externí disk - vir

Zpráva

pogo23 · #1 Příspěvek od **pogo23** » 29 říj 2011 01:12

mela jsem svůj externí disk k zálohování PC a ted mi z nej nejde nic otevrít. Jakmile v nem otevru nejakou slozku, Hned zamrzne a nekdy i celý počítač. Zrejme jsem si tam zazalohovala s daty i trojana nebo nebo nejakou podobnou havet. Kdyz to to projdu AVG nebo nejakym lečícim ci cisticim programem, hned se to sekne a pak uplne zamrzne. Hledá to obcas ...RECYCLER...

#2 Příspěvek od **vyosek** » 29 říj 2011 06:58

Zdravim, pekne rano preji a vitam vas u nas na foru

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

pogo23 · #3 Příspěvek od **pogo23** » 29 říj 2011 10:36

Ahoj,
zkoušela jsem spustit 2x UsbFix -> detection ....a pokaždé se sekne na 48%..

#4 Příspěvek od **vyosek** » 29 říj 2011 11:28

Zkuste to jeste jednou v nouzovem rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti)

pogo23 · #5 Příspěvek od **pogo23** » 29 říj 2011 11:52

tak nevim, restart -> mackam F8 jako blazen stejne se to pokazdy hned spustí normalne.

pogo23 · #6 Příspěvek od **pogo23** » 29 říj 2011 12:03

V nouzovém rezimu v siti opet usbfix zamrznul na 48%.

pogo23 · #7 Příspěvek od **pogo23** » 29 říj 2011 12:07

#8 Příspěvek od **vyosek** » 29 říj 2011 12:37

Zkuste dat log z RSIT http://www.viry.cz/forum/viewtopic.php?f=13&t=105895

pogo23 · #9 Příspěvek od **pogo23** » 30 říj 2011 12:46

Logfile of random's system information tool 1.09 (written by random/random)
Run by Karca at 2011-10-30 12:40:44
Microsoft Windows 7 Professional
System drive C: has 50 GB (30%) free of 167 GB
Total RAM: 2046 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:41:16, on 30.10.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16869)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Users\Karca\Desktop\Nová složka\RSIT.exe
C:\Program Files (x86)\trend micro\Karca.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{71615102-96F8-4337-899B-97C218EA612A}: NameServer = 10.0.0.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Memos\eWay Outlook Client\Skype4COM.dll (file missing)
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-30007 (IISADMIN) - Unknown owner - C:\Windows\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-20001 (WMSVC) - Unknown owner - C:\Windows\system32\inetsrv\wmsvc.exe (file missing)

--
End of file - 10019 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Karca\AppData\Roaming\Mozilla\Firefox\Profiles\6ku0smyu.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.google.cz/"
prefs.js - "keyword.URL" - "http://isearch.avg.com/search?cid=%7B07 ... &sap=ku&q="

"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=C:\Program Files (x86)\AVG\AVG2012\Firefox4\

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.1.11]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Karca\AppData\Roaming\Mozilla\Firefox\Profiles\6ku0smyu.default\extensions\
avg@toolbar

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll [2011-09-27 2179936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-27 1451336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-27 1451336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-08-31 449608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableStatusMessages"=1
"DisableStartupSound"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=0
"NoDriveAutoRun"=3

