhlp02.sys [2005-02-23 6656]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6x.sys [2010-07-12 54112]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys [2011-03-01 34896]
R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys [2011-04-05 297168]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-05 232512]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 137144]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 95384]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-07-14 117248]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-03-09 107024]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-11-27 58368]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]
S0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\Windows\System32\drivers\sfdrv01.sys [2005-03-03 48640]
S0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\Windows\System32\drivers\sfsync02.sys [2004-12-03 20544]
S1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
S1 MpKsl0806cd50;MpKsl0806cd50; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl0806cd50.sys []
S1 MpKsl0931948f;MpKsl0931948f; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A56D38E8-4C93-4540-BAD4-630275590083}\MpKsl0931948f.sys []
S1 MpKsl10e102a9;MpKsl10e102a9; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5956773A-4483-44A0-A4C1-57639D78F60D}\MpKsl10e102a9.sys []
S1 MpKsl14536795;MpKsl14536795; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{47F70567-5DD9-4868-8FF9-CFCEE2786D61}\MpKsl14536795.sys []
S1 MpKsl18ef9d6f;MpKsl18ef9d6f; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl18ef9d6f.sys []
S1 MpKsl1b870b40;MpKsl1b870b40; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{371644D2-7FC2-4BE8-900F-064B3687126B}\MpKsl1b870b40.sys []
S1 MpKsl29c7c2e3;MpKsl29c7c2e3; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl29c7c2e3.sys []
S1 MpKsl29e03d80;MpKsl29e03d80; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{55C42675-D760-402F-B213-5611821430C5}\MpKsl29e03d80.sys []
S1 MpKsl31b33eb1;MpKsl31b33eb1; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C64569D7-6149-4DB8-B0D9-1A50B7586F2E}\MpKsl31b33eb1.sys []
S1 MpKsl3d8991d4;MpKsl3d8991d4; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5A3782A3-D443-4290-AB56-0B3CE1A686ED}\MpKsl3d8991d4.sys []
S1 MpKsl3fb44388;MpKsl3fb44388; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E112BE0-C4FE-499B-AFDC-C029808D32BB}\MpKsl3fb44388.sys []
S1 MpKsl5478fedb;MpKsl5478fedb; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CDA79F8C-54E6-4EA6-8AD4-E68B95FA821E}\MpKsl5478fedb.sys []
S1 MpKsl62d666af;MpKsl62d666af; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DAFE93CE-D2A8-485E-9B57-6D93A8CBC974}\MpKsl62d666af.sys []
S1 MpKsl6aaf7b58;MpKsl6aaf7b58; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A03C927B-B904-4CEA-B798-CB7B40AE226A}\MpKsl6aaf7b58.sys []
S1 MpKsl6ad9310d;MpKsl6ad9310d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2283F489-A3F1-45A6-ABE5-65A008FFE07A}\MpKsl6ad9310d.sys []
S1 MpKsl7634feb8;MpKsl7634feb8; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6ED08C80-08C5-4D6E-8081-6943022E41E3}\MpKsl7634feb8.sys []
S1 MpKslb66569a3;MpKslb66569a3; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3C713A99-6CF8-423E-8B29-4425CBAD0B8C}\MpKslb66569a3.sys []
S1 MpKslbd144001;MpKslbd144001; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A10B5403-D24A-439D-BDA0-A4BD35F94D45}\MpKslbd144001.sys []
S1 MpKsleba7dac5;MpKsleba7dac5; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{79DAE702-9964-4A06-A12D-5A4F4ADC12A0}\MpKsleba7dac5.sys []
S1 MpKslee5f2736;MpKslee5f2736; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{BC7597F4-C215-44E5-BFDD-4F7CB089EBFD}\MpKslee5f2736.sys []
S1 MpKslf927a876;MpKslf927a876; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8E3CB110-C33B-427D-839C-8D0F95EFB472}\MpKslf927a876.sys []
S1 prodrv03;Star Force copy protection driver v3; C:\Windows\System32\drivers\prodrv03.sys [2011-02-11 115968]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-14 134480]
S3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
S3 AVGIDSShim;AVGIDSShim; C:\Windows\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 21968]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 catchme;catchme; \??\C:\Users\Adam\AppData\Local\Temp\catchme.sys []
S3 FLASHSYS;FLASHSYS; \??\C:\Program Files\MSI\Live Update 4\LU4\FLASHSYS.sys [2007-12-14 9216]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-04-07 172032]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-06-10 31064]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-06 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: FB-vir, prosím o pomoc

#12 Příspěvek od motji »

Dobrý večer, záskok za kolegu :) .
Takže antiviry máte odinstalované a můžu domazat zbytky?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#13 Příspěvek od callenthe »

Ano, antiviry jsou odinstalované.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: FB-vir, prosím o pomoc

#14 Příspěvek od motji »

Skript na dočištění napíšu večer, ještě udělejte mbam.

:arrow: Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT :!:
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
callenthe
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 29 srp 2011 14:01

Re: FB-vir, prosím o pomoc

#15 Příspěvek od callenthe »

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Verze databáze: 7635

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

2.9.2011 14:10:14
mbam-log-2011-09-02 (14-10-14).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 276348
Uplynulý čas: 26 minut, 12 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“