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-10-30 12:40:43 ----D---- C:\rsit
2011-10-29 11:58:40 ----D---- C:\32788R22FWJFW
2011-10-29 11:58:30 ----N---- C:\Bug.txt
2011-10-29 11:56:56 ----A---- C:\Windows\ntbtlog.txt
2011-10-29 10:56:04 ----D---- C:\Users\Karca\AppData\Roaming\Malwarebytes
2011-10-29 10:55:54 ----D---- C:\ProgramData\Malwarebytes
2011-10-29 10:55:50 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-10-29 07:11:45 ----D---- C:\Windows\SysWOW64\Wat
2011-10-29 04:00:55 ----RASHD---- C:\Autorun.inf
2011-10-29 01:56:49 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2011-10-29 01:34:12 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2011-10-29 01:34:12 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2011-10-29 01:34:12 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2011-10-29 01:34:12 ----A---- C:\Windows\SysWOW64\mscoree.dll
2011-10-29 01:34:12 ----A---- C:\Windows\SysWOW64\dfshim.dll
2011-10-29 01:12:52 ----N---- C:\UsbFix.txt
2011-10-29 01:12:39 ----D---- C:\UsbFix
2011-10-28 20:51:32 ----SHD---- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-10-28 10:18:33 ----A---- C:\Windows\SysWOW64\tzres.dll
2011-10-28 10:17:48 ----A---- C:\Windows\SysWOW64\kerberos.dll
2011-10-28 10:17:29 ----A---- C:\Windows\SysWOW64\odbcjt32.dll
2011-10-28 10:17:29 ----A---- C:\Windows\SysWOW64\odbccr32.dll
2011-10-28 10:17:29 ----A---- C:\Windows\SysWOW64\odbccp32.dll
2011-10-28 10:17:28 ----A---- C:\Windows\SysWOW64\odbctrac.dll
2011-10-28 10:17:28 ----A---- C:\Windows\SysWOW64\odbccu32.dll
2011-10-28 10:17:23 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2011-10-28 10:17:12 ----A---- C:\Windows\SysWOW64\poqexec.exe
2011-10-28 10:17:09 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2011-10-28 10:17:08 ----A---- C:\Windows\SysWOW64\EncDec.dll
2011-10-28 10:17:07 ----A---- C:\Windows\SysWOW64\sbe.dll
2011-10-28 10:17:04 ----A---- C:\Windows\SysWOW64\t2embed.dll
2011-10-28 10:16:59 ----A---- C:\Windows\SysWOW64\ole32.dll
2011-10-28 10:16:54 ----A---- C:\Windows\SysWOW64\taskschd.dll
2011-10-28 10:16:53 ----A---- C:\Windows\SysWOW64\taskeng.exe
2011-10-28 10:16:53 ----A---- C:\Windows\SysWOW64\taskcomp.dll
2011-10-28 10:16:53 ----A---- C:\Windows\SysWOW64\schtasks.exe
2011-10-28 10:16:51 ----A---- C:\Windows\SysWOW64\StructuredQuery.dll
2011-10-28 10:16:33 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2011-10-28 10:16:13 ----A---- C:\Windows\SysWOW64\shell32.dll
2011-10-28 10:15:49 ----A---- C:\Windows\SysWOW64\schannel.dll
2011-10-28 10:15:45 ----A---- C:\Windows\SysWOW64\comctl32.dll
2011-10-28 10:15:40 ----A---- C:\Windows\SysWOW64\vbscript.dll
2011-10-28 10:15:40 ----A---- C:\Windows\SysWOW64\jscript.dll
2011-10-28 10:15:22 ----A---- C:\Windows\SysWOW64\explorer.exe
2011-10-28 10:15:22 ----A---- C:\Windows\explorer.exe
2011-10-28 10:15:13 ----A---- C:\Windows\SysWOW64\mfc42u.dll
2011-10-28 10:15:13 ----A---- C:\Windows\SysWOW64\mfc42.dll
2011-10-28 10:14:48 ----A---- C:\Windows\SysWOW64\ieframe.dll
2011-10-28 10:14:40 ----A---- C:\Windows\SysWOW64\mshtml.dll
2011-10-28 10:14:40 ----A---- C:\Windows\SysWOW64\iertutil.dll
2011-10-28 10:14:36 ----A---- C:\Windows\SysWOW64\urlmon.dll
2011-10-28 10:14:32 ----A---- C:\Windows\SysWOW64\wininet.dll
2011-10-28 10:14:27 ----A---- C:\Windows\SysWOW64\msfeeds.dll
2011-10-28 10:14:25 ----A---- C:\Windows\SysWOW64\mstime.dll
2011-10-28 10:14:23 ----A---- C:\Windows\SysWOW64\iepeers.dll
2011-10-28 10:14:23 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2011-10-28 10:14:19 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2011-10-28 10:14:18 ----A---- C:\Windows\SysWOW64\licmgr10.dll
2011-10-28 10:14:15 ----A---- C:\Windows\SysWOW64\mshtmled.dll
2011-10-28 10:14:15 ----A---- C:\Windows\SysWOW64\ieui.dll
2011-10-28 10:14:13 ----A---- C:\Windows\SysWOW64\url.dll
2011-10-28 10:14:10 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2011-10-28 10:14:09 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2011-10-28 10:13:21 ----A---- C:\Windows\SysWOW64\rtutils.dll
2011-10-28 10:12:40 ----A---- C:\Windows\SysWOW64\fontsub.dll
2011-10-28 10:12:40 ----A---- C:\Windows\SysWOW64\atmfd.dll
2011-10-28 10:12:39 ----A---- C:\Windows\SysWOW64\atmlib.dll
2011-10-28 10:12:37 ----A---- C:\Windows\SysWOW64\webio.dll
2011-10-28 10:12:35 ----A---- C:\Windows\SysWOW64\iccvid.dll
2011-10-28 10:12:18 ----A---- C:\Windows\SysWOW64\dnsapi.dll
2011-10-28 10:12:17 ----A---- C:\Windows\SysWOW64\dnscacheugc.exe
2011-10-28 10:11:51 ----A---- C:\Windows\SysWOW64\wmpmde.dll
2011-10-28 10:11:50 ----A---- C:\Windows\SysWOW64\quartz.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\msyuv.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\msrle32.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2011-10-28 10:11:49 ----A---- C:\Windows\SysWOW64\avifil32.dll
2011-10-28 10:11:42 ----A---- C:\Windows\SysWOW64\psisdecd.dll
2011-10-28 10:11:36 ----A---- C:\Windows\SysWOW64\ntdll.dll
2011-10-28 10:11:32 ----A---- C:\Windows\SysWOW64\msxml3.dll
2011-10-28 10:11:28 ----A---- C:\Windows\SysWOW64\secur32.dll
2011-10-28 10:11:27 ----A---- C:\Windows\SysWOW64\sspicli.dll
2011-10-28 10:11:20 ----A---- C:\Windows\SysWOW64\mfc40u.dll
2011-10-28 10:11:20 ----A---- C:\Windows\SysWOW64\mfc40.dll
2011-10-28 10:11:18 ----A---- C:\Windows\SysWOW64\msasn1.dll
2011-10-28 10:11:12 ----A---- C:\Windows\SysWOW64\KernelBase.dll
2011-10-28 10:11:11 ----A---- C:\Windows\SysWOW64\setup16.exe
2011-10-28 10:11:11 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2011-10-28 10:11:11 ----A---- C:\Windows\SysWOW64\kernel32.dll
2011-10-28 10:11:10 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-10-28 10:11:10 ----A---- C:\Windows\SysWOW64\wow32.dll
2011-10-28 10:11:10 ----A---- C:\Windows\SysWOW64\instnm.exe
2011-10-28 10:10:59 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-10-28 10:10:59 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2011-10-28 10:10:58 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-10-28 10:10:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-10-28 10:10:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2011-10-28 10:10:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-10-28 10:10:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-10-28 10:10:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-10-28 10:10:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-10-28 10:10:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-10-28 10:10:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-10-28 10:10:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-10-28 10:10:53 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2011-10-28 10:10:53 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-10-28 10:10:52 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-10-28 10:10:52 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-10-28 10:10:52 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-10-28 10:10:51 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-10-28 10:10:51 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-10-28 10:10:51 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-10-28 10:10:50 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-10-28 10:10:49 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2011-10-28 10:10:48 ----A---- C:\Windows\SysWOW64\user.exe
2011-10-28 10:10:42 ----A---- C:\Windows\SysWOW64\drvinst.exe
2011-10-28 10:10:42 ----A---- C:\Windows\SysWOW64\cfgmgr32.dll
2011-10-28 10:10:41 ----A---- C:\Windows\SysWOW64\devrtl.dll
2011-10-28 10:10:41 ----A---- C:\Windows\SysWOW64\devobj.dll
2011-10-28 10:10:37 ----A---- C:\Windows\SysWOW64\mstscax.dll
2011-10-28 10:10:36 ----A---- C:\Windows\SysWOW64\mstsc.exe
2011-10-28 10:10:29 ----A---- C:\Windows\SysWOW64\wmp.dll
2011-10-28 10:10:27 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2011-10-28 10:10:12 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2011-10-28 10:10:00 ----A---- C:\Windows\SysWOW64\oleaut32.dll
2011-10-28 10:10:00 ----A---- C:\Windows\SysWOW64\oleacc.dll
2011-10-28 10:02:48 ----A---- C:\Windows\SysWOW64\odbc32.dll
2011-10-28 10:02:27 ----A---- C:\Windows\SysWOW64\sscore.dll
2011-10-28 10:01:34 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2011-10-28 10:01:34 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2011-10-27 19:10:05 ----D---- C:\Users\Karca\AppData\Roaming\AVG
2011-10-27 19:01:18 ----AD---- C:\ProgramData\TEMP
2011-10-27 06:23:47 ----D---- C:\Users\Karca\AppData\Roaming\AVG2012
2011-10-27 06:23:13 ----D---- C:\Program Files (x86)\Common Files\AVG Secure Search
2011-10-27 06:23:12 ----D---- C:\Program Files (x86)\AVG Secure Search
2011-10-27 06:21:54 ----D---- C:\ProgramData\AVG2012
2011-10-27 02:27:44 ----A---- C:\Windows\SysWOW64\wintrust.dll
2011-10-27 02:27:43 ----A---- C:\Windows\SysWOW64\cabview.dll
2011-10-27 02:14:02 ----D---- C:\Program Files (x86)\Microsoft Security Client
2011-10-27 02:10:44 ----D---- C:\ProgramData\MFAData
2011-10-27 02:03:58 ----D---- C:\Program Files (x86)\Trend Micro
2011-10-25 21:41:18 ----D---- C:\Users\Karca\AppData\Roaming\GHISLER
2011-10-25 21:41:18 ----D---- C:\totalcmd
2011-10-25 21:41:18 ----A---- C:\Windows\UC.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\RAR.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\PKZIP.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\PKUNZIP.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\NOCLOSE.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\LHA.PIF
2011-10-25 21:41:18 ----A---- C:\Windows\ARJ.PIF
2011-10-18 14:53:48 ----D---- C:\ProgramData\FLEXnet
2011-10-17 17:47:00 ----D---- C:\ProgramData\ALM
2011-10-17 17:26:47 ----D---- C:\Windows\SysWOW64\spool
2011-10-17 17:26:32 ----D---- C:\Program Files (x86)\Adobe Media Player
2011-10-17 17:24:46 ----D---- C:\Program Files (x86)\Common Files\Adobe AIR
2011-10-17 17:21:41 ----D---- C:\Program Files (x86)\Common Files\Macrovision Shared
2011-10-17 17:18:00 ----D---- C:\ProgramData\Protexis
2011-10-17 17:17:55 ----D---- C:\Users\Karca\AppData\Roaming\Corel
2011-10-17 17:11:28 ----D---- C:\Program Files (x86)\Microsoft SDKs
2011-10-17 17:11:27 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 9.0
2011-10-17 17:09:36 ----D---- C:\Program Files (x86)\Common Files\Corel
2011-10-17 17:08:04 ----D---- C:\ProgramData\Corel
2011-10-17 17:08:04 ----D---- C:\Program Files (x86)\Common Files\Protexis
2011-10-17 16:58:29 ----D---- C:\Program Files (x86)\Corel
2011-10-16 18:22:58 ----D---- C:\Users\Karca\AppData\Roaming\PSpad
2011-10-16 16:45:36 ----D---- C:\Program Files (x86)\PSPad editor
2011-10-01 03:41:56 ----D---- C:\Users\Karca\AppData\Roaming\Babylon
2011-10-01 03:41:56 ----D---- C:\ProgramData\Babylon

======List of files/folders modified in the last 1 month======

2011-10-30 12:41:18 ----D---- C:\Windows\Temp
2011-10-30 12:41:07 ----D---- C:\Windows\System32
2011-10-30 12:41:03 ----D---- C:\Windows\inf
2011-10-30 11:40:25 ----D---- C:\Windows\Microsoft.NET
2011-10-30 11:40:18 ----RSD---- C:\Windows\assembly
2011-10-30 11:20:31 ----D---- C:\Windows\winsxs
2011-10-30 10:07:31 ----D---- C:\Windows\SysWOW64
2011-10-30 10:05:29 ----D---- C:\Windows\SysWOW64\cs-CZ
2011-10-29 14:29:10 ----SHD---- C:\Windows\Installer
2011-10-29 14:29:10 ----D---- C:\Config.Msi
2011-10-29 14:29:05 ----D---- C:\ProgramData\Microsoft Help
2011-10-29 14:28:27 ----SHD---- C:\System Volume Information
2011-10-29 14:26:36 ----D---- C:\Windows\Prefetch
2011-10-29 11:58:01 ----D---- C:\Program Files (x86)\Common Files\Adobe
2011-10-29 11:56:56 ----D---- C:\Windows
2011-10-29 11:40:35 ----D---- C:\Windows\SysWOW64\drivers
2011-10-29 10:55:54 ----HD---- C:\ProgramData
2011-10-29 10:55:50 ----D---- C:\Program Files (x86)
2011-10-29 10:17:48 ----D---- C:\Windows\Minidump
2011-10-29 07:12:04 ----D---- C:\Windows\ehome
2011-10-29 07:12:02 ----D---- C:\Program Files (x86)\Windows Mail
2011-10-29 07:12:01 ----D---- C:\Windows\SysWOW64\inetsrv
2011-10-29 07:11:58 ----D---- C:\Windows\SysWOW64\migration
2011-10-29 07:11:58 ----D---- C:\Program Files (x86)\Internet Explorer
2011-10-29 07:11:40 ----D---- C:\Windows\AppPatch
2011-10-29 07:11:39 ----D---- C:\Program Files (x86)\Windows Media Player
2011-10-29 03:59:44 ----SHD---- C:\$Recycle.Bin
2011-10-29 03:59:42 ----SHD---- C:\RECYCLER
2011-10-29 02:06:01 ----D---- C:\Windows\Logs
2011-10-29 01:59:56 ----D---- C:\Windows\debug
2011-10-29 01:52:23 ----A---- C:\Windows\SysWOW64\PerfStringBackup.INI
2011-10-29 01:51:05 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2011-10-29 01:44:59 ----D---- C:\Windows\Registration
2011-10-27 19:18:37 ----D---- C:\Windows\Downloaded Program Files
2011-10-27 19:00:55 ----D---- C:\Program Files (x86)\AVG
2011-10-27 06:23:13 ----D---- C:\Program Files (x86)\Common Files
2011-10-27 06:22:59 ----D---- C:\Windows\SysWOW64\drivers\avg
2011-10-27 02:56:17 ----D---- C:\ProgramData\avg9
2011-10-27 02:54:21 ----SD---- C:\Users\Karca\AppData\Roaming\Microsoft
2011-10-27 02:14:02 ----SD---- C:\ProgramData\Microsoft
2011-10-27 02:13:28 ----D---- C:\Program Files
2011-10-27 02:13:27 ----D---- C:\Windows\SoftwareDistribution
2011-10-20 20:23:47 ----D---- C:\Users\Karca\AppData\Roaming\Adobe
2011-10-18 15:39:18 ----D---- C:\ProgramData\SprinxCRM
2011-10-17 17:41:00 ----D---- C:\ProgramData\Adobe
2011-10-17 17:36:23 ----RSD---- C:\Windows\Fonts
2011-10-17 17:31:54 ----D---- C:\Program Files (x86)\Adobe
2011-10-17 17:11:28 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2011-10-13 16:17:06 ----D---- C:\Users\Karca\AppData\Roaming\vlc
2011-10-09 23:37:00 ----D---- C:\Windows\Tasks
2011-10-04 01:48:30 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-10-03 20:39:20 ----D---- C:\Program Files (x86)\Microsoft Office
2011-10-03 20:39:19 ----D---- C:\Windows\ShellNew
2011-10-03 20:37:24 ----D---- C:\Windows\Help
2011-10-02 20:48:33 ----D---- C:\Windows\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys []
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys []
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys []
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys []
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys []
R2 adfs;adfs; C:\Windows\SysWOW64\drivers\adfs.sys [2008-08-14 74720]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys []
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys []
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys []
S3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys []
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys []
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys []
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys []
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys []
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys []
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\AVG2012\avgfws.exe [2011-08-19 2399560]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 IISADMIN;@%windir%\system32\inetsrv\iisres.dll,-30007; C:\Windows\system32\inetsrv\inetinfo.exe []
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2011-04-27 12784]
R2 MSSQL$EWAYSQL;SQL Server (EWAYSQL); C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R2 MSSQL$SPRINXCRM;SQL Server (SPRINXCRM); c:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [2009-07-24 189728]
R2 SQLBrowser;SQL Server Browser; C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2010-12-10 238944]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2010-12-10 153440]
R2 vToolbarUpdater;vToolbarUpdater; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-27 246600]
R2 W3SVC;@%windir%\system32\inetsrv\iisres.dll,-30003; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4; C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;@%windir%\system32\inetsrv\iisres.dll,-30009; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe [2009-06-10 42840]
S3 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-09-12 5265248]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-17 1038088]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-10-17 655624]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
S3 NisSrv;@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []
S3 WMSVC;@%windir%\system32\inetsrv\iisres.dll,-20001; C:\Windows\system32\inetsrv\wmsvc.exe []
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2010-12-10 44384]

-----------------EOF-----------------

#10 Příspěvek od **vyosek** » 30 říj 2011 14:47

Pod jakym pismenem se zobrazuje disk

pogo23 · #11 Příspěvek od **pogo23** » 30 říj 2011 18:06

Pod písmenem H.

#12 Příspěvek od **vyosek** » 30 říj 2011 19:19

Zapojte disk do PC

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

Do okna vlozte skript nize
Kód: Vybrat vše
```
:dir
H:\
```
Kliknete na Look
Tlacitko Look se zmeni na Scanning a zsedne
Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

pogo23 · #13 Příspěvek od **pogo23** » 30 říj 2011 19:31

SystemLook 30.07.11 by jpshortstuff
Log created at 19:30 on 30/10/2011 by Karca
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== dir ==========

H: - Parameters: "(none)"

---Files---
111111111111111(2).pdf ------- 50211 bytes [16:57 27/07/2011] [16:57 27/07/2011]
111111111111111111111111111.txt ------- 7956 bytes [16:57 27/07/2011] [16:57 27/07/2011]
22222222222222.txt ------- 5452 bytes [17:11 27/07/2011] [17:11 27/07/2011]
9556136540.zip ------- 350559 bytes [22:59 22/08/2011] [22:59 22/08/2011]
battle.snp ------- 557310 bytes [00:50 19/10/2011] [08:30 19/07/2007]
bmw1.jpg ------- 946171 bytes [08:23 07/10/2011] [08:23 07/10/2011]
CV_-_Karolina_Smetakova.doc ------- 83968 bytes [11:17 15/01/2011] [11:17 15/01/2011]
djcrunchmixtape1.mp3 ------- 20948643 bytes [19:19 23/09/2011] [21:01 20/09/2011]
Dámské_bezešvé_spodní_prádlo_Stelledonna.doc ------- 26112 bytes [23:33 22/08/2011] [02:00 11/08/2011]
kaRol - Oldschool Vibes.mp3 ------- 32884620 bytes [19:19 23/09/2011] [20:48 20/09/2011]
KRAJNI-MEZE-02-01_CESTA-V-CASE.avi ------- 367013888 bytes [18:15 14/10/2011] [19:05 01/10/2011]
KRAJNI-MEZE-02-07_PRVNI-VYROCI.avi ------- 367022080 bytes [18:14 14/10/2011] [07:00 14/10/2011]
krajni-meze-s05e05-druha-strana.avi ------- 343439360 bytes [18:15 14/10/2011] [11:38 28/09/2011]
Krajni_meze-s01e05-Horecka-bileho-svetla.avi ------- 123787264 bytes [20:35 15/10/2011] [11:24 15/10/2011]
Krajni_meze-s01e09-Koutkem-oka.avi ------- 123777024 bytes [20:35 15/10/2011] [13:13 15/10/2011]
Krajni_meze-s01e10-Pod-posteli.avi ------- 123609088 bytes [20:35 15/10/2011] [23:48 14/10/2011]
Thumbs.db --ahs-- 5120 bytes [01:27 09/07/2011] [01:27 09/07/2011]
Windows 7 Ultimate_CS_DVD_x64.iso ------- -1159036928 bytes [23:49 19/08/2011] [12:07 29/07/2011]

---Folders---
$AVG d------ [15:31 25/08/2011]
$RECYCLE.BIN d--hs-- [20:48 29/07/2011]
C d------ [19:59 06/08/2011]
dnb d------ [19:20 23/09/2011]
Documents and Settings d------ [17:21 27/07/2011]
fonty d------ [23:27 22/10/2011]
html d------ [23:33 22/08/2011]
mp3 d------ [22:41 08/07/2011]
msdownld.tmp d------ [06:54 01/09/2011]
Pictures d------ [16:45 08/07/2011]
PROGRAMY d------ [01:26 09/07/2011]
RECYCLER d--hs-- [23:08 03/07/2011]
System Volume Information d--hs-- [21:28 03/07/2011]
videa d------ [22:15 14/08/2011]

-= EOF =-

#14 Příspěvek od **vyosek** » 30 říj 2011 20:13

Nechte disk zapojeny

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

pogo23 · #15 Příspěvek od **pogo23** » 30 říj 2011 23:28

ComboFix 11-10-30.03 - Karca 30.10.2011 21:51:51.1.2 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2046.1051 [GMT 1:00]
Spuštěný z: c:\users\Karca\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-28 do 2011-10-30 )))))))))))))))))))))))))))))))
.
.
2011-10-30 20:42 . 2011-10-30 20:42 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{73FC8393-42E8-4559-8762-4451294C470D}\offreg.dll
2011-10-30 20:42 . 2011-10-06 19:16 8570192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{73FC8393-42E8-4559-8762-4451294C470D}\mpengine.dll
2011-10-30 11:40 . 2011-10-30 11:41 -------- d-----w- C:\rsit
2011-10-29 13:27 . 2011-10-29 13:27 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-10-29 12:05 . 2011-04-28 03:58 552448 ----a-w- c:\windows\system32\drivers\bthport.sys
2011-10-29 12:05 . 2011-04-28 03:58 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2011-10-29 09:56 . 2011-10-29 09:56 -------- d-----w- c:\users\Karca\AppData\Roaming\Malwarebytes
2011-10-29 09:55 . 2011-10-29 09:55 -------- d-----w- c:\programdata\Malwarebytes
2011-10-29 09:55 . 2011-10-29 09:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-10-29 09:55 . 2011-08-31 15:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-29 06:11 . 2011-10-29 06:11 -------- d-----w- c:\windows\SysWow64\Wat
2011-10-29 06:08 . 2011-10-29 06:11 -------- d-----w- c:\windows\system32\WAT
2011-10-29 00:56 . 2009-09-10 06:28 311808 ----a-w- c:\windows\system32\msv1_0.dll
2011-10-29 00:56 . 2009-09-10 05:52 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll
2011-10-29 00:34 . 2009-11-25 10:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2011-10-29 00:34 . 2009-11-25 10:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2011-10-29 00:34 . 2009-11-25 10:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2011-10-29 00:34 . 2009-11-25 10:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2011-10-29 00:34 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2011-10-29 00:34 . 2009-11-25 10:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-10-29 00:34 . 2009-11-25 10:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe
2011-10-29 00:34 . 2009-11-25 10:47 48960 ----a-w- c:\windows\system32\netfxperf.dll
2011-10-29 00:34 . 2009-11-25 10:47 444752 ----a-w- c:\windows\system32\mscoree.dll
2011-10-29 00:34 . 2009-11-25 10:47 1942856 ----a-w- c:\windows\system32\dfshim.dll
2011-10-29 00:33 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2011-10-29 00:12 . 2011-10-29 11:01 -------- d-----w- C:\UsbFix
2011-10-28 19:51 . 2011-10-28 19:51 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-10-28 09:18 . 2011-06-21 06:27 1896832 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-10-28 09:18 . 2011-07-09 05:14 2048 ----a-w- c:\windows\system32\tzres.dll
2011-10-28 09:18 . 2011-07-09 04:30 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-10-28 09:16 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\SysWow64\ole32.dll
2011-10-28 09:15 . 2011-09-06 03:07 3134976 ----a-w- c:\windows\system32\win32k.sys
2011-10-28 09:13 . 2010-06-19 06:53 52224 ----a-w- c:\windows\system32\rtutils.dll
2011-10-28 09:13 . 2010-06-19 06:23 37376 ----a-w- c:\windows\SysWow64\rtutils.dll
2011-10-28 09:11 . 2010-08-21 06:38 1024512 ----a-w- c:\windows\system32\wmpmde.dll
2011-10-28 09:10 . 2011-07-16 05:04 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-10-28 09:02 . 2010-10-16 05:17 720896 ----a-w- c:\windows\system32\odbc32.dll
2011-10-28 09:02 . 2010-10-16 05:16 1425408 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-10-28 09:02 . 2010-10-16 04:34 573440 ----a-w- c:\windows\SysWow64\odbc32.dll
2011-10-28 09:02 . 2010-10-16 05:16 495616 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-10-28 09:02 . 2010-10-16 05:16 466944 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-10-28 09:02 . 2010-10-16 05:16 258048 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-10-28 09:02 . 2010-10-16 04:33 372736 ----a-w- c:\program files (x86)\Common Files\System\ado\msadox.dll
2011-10-28 09:02 . 2010-10-16 04:33 352256 ----a-w- c:\program files (x86)\Common Files\System\ado\msadomd.dll
2011-10-28 09:02 . 2010-10-16 04:33 987136 ----a-w- c:\program files (x86)\Common Files\System\ado\msado15.dll
2011-10-28 09:02 . 2010-10-16 04:33 208896 ----a-w- c:\program files (x86)\Common Files\System\msadc\msadco.dll
2011-10-28 09:02 . 2010-08-27 06:14 236032 ----a-w- c:\windows\system32\srvsvc.dll
2011-10-28 09:02 . 2010-08-27 05:46 9728 ----a-w- c:\windows\SysWow64\sscore.dll
2011-10-28 09:01 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-28 09:01 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-10-28 09:01 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-10-27 18:10 . 2011-10-27 19:32 -------- d-----w- c:\users\Karca\AppData\Roaming\AVG
2011-10-27 17:57 . 2011-10-29 10:58 301568 ----a-w- c:\windows\SysWow64\cmd.execf
2011-10-27 05:23 . 2011-10-27 05:23 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2011-10-27 05:23 . 2011-10-27 05:23 -------- d-----w- c:\program files (x86)\AVG Secure Search
2011-10-27 05:21 . 2011-10-30 16:21 -------- d-----w- c:\windows\system32\drivers\AVG
2011-10-27 05:21 . 2011-10-29 06:16 -------- d-----w- c:\programdata\AVG2012
2011-10-27 01:27 . 2009-12-29 08:03 220672 ----a-w- c:\windows\system32\wintrust.dll
2011-10-27 01:27 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll
2011-10-27 01:27 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll
2011-10-27 01:27 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
2011-10-27 01:19 . 2011-10-06 19:16 8570192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-27 01:18 . 2011-10-27 01:18 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2CA851D1-07B0-4C54-8ADC-3513FA0E9211}\gapaengine.dll
2011-10-27 01:17 . 2010-10-19 20:51 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-10-27 01:14 . 2011-10-27 01:14 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2011-10-27 01:13 . 2011-10-27 01:14 -------- d-----w- c:\program files\Microsoft Security Client
2011-10-27 01:13 . 2010-04-09 11:06 374664 ----a-w- c:\windows\system32\drivers\netio.sys
2011-10-27 01:10 . 2011-10-30 12:03 -------- d-----w- c:\programdata\MFAData
2011-10-27 01:03 . 2011-10-30 11:41 -------- d-----w- c:\program files (x86)\Trend Micro
2011-10-25 20:41 . 2011-10-25 20:44 -------- d-----w- c:\users\Karca\AppData\Roaming\GHISLER
2011-10-25 20:41 . 2011-10-25 20:41 -------- d-----w- C:\totalcmd
2011-10-25 20:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\UC.PIF
2011-10-25 20:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\RAR.PIF
2011-10-25 20:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-10-25 20:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\LHA.PIF
2011-10-25 20:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\ARJ.PIF
2011-10-18 14:35 . 2011-10-18 14:39 -------- d-----w- c:\windows\system32\appmgmt
2011-10-18 13:53 . 2011-10-20 19:12 -------- d-----w- c:\programdata\FLEXnet
2011-10-17 16:55 . 2011-10-17 16:57 -------- d-----w- c:\users\Karca\Adobe Flash CS4
2011-10-17 16:53 . 2011-10-17 16:54 -------- d-----w- c:\users\Karca\Adobe InDesign CS4
2011-10-17 16:50 . 2011-10-17 16:52 -------- d-----w- c:\users\Karca\Adobe Photoshop CS4 (64 Bit)
2011-10-17 16:49 . 2011-10-17 16:49 -------- d-----w- c:\users\Karca\Adobe Photoshop CS4
2011-10-17 16:47 . 2011-10-17 16:47 -------- d-----w- c:\users\Karca\Adobe Illustrator CS4
2011-10-17 16:47 . 2011-10-17 16:47 -------- d-----w- c:\programdata\ALM
2011-10-17 16:45 . 2011-10-17 16:46 -------- d-----w- c:\users\Karca\Adobe Fireworks CS4
2011-10-17 16:42 . 2011-10-17 16:44 -------- d-----w- c:\users\Karca\Adobe Dreamweaver CS4
2011-10-17 16:40 . 2008-04-07 03:38 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2011-10-17 16:33 . 2011-10-17 16:38 -------- d-----w- c:\users\Karca\Acrobat 9.0
2011-10-17 16:26 . 2011-10-17 16:26 -------- d-----w- c:\windows\SysWow64\spool
2011-10-17 16:26 . 2011-10-17 16:26 -------- d-----w- c:\program files (x86)\Adobe Media Player
2011-10-17 16:25 . 2011-10-17 16:25 -------- d-----w- c:\users\Karca\Adobe Bridge CS4
2011-10-17 16:24 . 2011-10-17 16:24 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2011-10-17 16:24 . 2011-10-17 16:24 -------- d-----w- c:\users\Karca\Adobe Extension Manager CS4
2011-10-17 16:23 . 2011-10-17 16:23 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2011-10-17 16:23 . 2011-10-17 16:52 -------- d-----w- c:\program files\Common Files\Adobe
2011-10-17 16:21 . 2011-10-17 16:21 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
2011-10-17 16:18 . 2011-10-17 16:26 -------- d-----w- c:\programdata\Protexis
2011-10-17 16:17 . 2011-10-17 16:18 -------- d-----w- c:\users\Karca\AppData\Roaming\Corel
2011-10-17 16:11 . 2011-10-17 16:11 -------- d-----w- c:\program files (x86)\Microsoft SDKs
2011-10-17 16:11 . 2011-10-17 16:11 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2011-10-17 16:09 . 2011-10-17 16:09 -------- d-----w- c:\program files (x86)\Common Files\Corel
2011-10-17 16:08 . 2011-10-17 16:18 -------- d-----w- c:\programdata\Corel
2011-10-17 16:08 . 2011-10-17 16:08 -------- d-----w- c:\program files (x86)\Common Files\Protexis
2011-10-17 15:58 . 2011-10-17 15:58 -------- d-----w- c:\program files (x86)\Corel
2011-10-16 17:22 . 2011-10-20 19:03 -------- d-----w- c:\users\Karca\AppData\Roaming\PSpad
2011-10-16 15:45 . 2011-10-16 15:45 -------- d-----w- c:\program files (x86)\PSPad editor
2011-10-01 02:41 . 2011-10-01 02:41 -------- d-----w- c:\users\Karca\AppData\Roaming\Babylon
2011-10-01 02:41 . 2011-10-01 02:41 -------- d-----w- c:\users\Karca\AppData\Local\Babylon
2011-10-01 02:41 . 2011-10-01 02:41 -------- d-----w- c:\programdata\Babylon
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-26 00:03 . 2011-09-26 00:03 107832 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-09-13 04:30 . 2011-09-13 04:30 37456 ----a-w- c:\windows\system32\drivers\avgrkx64.sys
2011-09-12 21:50 . 2011-09-12 21:50 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-16 06:48 . 2011-09-12 22:00 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9648DB63-A206-4864-B595-556F8020C3E8}\mpengine.dll
2011-08-08 04:08 . 2011-08-08 04:08 46672 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-10-27 05:23 1451336 ----a-w- c:\program files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-10-27 1451336]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableStatusMessages"= 1 (0x1)
"DisableStartupSound"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-09-12 5265248]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-17 1038088]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WMSVC;Služba webové správy;c:\windows\system32\inetsrv\wmsvc.exe [x]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2012\avgfws.exe [2011-08-19 2399560]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 MSSQL$EWAYSQL;SQL Server (EWAYSQL);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$SPRINXCRM;SQL Server (SPRINXCRM);c:\program files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 vToolbarUpdater;vToolbarUpdater;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-27 246600]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
TCP: Interfaces\{71615102-96F8-4337-899B-97C218EA612A}: NameServer = 10.0.0.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
FF - ProfilePath - c:\users\Karca\AppData\Roaming\Mozilla\Firefox\Profiles\6ku0smyu.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B0705a428-0111-4177-b1fa-fe03d8de2a05%7D&mid=4a45170d9431d8f96c6e90fd83ce9ac1-9a17500a96d428a5cdb8b2643968b9a928fc107f&ds=AVG&v=8.0.0.34.1&lang=cs&pr=pr&d=2011-10-27%2007%3A23%3A17&sap=ku&q=
FF - prefs.js: network.proxy.type - 4
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-10-30 23:25:29
ComboFix-quarantined-files.txt 2011-10-30 22:25
.
Před spuštěním: Volných bajtů: 51 740 078 080
Po spuštění: Volných bajtů: 51 688 079 360
.
- - End Of File - - A25FA64467568BAB84E7841EB5DC4850

VIRY.CZ

externí disk - vir

externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir

Re: externí disk - vir